The .deb format is the Debian binary package file format. It is understood since dpkg 0.93.76, and is generated by default since dpkg 1.2.0 and 1.1.1elf (i386/ELF builds).
The format described here is used since Debian 0.93; details of the old format are described in deb-old(5).
The file is an ar archive with a magic value of !<arch>. Only the common ar archive format is supported, with no long file name extensions, but with file names containing an optional trailing slash, which limits their length to 15 characters (from the 16 allowed). File sizes are limited to 10 ASCII decimal digits, allowing for up to approximately 9536.74 MiB member files.
The tar archives currently allowed are, the old-style (v7) format, the pre-POSIX ustar format, a subset of the GNU format (new style long pathnames and long linknames, supported since dpkg 220.127.116.11; large file metadata since dpkg 1.18.24), and the POSIX ustar format (long names supported since dpkg 1.15.0). Unrecognized tar typeflags are considered an error. Each tar entry size inside a tar archive is limited to 11 ASCII octal digits, allowing for up to 8 GiB tar entries. The GNU large file metadata support permits 95-bit tar entry sizes and negative timestamps, and 63-bit UID, GID and device numbers.
The first member is named debian-binary and contains a series of lines, separated by newlines. Currently only one line is present, the format version number, 2.0 at the time this manual page was written. Programs which read new-format archives should be prepared for the minor number to be increased and new lines to be present, and should ignore these if this is the case.
If the major number has changed, an incompatible change has been made and the program should stop. If it has not, then the program should be able to safely continue, unless it encounters an unexpected member in the archive (except at the end), as described below.
The second required member is named control.tar. It is a tar archive containing the package control information, either not compressed (supported since dpkg 1.17.6), or compressed with gzip (with .gz extension) or xz (with .xz extension, supported since 1.17.6), as a series of plain files, of which the file control is mandatory and contains the core control information, the md5sums, conffiles, triggers, shlibs and symbols files contain optional control information, and the preinst, postinst, prerm and postrm files are optional maintainer scripts. The control tarball may optionally contain an entry for ‘.’, the current directory.
The third, last required member is named data.tar. It contains the filesystem as a tar archive, either not compressed (supported since dpkg 1.10.24), or compressed with gzip (with .gz extension), xz (with .xz extension, supported since dpkg 1.15.6), bzip2 (with .bz2 extension, supported since dpkg 1.10.24) or lzma (with .lzma extension, supported since dpkg 1.13.25).
These members must occur in this exact order. Current implementations should ignore any additional members after data.tar. Further members may be defined in the future, and (if possible) will be placed after these three. Any additional members that may need to be inserted after debian-binary and before control.tar or data.tar and which should be safely ignored by older programs, will have names starting with an underscore, ‘_’.
Those new members which won't be able to be safely ignored will be inserted before data.tar with names starting with something other than underscores, or will (more likely) cause the major version number to be increased.
deb-old(5), dpkg-deb(1), deb-control(5), deb-conffiles(5), deb-md5sums(5), deb-triggers(5), deb-shlibs(5), deb-symbols(5), deb-preinst(5), deb-postinst(5), deb-prerm(5), deb-postrm(5).
deb2solv(1), deb-control(5), deb-old(5), deb-split(5), deb-version(7), dpkg(1), dpkg-deb(1), dpkg-name(1), dpkg-split(1), dselect(1), fakeroot(1), fakeroot-pseudo(1).