I installed php5-fpm package using apt; then I made some changes to the PHP configuration files.

Now I would get the diffs between the original files versions (the ones of the package installed) and the current versions (modified by me). How to do it?

  • It is hard to understand what exactly you want to know. It is not even clear what your situation is. – Hauke Laging Apr 17 '13 at 11:01
  • I don't know if apt can tell you that, but what I do recommend is to put /etc under revision control (I use mercurial for that) and add and commit on a regular basis. That way you can roll back to original files, or to intermediate changed states and with hg diff you can see changes. If you cannot find a way to do this with apt, backup your changed files, reinstall the packag(es), bring the config files under revision control and copy back your changes. After that you can do a diff. – Anthon Apr 17 '13 at 11:03
  • @HaukeLaging I am not good at english, I'm sorry – mdesantis Apr 17 '13 at 14:18
  • Duplicate of superuser.com/questions/10997/… – reinierpost Apr 23 '15 at 11:17
  • 1
    @reinierpost no it isn't. I want the diffs. – mdesantis Apr 28 '15 at 8:58

Try something like this:

# exit on failure
set -e

mkdir $package
cd $package

# you could also get the file from a package mirror if you have
#  an older version of apt-get that doesn't support 'download' 
#  or if you would like more control over what package version
#  you are downloading.
# (e.g. http://archive.ubuntu.com/ubuntu/pool/main/)
apt-get download $package

# deb package files are ar archives
ar vx ${package}*.deb
# containing some compressed tar archives
tar xzf data.tar.gz
# now you have the files

# you can get diffs for all of the files in etc if you would like
find etc -type f |
while read file ; do
    diff $file /$file

As suggested by others, definitely put your configuration files under revision control. That way, you can see exactly what you changed and when you changed it.

  • Thank you! I had to modify a bit the code: gist.github.com/ProGNOMmers/5404609 if you update your question with working code I will be happy to accept it – mdesantis Apr 17 '13 at 14:13
  • I'm glad my solution worked for you. I have included your changes and fixes in my code. – user26112 Apr 17 '13 at 14:44
  • 1
    tar xzf data.tar.gz should be tar xf data.tar.xz for recent Ubuntu – Znarkus Apr 26 '16 at 10:45
  • 2
    You could use dpkg-deb -x ${package}_*.deb . instead of using ar and tar. Also apt-get download $(dpkg-query -W -f='${binary:Package}=${Version}' $package) will make sure you grab the currently installed version rather than the latest, for example if you are doing this just before doing an upgrade. – pix Sep 19 '17 at 3:52

etc directory

For tracking changes to your /etc directory you can do as @Anthon has suggested and use git, subversion, mercurial, etc. to version control that directory. You can also use a tool such as etckeeper. There's a tutorial here as well as here.

etckeeper is a collection of tools to let /etc be stored in a git, mercurial, bazaar or darcs repository. It hooks into apt to automatically commit changes made to /etc during package upgrades. It tracks file metadata that git does not normally support, but that is important for /etc, such as the permissions of /etc/shadow. It's quite modular and configurable, while also being simple to use if you understand the basics of working with version control.

package files

To my knowledge apt does not have a way to check the files on disk vs. the files that are in the actual .deb. Neither does dpkg, the tool that apt is actually using to do the management of files.

However you can use a tool such as debsums to compare some of the files you have installed, it only looks at their checksums (md5sum) of what's in the .deb file vs. what's on your systems disk.

See this serverfault question for more details about debsum and dpkg checksumming, as well as this askubuntu question.

debsum example

% debsums openssh-server
/usr/lib/openssh/sftp-server                                                  OK
/usr/sbin/sshd                                                                OK
/usr/share/lintian/overrides/openssh-server                                   OK
/usr/share/man/man5/sshd_config.5.gz                                          OK
/usr/share/man/man8/sshd.8.gz                                                 OK
/usr/share/man/man8/sftp-server.8.gz                                          OK
  • thank you a lot! I didn't know about the practice to keep /etc under revision control, and etckeeper seems the right solution in order to manage it; I will adopt it – mdesantis Apr 17 '13 at 14:16
  • 2
    Note that the OP will need to run debsums -a, otherwise configuration files will be excluded from the check. – Dmitry Grigoryev Jan 6 '17 at 9:51
  • 1
    @DmitryGrigoryev debums -ce is perfect to find which (configuration) files to look at. – 0xC0000022L Nov 19 '18 at 19:03

I wrote the following simple script to automatically retrieve the original file from the right Debian package and diff the current file against it: https://a3nm.net/git/mybin/tree/debdiffconf

Use it as follows: debdiffconf FILE


# Usage: debdiffconf.sh FILE
# Produce on stdout diff of FILE against the first installed Debian package
# found that provides it.
# Returns the exit code of diff if everything worked, 3 or 4 otherwise.

command -v apt-get >/dev/null 2>&1 || {
  echo "apt-get not found, this is probably not a Debian system. Aborting." >&2;
  exit 4; }
command -v apt-file >/dev/null 2>&1 || {
  echo "Please install apt-file: sudo apt-get install apt-file. Aborting." >&2;
  exit 4; }

FILE=$(readlink -f "$1")
while read PACKAGE
  # verify from first installed package
  if dpkg-query -W --showformat='${Status}\n' | grep installed > /dev/null
    DIR=$(mktemp -d)
    cd "$DIR"
    echo "Trying $PACKAGE..." >&2
    apt-get download "$PACKAGE" >&2
    # downloaded archive is the only file present...
    mkdir contents
    # extract entire archive
    dpkg-deb -x "$ARCHIVE" contents/ >&2
    if [ -f "contents$FILE" ]
      # package contained required file
      diff "contents$FILE" "$FILE"
      # cleanup
      rm -Rf "$DIR"
      # exit entire script as this is the main shell
      # with the return code from diff
      exit $RET
      # cleanup
      rm -Rf "$DIR"
done < <(apt-file -l search "$FILE")
# if we are here, it means we have found no suitable package
echo "Could not find original package for $FILE" >&2
exit 3
  • Your script also requires realpath package installed. – Mxx Oct 14 '14 at 21:06
  • @Mxx: thanks, adding a check for this package, although starting with Debian jessie it seems that coreutils is providing a `realpath' command. – a3nm Oct 15 '14 at 7:25
  • It was missing on Ubuntu. – Mxx Oct 15 '14 at 7:32
  • Here is mine. – reinierpost Nov 9 '15 at 17:10
  • 1
    Unfortunately, this only works for packages that come from repositories with a Contents file. Otherwise, excellent script! – Martijn Pieters Apr 11 '17 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.