Checking installed package integrity on Debian and Ubuntu with debsums and dpkg --verify

Goal

Find out whether a file on disk still matches what its Debian/Ubuntu package installed, identify which package owns a suspicious file, and repair a package whose files were modified or deleted outside apt/dpkg.

Prerequisites

apt-get install debsums; dpkg's own metadata is present by default and needs no extra package for --verify, -S or -L.

Steps

1. Check every installed package's files against the checksums recorded at build time: debsums -s (quiet, only report problems). debsums is described as verifying "installed Debian package files against MD5 checksum lists from /var/lib/dpkg/info/*.md5sums", and can also "check the MD5 sums of installed Debian packages" for one named package: debsums <package>.
2. As a second check that needs no extra package, use dpkg --verify [package] (-V), which compares installed files against what is recorded "in the dpkg database"; in current dpkg the functional check is the same MD5 comparison, reported in an rpm-like format. Packages that shipped no md5sums file cannot be checked by either tool; debsums -l lists them.
3. To find which package owns a specific file, for example one flagged above: dpkg -S /path/to/file. dpkg-query's -S/--search option is documented as searching "for packages that own files corresponding to the given patterns", including shell wildcards.
4. To see everything a package installed, for comparison against what is actually on disk: dpkg -L <package> (--listfiles), which lists the files installed from that package.
5. To repair a package whose files fail verification, force a reinstall of exactly that version: apt-get install --reinstall <package>=<version> (find the installed version first with dpkg -l <package>), or apt-get -y --reinstall install <package> for the currently configured candidate.
6. Re-run debsums <package> or dpkg --verify <package> to confirm the mismatch is gone.

Expected result

debsums -s and dpkg --verify print nothing for a clean system; after a targeted reinstall, the previously flagged package passes both checks.

Limits and test basis

Neither tool detects a file that was never dpkg-managed to begin with, nor packages installed with --force-* options that bypassed dpkg's own bookkeeping. A reinstall does not silently replace locally modified configuration files — dpkg keeps them or asks — and it does not restore a conffile that was deleted unless -o Dpkg::Options::=--force-confmiss is given. Back up modified conffiles before any reinstall anyway.