How to get vendor name of debian based linux packages?

Question

rpm based Linux distribution give's vendor name like:

rpm -qi nano
<other info>
Vendor: CentOS
<other info>

How can I get vendor names for the packages in Debian based distribution? Already tried:

dpkg -l
apt list
apt show <package name>

I need vendor name cause I am writing a script which would create CPE's of every package in my system, I was able to get package name & version but incapable of getting vendor names, If anyone knew how to get cpes from Debian based packages please help me...

Answer 1

.deb packages don’t track vendors per package; the closest equivalent is the “Origin” field of the Release file describing the repository from which the package can be downloaded.

To figure this out, start with apt show:

$ apt show ... | grep APT-Sources:
APT-Sources: http://deb.debian.org/debian buster/main amd64 Packages

Then look for the corresponding Release file in /var/lib/apt/lists:

$ ls /var/lib/apt/lists/deb.debian.org_debian_dists_buster_*Release
/var/lib/apt/lists/deb.debian.org_debian_dists_buster_InRelease

Finally, look for “Origin” there:

$ grep Origin: /var/lib/apt/lists/deb.debian.org_debian_dists_buster_InRelease
Origin: Debian

Answer 2

Debian/Ubuntu maintainers don't save this info. apt-cache show packagename shows information which is comparable to rpm -qi but there's no Vendor per se, only Maintainer which is not what you're looking for.