2

I'd like to use a piece of software that's only available through a .deb package. I don't usually like these methods because I'm afraid they can mess up my Debian system into some kind of Frankendebian, so I'd like to know if there's some way I could look into the installation process of dpkg -i in order to see what changes it's going to make on my system. Would something such as dpkg --dry-run -i work for this?

Is it completely safe to install software through dpkg?

Thanks.

Improve this question
1

2 Answers 2

Reset to default
2

You can extract package (as bodo suggested in comments) or dive into it using mc. Then you can see which files will be installed (CONTENTS) and what scripts will run (DEBIAN/preinst, DEBIAN/postinst).

Off course, it's not safe to install untrusted packages, because packages are always installed as superuser and preinst script can do anything, even rm -rf /

Improve this answer
4
  • Thanks. I've been reading the Debian Administrator's Handbook section on dpkg and I'll try the --listfiles (-L) and --info (-I) options to check what files it's going to install and where. It's a trusted package (it's a well-known cypto wallet), but I'd rather keep things clean and avoid installing software as root, so I'll use either the .AppImage or the .zip file, which can be unpacked and run out-of-the-box, without modifying my system.
    – 3435
    Jul 25, 2019 at 11:47
  • AFAIK, --listfiles works only with installed packages
    – WhiteWind
    Jul 25, 2019 at 12:09
  • If it runs from a .ZIP, then it is self-contained and the .deb won't be dragging other packages. In my experience, AppImage may not be well integrated with your system (which is a requirement for a wallet), IMHO they are OK only if a regular install is not possible.
    – xenoid
    Jul 25, 2019 at 12:41
  • 1
    @xenoid, aren't AppImage files intended to be self-contained? As far as I know, AppImage, Flatpak and Snap packages are the preferred way over having to change the whole system.
    – 3435
    Jul 25, 2019 at 13:26
1

As stated in the Wiki you point to, to create a FrankenDebian you have to add "alien" repositories. Installing a package with dpkg will use the current declared repos and should be safe. If the .deb requires software releases that aren't in your current repos, it won't install. The whole point of pdkg/apt/.deb (from the same people you trust with your OS....) is to make installs easy and safe... It's going manual which is dangerous.

Improve this answer
1
  • To give an example, some days ago I installed NordVPN client on my Debian using their .deb file, and during the process they changed my sources.list file to add their own repository and they made some changes in important files such as resolv.conf, which is used by different services (they made it immutable and other services couldn't overwrite it). That's why I don't trust the changes some .deb files make.
    – 3435
    Jul 25, 2019 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.