Debian Binary Package MIME Type

What does application/vnd.debian.binary-package mean?

The application/vnd.debian.binary-package media type identifies a Debian binary package. Most such files use the .deb extension and contain software, configuration, documentation, package metadata, and sometimes scripts that run during installation. The less common .udeb variant is a reduced package used by the Debian installer, not an ordinary package for a running system.¹²

IANA registered the media type in 2014. The older names application/x-debian-package and application/x-deb are deprecated aliases, so new servers and applications should send the registered type.¹

How is a .deb file structured?

A modern .deb file is an ar archive whose first eight bytes are the ASCII signature !<arch>\n, or 21 3C 61 72 63 68 3E 0A in hexadecimal. That signature alone identifies the outer ar container. A Debian package is distinguished by the required members that follow in this order:⁴

The two TAR members may use several compression methods. Current dpkg documentation permits Gzip, XZ, or Zstandard for control.tar; data.tar can additionally use bzip2 or LZMA. Tools should not assume a fixed suffix such as control.tar.gz.⁴

This ar-based format has been used since Debian 0.93. Debian 0.93 Release 5 arrived in March 1995 and was the project's first modern release built around dpkg package management.⁴⁵ The media type came much later, but it names that established package format.

How to inspect or open a Debian package

On Debian and related Linux distributions, dpkg-deb is the format-aware tool. It can show the control record, list payload paths, or extract a package without installing it:⁶

dpkg-deb --info package.deb
dpkg-deb --contents package.deb
dpkg-deb --extract package.deb output-directory

Use APT or another trusted package-management front end when you intend to install software. A generic archive utility may expose the outer members, but it does not validate dependencies, architecture, or package-management rules. Renaming a TAR or an arbitrary ar archive to .deb does not make it a valid Debian package.

Web browsers generally download .deb files rather than display their contents. That is appropriate for an installable binary container, so the absence of an in-browser renderer is not a compatibility problem.

Support in Poly

Poly recognizes the canonical application/vnd.debian.binary-package value and maps .deb filenames to its Debian-package archive type. It stores, syncs, shares, versions, and finds the file by name and ordinary file properties.

Poly does not unpack the ar container, parse the control record, list payload files, render a preview, or index archived content. The agent also cannot read the metadata, scripts, or payload. The registered .udeb extension and both deprecated media-type aliases are not present in Poly's MIME mapping, so those inputs may fall back to a generic type.

To inspect a package held in Poly, download it and use dpkg-deb or a trusted package manager. Do not confuse Poly's recognition of .deb with package validation or installation approval.

Security and authenticity

A Debian package can include maintainer scripts that execute commands with administrator privileges. IANA therefore recommends trusting the origin and using an authenticated Debian-format repository. It also warns that declared installed size is not protection against a malicious compression bomb.¹

APT authenticates repositories by verifying signed release metadata and the chain of hashes leading to packages. This protects against unauthorized mirror changes and network substitution. It does not mean APT has audited the package's code, and the normal repository model does not require each .deb to carry its own signature.⁷

Package metadata can also disclose useful system details. The filename and control record commonly expose package name, version, architecture, dependencies, and maintainer information. Sharing a private package may therefore reveal more than the program payload itself.

.deb, .udeb, source packages, and other package formats

These neighboring formats serve different jobs:

The control record includes an Architecture field. A value such as amd64 targets one Debian architecture, while all marks an architecture-independent package. Package relationships such as Depends are part of the package-management model, so extracting files from a .deb is not equivalent to installing it correctly.⁸

There is no universal conversion from an arbitrary installer to a safe Debian package. Archive conversion can preserve files while losing dependency rules, maintainer behavior, ownership, or distribution-specific integration. When possible, obtain a package built for the target distribution and release instead of converting another package format.