How do I check if I have the exact same deb as installed on a system

Question

When building packages for internal company projects, sometimes we loose track of the package source and only have the binary .deb. Even worse, the package builder may install it onto a production system but forget to drop it in yum and later leave the company. Some point in the future we need to build a new server and want to ensure that the .deb we found in the engineer's home directory exactly matches the one on existing servers. Is there a way to find out if the .deb is the exact same one?

On rpm based systems I would do the following

old-server$ rpm -qi foo

new-server$ rpm -qi -p foo-1.2.3.rpm

and compare the size, build date, build host and if they match, then I know I have the exact rpm I need.

Is there an equivalent way of doing this on dpkg based systems?

I see that dpkg-query can return an MD5 of some data, but the manual page says it's related to dselect and I'm unable to get any data from it.

Answer 1

You could do a dpkg -l <packagename> and see if the package is installed and what version it is. This may not work if you don't have some sort of guidelines for version numbers and such (eg. when making changes to the code and releasing/installing, you should bump the version number)

Answer 2

I guess comparing the installed files on the system with the files inside the package should give you a good idea? You can extract files from a *.deb with dpkg -x <deb-filename> <directory-to-extract-in> and you can list all files installed by an installed package with dpkg -L <package-name>.

When you have this info, you should be able to compare filenames, file dates, checksums, or whatever you want...