dpkgQuery and install .deb packages directly
dpkg is the low-level Debian package tool that apt drives. It installs or removes individual .deb files without fetching dependencies, and it's the fastest way to ask the local database what's installed, which package owns a file and what a package put on disk.
dpkg {-l|-L|-S|-s|-i|-r|-P|-V|--configure} [OPTIONS] [PACKAGE | FILE.deb | PATTERN]...You're auditing an Ubuntu server: list packages, then trace a binary and a config file back to their packages.
dpkgThe Debian package manager. Database in /var/lib/dpkg (status file + info/*.list).
A .deb is an ar archive with three members: debian-binary, control.tar (metadata: name, version, Depends, maintainer scripts preinst/postinst/prerm/postrm, md5sums and conffiles) and data.tar (the files). dpkg -i unpacks in two phases: unpack runs preinst and extracts data.tar to the filesystem, then configure runs postinst. Between them the package is 'unpacked' but not configured, which is the state you see after a dependency failure (iU in dpkg -l). The database is plain text: /var/lib/dpkg/status holds every package's state and metadata, and /var/lib/dpkg/info/<pkg>.list lists every file it owns, which is what -L and -S read. dpkg checks dependencies but never downloads anything; apt does that. Conffiles under /etc are tracked by checksum, so an upgrade asks before replacing one you edited. A lock on /var/lib/dpkg/lock stops two dpkg runs at once.
-l [PATTERN]List packages with their state (ii, rc, iU...)-L PKGList files installed by a package-S PATH|PATTERNFind the package that owns a file-s PKGStatus and metadata of an installed package-i FILE.debInstall (unpack + configure) a package file-r / -P PKGRemove (keep config) / purge (delete config too)-I / -c FILE.debShow a .deb's control info / list its contents-V [PKG]Verify installed files against stored md5sums--configure -aFinish configuring every unpacked package (after an interrupted install)--get-selectionsDump package selections (install/hold/deinstall)dpkg-query -W -f=FMTScript-friendly custom outputsudo dpkg -i app.deb and walking awaydpkg doesn't fetch dependencies, so the package can be left unpacked and unconfigured (iU), blocking apt.
sudo apt install ./app.debdpkg -l | grep nginx to check whether nginx is installedrc (removed, config left) and un rows also match, so a removed package looks installed.
dpkg-query -W -f='${Status}\n' nginx # 'install ok installed' or notEditing /var/lib/dpkg/status by hand to 'fix' a broken packageOne wrong field corrupts the database for every package.
sudo dpkg --configure -a; sudo apt -f installdpkg -r to remove a package with dependentsdpkg refuses with 'dependency problems - not removing', and --force-depends leaves the system broken.
sudo apt remove <pkg> # shows and removes dependents explicitlyTry these on a Linux machine of your own. Each task has a hint and a solution.
Find which package installed /usr/bin/ss and list every file in that package that lives under /usr/bin or /usr/sbin.
Show the installed version of bash using a script-friendly format: just the version string.
List the five largest installed packages by installed size.
Check whether any files from the coreutils package were modified or deleted.
dpkgQuery and install .deb packages directly
dpkg is the low-level Debian package tool that apt drives. It installs or removes individual .deb files without fetching dependencies, and it's the fastest way to ask the local database what's installed, which package owns a file and what a package put on disk.
dpkg {-l|-L|-S|-s|-i|-r|-P|-V|--configure} [OPTIONS] [PACKAGE | FILE.deb | PATTERN]...You're auditing an Ubuntu server: list packages, then trace a binary and a config file back to their packages.
dpkgThe Debian package manager. Database in /var/lib/dpkg (status file + info/*.list).
A .deb is an ar archive with three members: debian-binary, control.tar (metadata: name, version, Depends, maintainer scripts preinst/postinst/prerm/postrm, md5sums and conffiles) and data.tar (the files). dpkg -i unpacks in two phases: unpack runs preinst and extracts data.tar to the filesystem, then configure runs postinst. Between them the package is 'unpacked' but not configured, which is the state you see after a dependency failure (iU in dpkg -l). The database is plain text: /var/lib/dpkg/status holds every package's state and metadata, and /var/lib/dpkg/info/<pkg>.list lists every file it owns, which is what -L and -S read. dpkg checks dependencies but never downloads anything; apt does that. Conffiles under /etc are tracked by checksum, so an upgrade asks before replacing one you edited. A lock on /var/lib/dpkg/lock stops two dpkg runs at once.
-l [PATTERN]List packages with their state (ii, rc, iU...)-L PKGList files installed by a package-S PATH|PATTERNFind the package that owns a file-s PKGStatus and metadata of an installed package-i FILE.debInstall (unpack + configure) a package file-r / -P PKGRemove (keep config) / purge (delete config too)-I / -c FILE.debShow a .deb's control info / list its contents-V [PKG]Verify installed files against stored md5sums--configure -aFinish configuring every unpacked package (after an interrupted install)--get-selectionsDump package selections (install/hold/deinstall)dpkg-query -W -f=FMTScript-friendly custom outputsudo dpkg -i app.deb and walking awaydpkg doesn't fetch dependencies, so the package can be left unpacked and unconfigured (iU), blocking apt.
sudo apt install ./app.debdpkg -l | grep nginx to check whether nginx is installedrc (removed, config left) and un rows also match, so a removed package looks installed.
dpkg-query -W -f='${Status}\n' nginx # 'install ok installed' or notEditing /var/lib/dpkg/status by hand to 'fix' a broken packageOne wrong field corrupts the database for every package.
sudo dpkg --configure -a; sudo apt -f installdpkg -r to remove a package with dependentsdpkg refuses with 'dependency problems - not removing', and --force-depends leaves the system broken.
sudo apt remove <pkg> # shows and removes dependents explicitlyTry these on a Linux machine of your own. Each task has a hint and a solution.
Find which package installed /usr/bin/ss and list every file in that package that lives under /usr/bin or /usr/sbin.
Show the installed version of bash using a script-friendly format: just the version string.
List the five largest installed packages by installed size.
Check whether any files from the coreutils package were modified or deleted.