Differences between revisions 34 and 38 (spanning 4 versions)
Revision 34 as of 2019-01-23 08:03:39
Size: 7290
Editor: ?ScottKitterman
Comment: Added reference to how to deal with cases where dbgsym packages aren't appropriate.
Revision 38 as of 2020-03-14 23:56:21
Size: 7512
Editor: PaulWise
Comment: move a bit of status around
Deletions are marked like this. Additions are marked like this.
Line 21: Line 21:
The security archive does not [[DebianBug:894081|yet]] provide dbgsym packages.

= Archive =
Line 22: Line 26:

To get the corresponding dbgsym packages for stable security updates, please use the proposed-updates-debug apt source.

tl;dr for package maintainers who’d like to migrate

If you’re using dh with compat ≥ 9

Say you’re preparing freeradius 3.0.11-1 and want to switch from a -dbg package to automatically created -dbgsym packages. You would:

  1. Change your existing dh_strip -a --dbg-package=freeradius-dbg to dh_strip --dbgsym-migration='freeradius-dbg (<< 3.0.11-1~)'

  2. Delete the freeradius-dbg package from debian/control
  3. Bump the Build-Depends to debhelper (>= 9.20160114) or newer.

NB: The debhelper in jessie-backports has -dbgsym support reverted despite satisfying this version constraint.


The proposal is to automatically produce debugging symbols for everything in the archive, without the developers needing to add -dbg packages everywhere, which are rarely used and right now we mirror everywhere.


This proposal is implemented. Although some of the items listed below may be different from the current implementation.

The security archive does not yet provide dbgsym packages.


The automatic dbgsym packages are available from a separate archive. Please fetch these from http://deb.debian.org/debian-debug/ (backed by http://debug.mirrors.debian.org/debian-debug/). They are also available on http://snapshot.debian.org/. They are only available for stable, proposed-updates, backports, testing, unstable and experimental at this point in time, optionally also under the release's codename.

To get the corresponding dbgsym packages for stable security updates, please use the proposed-updates-debug apt source.

deb http://deb.debian.org/debian-debug/ stable-debug main
deb http://deb.debian.org/debian-debug/ proposed-updates-debug main
deb http://deb.debian.org/debian-debug/ stretch-backports-debug main
deb http://deb.debian.org/debian-debug/ testing-debug main
deb http://deb.debian.org/debian-debug/ testing-proposed-updates-debug main
deb http://deb.debian.org/debian-debug/ unstable-debug main
deb http://deb.debian.org/debian-debug/ experimental-debug main


Original proposal created by: ?EmilioPozueloMonfort; his version is at AutomaticDebugPackages/OldProposal

New proposal created by: SamuelBronson (please feel free to edit, though!)


Original "Why"

This thread in debian-devel expresses the need of this change. The reasons mentioned there include:

  • -dbg packages are mirrored everywhere, which is a waste of mirror space and bandwidth since they are rarely needed.
  • It would be possible to integrate bug-reporting tools to get meaningful stack traces.
  • Adding -dbg packages by hand everywhere is a waste of time and resources.

We don't want to completely remove them without having a replacement though. They are very useful when the time arises. The proposed replacement is to automatically build .ddeb packages that contain those debug symbols, and that are moved to a separate component/archive that isn't mirrored. That way we get debugging symbols for every binary in the archive with no effort, and solve the mirror problems.

Existing Practice


StackTraces Packaging:Debuginfo


Ubuntu has already done this.

See their spec and the package they use to generate ddebs.

TL;DR: they divert dh_strip to generate -dbgsym packages with filenames ending in .ddeb, and set up their archive manager to keep those somewhere out-of-the-way. One thing that's changed since they wrote the spec is the handling of packages that already ship symbols in -dbg binary packages: instead of making -dbgsym packages that conflicts with & breaks the -dbg packages, it now makes the -dbgsym packages into metapackages that pull in the relevant -dbg packages.


As Ubuntu's scheme seems good, we should just copy it, except presumably without the diversion of dh_strip.

It seems like all we really need to do here is:

  1. Prepare dak to accept ddebs and file them appropriately. (Maybe britney too?)
  2. Modify dh_strip to do what Ubuntu's pkg-create-dbgsym would make it do. (In theory we could just use pkg-create-dbgsym, but we won't because it diverts dh_strip, which obfuscates things and prevents others (like users) from diverting it.)
  3. Fix any packages that somehow take exception to the unexpected debuginfo packages.
  4. [at leisure] Drop -dbg packages, or if they contain something besides separate debug info, drop the separate debug info and rename the packages.



This describes the implementation in debhelper/9.20160114 (first implementation was 9.20151219) - it may have changed since then:

  • dh_strip (without --dbg-package or --no-automatic-dbgsym):
    • Saves extracted debugging info in a directory per dbgsym package (in an implementation defined location under debian/.debhelper).
      • Note that dh_strip only retains debug symbols for ELF binaries with build-ids - everything else is discarded.
    • Creates a usr/share/doc/<package>-dbgsym -> <package> symlink.

  • dh_md5sums
    • Generates an md5sums file for the dbgsym package like for a regular package.
  • dh_gencontrol:
    • Generate a control for <package>-dbgsym based on the entry for <package> in debian/control.

    • It will set the following fields:
      • Auto-Built-Package: debug-symbols
      • Priority: extra
      • Section: debug
      • Depends: <package> (= ${binary:Version})

      • Multi-arch: same [If the original binary was Multi-Arch: same, otherwise there is no Multi-Arch field]
      • Breaks/Replaces: <value passed dh_strip --dbgsym-migration>

    • This uses dpkg-gencontrol and accordingly, dpkg will know about the dbgsym package when generating the changes.
  • dh_builddeb:
    • Builds the debug symbol package like a regular deb.


ddeb can be installed into the same archive then the other packages and everything else should still work. They would be excluded on a per-mirror basis.

  • ddeb will have no override entries, so no priority or section.
  • They may not show up in the control-file, nor have a long description.
  • dak will accept $binary-dbgsym_$version_$arch.ddeb if a $binary_$version_$arch.{deb,udeb} is included in the same upload.

  • ddeb will go into the component "debug", so will show up in ./pool/debug/ (The pool-prefix is pretty much hardcoded, so making it variable would need a lot of work). No other packages will be allowed in "debug".

  • Standalone Release/Packages in ./debug/dists/.



Warn about -dbg packages that are duplicates of the -dbgsym packages.


  • How to generate recommends for the library dependencies?
  • Do we need the dependency from ddeb to deb?
  • Do we need to split ddeb per main/contrib/non-free?
  • There seems to be no solution at the moment for -dbg packages that contains more than debug symbols. See https://lists.debian.org/debian-python/2016/04/msg00092.html update January 2019: solutions to this question are documented in dh_strip (1).