Pacchetti .deb per Svogliati

$ ar t nginx_1.24.0-2_amd64.deb
debian-binary
control.tar.xz
data.tar.xz

# Estrazione completa per ispezione
$ mkdir extract && cd extract
$ ar x ../nginx_1.24.0-2_amd64.deb
$ ls -la
# debian-binary  control.tar.xz  data.tar.xz

$ cat debian-binary
2.0
# È un file di testo con DUE byte significativi: "2.0\n"

Package: myapp
Version: 1.2.3-1
Architecture: amd64
Maintainer: Tuo Nome <[email protected]>
Installed-Size: 4567
Depends: python3 (>= 3.10), nginx (>= 1.18), libssl3
Recommends: postgresql-client
Suggests: redis-server
Conflicts: myapp-legacy
Replaces: myapp-legacy
Provides: webapp-runtime
Section: web
Priority: optional
Homepage: https://myapp.example.com
Description: Web dashboard per qualcosa di utile
 Riga lunga con un paragrafo iniziale che riassume il pacchetto.
 .
 Secondo paragrafo (il punto su una riga indica riga vuota).
 Caratteri di continuazione sempre con uno spazio iniziale.

#!/bin/sh
set -e

case "$1" in
    configure)
        # 1. Crea utente di sistema (se non esiste)
        if ! getent passwd myapp >/dev/null; then
            adduser --system --group \
                --home /var/lib/myapp \
                --no-create-home \
                --shell /usr/sbin/nologin \
                myapp
        fi

        # 2. Crea directory di stato con i permessi giusti
        install -d -m 0750 -o myapp -g myapp /var/lib/myapp
        install -d -m 0750 -o myapp -g myapp /var/log/myapp

        # 3. Genera secret se non esiste (idempotente!)
        if [ ! -f /etc/myapp/secret ]; then
            head -c 32 /dev/urandom | base64 > /etc/myapp/secret
            chmod 0640 /etc/myapp/secret
            chown root:myapp /etc/myapp/secret
        fi

        # 4. systemd: enable + (re)start
        deb-systemd-helper enable myapp.service >/dev/null || true
        if [ -d /run/systemd/system ]; then
            systemctl daemon-reload >/dev/null || true
            deb-systemd-invoke restart myapp.service >/dev/null || true
        fi
        ;;

    abort-upgrade|abort-remove|abort-deconfigure)
        # Niente da fare; un altro script gestirà il rollback
        ;;

    *)
        echo "postinst chiamato con argomento ignoto: $1" >&2
        exit 1
        ;;
esac

exit 0

#!/bin/sh
set -e

case "$1" in
    purge)
        # Solo a purge: rimuovi conffile, dati, utente
        rm -rf /var/lib/myapp /var/log/myapp /etc/myapp
        if getent passwd myapp >/dev/null; then
            deluser --quiet myapp 2>/dev/null || true
        fi
        deb-systemd-helper purge myapp.service >/dev/null || true
        ;;

    remove)
        # Stop senza purge: lascia conffile e dati
        deb-systemd-helper mask myapp.service >/dev/null || true
        ;;

    upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
        ;;

    *)
        echo "postrm chiamato con argomento ignoto: $1" >&2
        exit 1
        ;;
esac

exit 0

/etc/myapp/config.yaml
/etc/myapp/logging.conf
/etc/logrotate.d/myapp
/etc/cron.daily/myapp-cleanup

Package: myapp
Version: 1.0.0-1
Section: web
Priority: optional
Architecture: amd64
Depends: python3 (>= 3.10), python3-flask
Maintainer: Selif Dev <[email protected]>
Description: Web app per fare cose
 Una piccola web app Flask che serve come esempio.
 Non fa niente di utile, ma fa qualcosa.

$ dpkg-deb --build --root-owner-group myapp_1.0.0
dpkg-deb: building package 'myapp' in 'myapp_1.0.0.deb'.

# Convenzione di naming:
$ mv myapp_1.0.0.deb myapp_1.0.0-1_amd64.deb

# Lista file (con permessi e owner)
$ dpkg-deb -c myapp_1.0.0-1_amd64.deb

# Mostra il control
$ dpkg-deb -I myapp_1.0.0-1_amd64.deb

# Estrai data in /tmp/x
$ dpkg-deb -x myapp_1.0.0-1_amd64.deb /tmp/x

# Estrai control in /tmp/c
$ dpkg-deb -e myapp_1.0.0-1_amd64.deb /tmp/c

# Lint check (richiede "apt install lintian")
$ lintian myapp_1.0.0-1_amd64.deb

# Install + test
$ sudo apt install ./myapp_1.0.0-1_amd64.deb
# NB: "./" obbligatorio per dirgli "file locale, non repo"

Source: myapp
Section: web
Priority: optional
Maintainer: Selif Dev <[email protected]>
Build-Depends: debhelper-compat (= 13), dh-python, python3-all
Standards-Version: 4.6.2
Homepage: https://myapp.example.com
Rules-Requires-Root: no

Package: myapp
Architecture: all
Depends: ${misc:Depends}, ${python3:Depends}, python3-flask
Description: Web app per fare cose
 Una piccola web app Flask...

#!/usr/bin/make -f
# Tutto il vero lavoro lo fa dh, queste 3 righe sono il pacchetto completo.

%:
	dh $@

#!/usr/bin/make -f

%:
	dh $@ --with python3 --buildsystem=pybuild

override_dh_auto_test:
	# Salta i test in build (tipico se servono rete/db)

override_dh_install:
	dh_install
	# Crea directory di stato vuota
	install -d -m 0750 debian/myapp/var/lib/myapp

myapp.py            usr/lib/myapp/
bin/myapp           usr/bin/
config.yaml         etc/myapp/
templates/          usr/share/myapp/

myapp (1.2.0-1) unstable; urgency=medium

  * Nuova feature: export PDF dei report.
  * Bugfix: timeout del client SMTP elevato a 30s.
  * Refactoring del modulo auth.

 -- Selif Dev <[email protected]>  Wed, 30 Apr 2026 14:23:01 +0200

myapp (1.1.5-1) unstable; urgency=high

  * Security fix: CVE-2026-12345 (XSS nella pagina /search).

 -- Selif Dev <[email protected]>  Mon, 22 Apr 2026 09:00:00 +0200

# Prima entry (crea il file)
$ dch --create --package myapp --newversion 1.0.0-1 \
       "Initial release."

# Nuova versione (incrementa Debian revision)
$ dch -i "Bugfix nel modulo X."

# Nuova versione upstream
$ dch -v 1.2.0-1 "New upstream release"

# Marca pronta per release (cambia "UNRELEASED" in "unstable")
$ dch -r ""

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: myapp
Upstream-Contact: Selif Dev <[email protected]>
Source: https://git.example.com/myapp

Files: *
Copyright: 2026 Selif Dev <[email protected]>
License: MIT

Files: debian/*
Copyright: 2026 Selif Dev <[email protected]>
License: MIT

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
 "Software"), to deal in the Software without restriction, including
 without limitation the rights to use, copy, modify, merge, publish,
 ...

# Prerequisiti: una volta sola
$ sudo apt install build-essential debhelper devscripts dh-make lintian

# Dentro la directory source (con debian/ presente)
$ cd myapp-1.0.0/

# Installa build-deps dichiarate in debian/control
$ sudo apt build-dep .
# equivalente a: leggi Build-Depends, apt install ognuno

# Build (binary only, senza firma)
$ dpkg-buildpackage -us -uc -b
#   -us: don't sign source
#   -uc: don't sign .changes
#   -b:  binary only (no source tarball)

# Output: tutto nella parent directory
$ ls ../
myapp-1.0.0/
myapp_1.0.0-1_amd64.deb         # <-- ecco il tuo .deb
myapp_1.0.0-1_amd64.buildinfo
myapp_1.0.0-1_amd64.changes

$ sudo apt install pbuilder

# Setup: crea base chroot (una volta per distro target)
$ sudo pbuilder create --distribution trixie \
                       --basetgz /var/cache/pbuilder/trixie-base.tgz

# Build di un pacchetto (a partire dal .dsc generato da dpkg-buildpackage -S)
$ dpkg-buildpackage -S -us -uc          # source package → .dsc
$ sudo pbuilder build ../myapp_1.0.0-1.dsc \
                       --basetgz /var/cache/pbuilder/trixie-base.tgz

# Output in /var/cache/pbuilder/result/
$ ls /var/cache/pbuilder/result/
myapp_1.0.0-1_amd64.deb
myapp_1.0.0-1_amd64.changes

name: build-deb

on: [push, pull_request]

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        distro: [bookworm, trixie]
    container: debian:${{ matrix.distro }}
    steps:
      - uses: actions/checkout@v4
      - name: Install build prereqs
        run: |
          apt update
          apt install -y build-essential debhelper devscripts lintian
          apt build-dep -y .
      - name: Build .deb
        run: dpkg-buildpackage -us -uc -b
      - name: Lintian check
        run: lintian ../*.deb || true
      - uses: actions/upload-artifact@v3
        with:
          name: deb-${{ matrix.distro }}
          path: ../*.deb

$ sudo apt install piuparts
$ sudo piuparts -d trixie myapp_1.0.0-1_amd64.deb
# Esegue install/remove/install/purge ciclo completo
# PASS = nessuna sorpresa

$ sudo apt install reprepro

$ mkdir -p ~/myrepo/conf
$ cat > ~/myrepo/conf/distributions <<EOF
Origin: Selif
Label: Selif Repo
Codename: trixie
Suite: stable
Architectures: amd64 arm64 source
Components: main
Description: Selif personal package repository
SignWith: ABCDEF1234567890     # GPG key ID
EOF

# Aggiungi un .deb al repo
$ cd ~/myrepo
$ reprepro includedeb trixie /path/to/myapp_1.0.0-1_amd64.deb

# Lista pacchetti
$ reprepro list trixie

# Rimuovi
$ reprepro remove trixie myapp

$ gpg --batch --quick-gen-key "Selif Repo <[email protected]>" rsa4096

$ gpg --list-keys
# Cerca la riga "pub": ABCDEF1234567890... <-- key ID

# Esporta la chiave pubblica (questa la pubblichi)
$ gpg --armor --export ABCDEF1234567890 > selif-repo.gpg

# È un file di testo, lo metti su https://repo.example.com/gpg

# 1. Scarica la chiave pubblica
$ sudo install -d -m 0755 /etc/apt/keyrings
$ curl -fsSL https://repo.example.com/gpg \
    | sudo tee /etc/apt/keyrings/selif.asc > /dev/null

# 2. Aggiungi la sources list (sintassi nuova: signed-by inline)
$ echo "deb [signed-by=/etc/apt/keyrings/selif.asc] https://repo.example.com/debian trixie main" \
    | sudo tee /etc/apt/sources.list.d/selif.list

# 3. Aggiorna e installa
$ sudo apt update
$ sudo apt install myapp

$ dpkg --compare-versions 1.0.0~rc1 lt 1.0.0 && echo yes
yes

$ dpkg --compare-versions 1.0.0-1 lt 1.0.0-2 && echo yes
yes

$ dpkg --compare-versions 2:0.5 gt 1:99.9 && echo yes
yes
# Epoch 2 batte epoch 1 anche se i numeri parlano contrario

$ dpkg --compare-versions 1.0.0+dfsg1-1 gt 1.0.0-1 && echo yes
yes

$ sudo DEBIAN_FRONTEND=noninteractive apt-get upgrade -y \
       -o Dpkg::Options::="--force-confold"
#                              ^ tieni la versione locale
# Alternative:
#   --force-confnew  → sovrascrivi con la nuova maintainer
#   --force-confdef  → usa default (rispetta scelte già fatte)

$ dpkg-deb -I pkg.deb              # control + info
$ dpkg-deb -c pkg.deb              # lista file con permessi
$ dpkg-deb -e pkg.deb /tmp/ctrl/   # estrai control + scripts
$ dpkg-deb -x pkg.deb /tmp/data/   # estrai i file (data)

$ ar t pkg.deb                     # i 3 membri ar
$ ar x pkg.deb                     # estrai i 3 membri

$ dpkg -l                          # tutti i pacchetti
$ dpkg -l nginx                    # info su uno specifico
$ dpkg -L nginx                    # tutti i file installati da nginx
$ dpkg -s nginx                    # status + control
$ dpkg -S /etc/nginx/nginx.conf   # quale pkg possiede questo file?
$ dpkg --verify nginx              # confronta md5sums vs filesystem

$ apt-cache depends nginx          # di cosa nginx ha bisogno
$ apt-cache rdepends nginx         # chi dipende da nginx
$ apt-cache policy nginx           # versione installata + candidate + sorgenti

$ apt-mark hold nginx              # blocca upgrade automatici
$ apt-mark unhold nginx            # sblocca
$ apt-mark showhold                # lista pacchetti held

$ mkdir -p mypkg/DEBIAN mypkg/usr/bin

$ cat > mypkg/DEBIAN/control <<EOF
Package: mypkg
Version: 1.0.0-1
Section: utils
Priority: optional
Architecture: all
Maintainer: Me <[email protected]>
Description: Test package
EOF

$ cp myapp mypkg/usr/bin/
$ chmod 0755 mypkg/usr/bin/myapp

$ dpkg-deb --build --root-owner-group mypkg
$ mv mypkg.deb mypkg_1.0.0-1_all.deb

$ sudo apt install ./mypkg_1.0.0-1_all.deb

$ sudo apt install build-essential debhelper devscripts dh-make lintian

$ cd mypackage-1.0.0/

# Genera scheletro debian/ (interattivo)
$ dh_make --native --single --packagename mypackage_1.0.0

# Edita debian/{control,changelog,rules,copyright}

$ sudo apt build-dep .
$ dpkg-buildpackage -us -uc -b
$ lintian ../mypackage_1.0.0-1_amd64.deb

$ lintian pkg.deb                   # style/policy check
$ sudo piuparts -d trixie pkg.deb   # install/remove/upgrade in chroot

# Install di test in container Docker
$ docker run --rm -v $PWD:/p debian:trixie \
    sh -c "apt update && apt install -y /p/pkg.deb && /p/test.sh"

$ sudo apt install reprepro
$ mkdir -p ~/myrepo/conf
$ cat > ~/myrepo/conf/distributions <<EOF
Origin: Me
Label: My Repo
Codename: trixie
Architectures: amd64 arm64 source
Components: main
SignWith: ABCDEF1234567890
EOF

$ cd ~/myrepo
$ reprepro includedeb trixie /path/to/pkg.deb
$ reprepro list trixie

# Ora ~/myrepo/dists e ~/myrepo/pool sono pronti
# Pubblica con: rsync -a ~/myrepo/ user@host:/var/www/repo/

$ sudo DEBIAN_FRONTEND=noninteractive apt-get upgrade -y \
       -o Dpkg::Options::="--force-confold" \
       -o Dpkg::Options::="--force-confdef"