Vol. I · No. 46The command line sectionSat, 10 Oct 2026
Linux · packages & software

dpkg

the tool beneath apt

dpkg is the low-level tool that apt drives. It installs one .deb file you already have, without fetching dependencies, and it is the way to ask "what is installed?" and "which package put this file here?"

apt fetches and resolves; dpkg unpacks and keeps the records.

List installed
dpkg -l
every package
Files in a package
dpkg -L NAME
where it put things
Owner of a file
dpkg -S PATH
which package
Install a file
dpkg -i file.deb
no dependency download

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashdpkg
$ dpkg -l | grep openssh
1ii openssh-client 1:9.6p1-3ubuntu13.5 amd64 secure shell (SSH) client
ii openssh-server 1:9.6p1-3ubuntu13.5 amd64 secure shell (SSH) server
2$ dpkg -S /usr/bin/ssh
openssh-client: /usr/bin/ssh
3$ dpkg -L tree | head -3
/.
/usr
/usr/bin
4$ sudo dpkg --verify openssh-server
Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range
Reading the output

What the numbered lines are telling you

1
ii means installed

The first column is the state, then the name, version, architecture and description.

2
Which package owns a file

/usr/bin/ssh came from openssh-client. Useful for finding what to reinstall, or where a strange file came from.

3
What a package installed

Every path the package created, starting from the root.

4
No output is good news

--verify compares installed files with what the package shipped. Silence means nothing has been altered.

Switches

A switch changes how the command behaves. These are the ones used day to day; man dpkg lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-i FILE
Install a .deb file.
-r NAME
Remove a package, keeping its configuration.
-P NAME
Purge: remove a package and its configuration.
-l
List installed packages.
-L NAME
List the files a package installed.
-S PATH
Find the package that owns a file.
-s NAME
Show a package’s status and details.
--verify
Check installed files against the package’s records.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

sudo dpkg -i package.deb

Installs a downloaded .deb file.

sudo apt install -f

Fetches the dependencies a dpkg -i left missing.

dpkg -s nginx

Shows the status and details of one installed package.

dpkg -c package.deb

Lists the files inside a .deb before installing it.

In cybersecurity

A .deb installed by hand skips every check the repositories provide.

A package runs scripts as root

Installation scripts inside a .deb execute as root. A package from an untrusted source is a root shell handed to its author.

It will not be updated

Software installed with dpkg -i from a download has no repository behind it, so security fixes never arrive unless you fetch them.

Verify system files

"dpkg --verify" lists files that differ from the packaged originals — a quick test for binaries replaced by an intruder.

Filed under

Packages & software

Read alongside

aptInstalls, updates and removes software on Debian, Ubuntu and their relatives.dnfInstalls, updates and removes software on Fedora, RHEL, Rocky and AlmaLinux.