Extract Debconf Files with apt-extracttemplates

Before you install a Debian package, apt-extracttemplates lets you pull out its debconf questions and configuration script and read them first. It writes both files to a directory you choose, prints their paths, and touches nothing else on the system. The whole check takes about ten minutes and never installs, removes or configures anything.

• You need: a readable .deb file and a shell.
• Privilege: reading the package and writing under /tmp normally needs none.
• Version used here: the installed apt-utils package, 2.8.3, on amd64.

1. Confirm the command and its version

$ command -v apt-extracttemplates
/usr/bin/apt-extracttemplates
$ apt-extracttemplates --version
apt 2.8.3 (amd64)

• It only takes files. The command accepts one or more Debian package files; it is not a downloader and will not select a package from an APT repository for you.
• Start local. Use a package file whose provenance you understand.

Checkpoint: if command -v prints nothing, install or repair apt-utils through your normal system administration process before continuing. Do not work around a missing binary by copying one from another host.

2. Create an isolated output directory

out_dir=$(mktemp -d)
printf 'extraction directory: %s\n' "$out_dir"

• Keep it separate. This keeps generated files away from your working tree and makes it obvious which files belong to this inspection.
• Expect random names. The command creates files such as package.template.random and package.config.random, with trailing characters generated to avoid a fixed filename.
• Do not reuse a real directory. Do not point --tempdir at a directory containing files you care about; treating a shared directory as disposable makes later cleanup and review harder even though the output names look temporary.

3. Extract one package

deb_file=/path/to/package.deb
apt-extracttemplates --tempdir "$out_dir" "$deb_file"
status=$?
printf 'exit status: %s\n' "$status"

For every input package containing both kinds of debconf data, the output line has this shape:

package version template-file config-script

Extracting the Ubuntu tzdata package with this installed command produced:

tzdata 2026c-0ubuntu0.24.04.1 /tmp/apt-extracttemplates-fixture-Oi9zz3/out/tzdata.template.EvoOfn /tmp/apt-extracttemplates-fixture-Oi9zz3/out/tzdata.config.yu3m8K

• Use your own paths. The temporary directory name and suffixes vary between runs; work from what your own run printed, not the example above.
• Read the exit status. 0 means the operation completed normally; the program uses decimal status 100 for an error.

4. Check what was written

find "$out_dir" -maxdepth 1 -type f -printf '%f %s bytes\n' | sort
file "$out_dir"/*

• Template files are the debconf questions and metadata.
• The config script is package-provided code intended for debconf processing.
• Treat both as untrusted input. Read them if you need to understand the package, but do not run the config script directly. Extraction is a file operation, not a safe way to execute package maintainer code.

Checkpoint: the paths printed by apt-extracttemplates should point inside $out_dir, and the corresponding files should exist:

test -d "$out_dir" && find "$out_dir" -maxdepth 1 -type f -print

A package without associated config scripts and templates may produce no data line and leave the output directory empty. That is different from a failed extraction, so check the exit status as well as the file list.

5. Extract several packages in one run

first_deb=/path/to/first-package.deb
second_deb=/path/to/second-package.deb
apt-extracttemplates --tempdir "$out_dir" "$first_deb" "$second_deb"
printf 'exit status: %s\n' "$?"

• Keep arguments separate. Passing multiple package paths as distinct shell arguments stops a filename containing whitespace from being split.
• Map output to input. Output lines identify the package and version, so you can trace each generated file back to its source.
• Use one directory per investigation. If two packages have similar names, mixing their extracted files in an old directory is an easy review error.

6. Use configuration only when you need it

apt-extracttemplates \
  -o APT::ExtractTemplates::TempDir="$out_dir" \
  "$deb_file"

• The command-line option maps to config. --tempdir corresponds to APT::ExtractTemplates::TempDir, and for a one-off check the option is easier to audit.
• Use --config-file deliberately. Reach for it when a complete APT configuration file is part of a controlled test; the program reads the default configuration before that named file.
• APT_CONFIG runs earlier still. It applies settings before default configuration files are parsed. Do not put secrets or unrelated production settings into a temporary test file.
• None of this changes the system. These options select where the command writes; they do not install the package, apply its debconf answers or touch the package database.

7. Clean up after review

rm -rf -- "$out_dir"

Warning: this deletion is irreversible. Check the variable before running it, especially if you opened another shell or copied commands between terminals:

printf 'about to remove: %s\n' "$out_dir"
test -n "$out_dir" && test -d "$out_dir" && rm -rf -- "$out_dir"

If you need an audit record, copy the extracted files to a deliberately named, access-controlled directory before cleanup. Do not retain a config script in a shared location merely because it is convenient.

Done means

• Version confirmed: apt-extracttemplates --version reports the installed APT version you intended to test.
• Isolated output: a fresh, private temporary directory holds the extracted files.
• Exit status checked: its output lines identify package, version, template and config paths.
• Config script treated as untrusted: inspected, never executed directly.
• Empty output understood: packages without debconf data are distinguished from command failures.
• Cleanup deliberate: the temporary directory was removed only after review, or retained with restricted access.