DEB MIME Type – Free, Online, Private

What .deb is

A Debian binary package is an ar archive. The first eight bytes are the ASCII string !<arch> followed by a newline. Members include debian-binary, control.tar, and data.tar, each often compressed. IANA registers application/vnd.debian.binary-package. application/x-deb is the unofficial alias older systems sent. The control tarball holds metadata and maintainer scripts. The data tarball holds the files that will be unpacked as root on install. That is why a .deb is not a harmless archive to extract and run from a browser download without checking the signature.

IANA registers application/vnd.debian.binary-package. The media type is application/vnd.debian.binary-package. Extensions that use it on this page: .deb. A client compares the type, not the filename, once the response has arrived. The filename still matters on disk and in Content-Disposition, which is why a wrong extension and a wrong header are two different bugs.

What sends application/vnd.debian.binary-package

What sends application/vnd.debian.binary-package: Send application/vnd.debian.binary-package for a .deb download. Set a filename that follows the package_version_arch.deb pattern so a package tool is willing to reason about it. Serve it over HTTPS. If you run a repository, the Packages index is a separate text file and is not this type. The package file itself is this type. Do not add a charset. Do not send application/gzip just because the member tarballs are gzip-compressed. The outer file is an ar archive. The file on disk is still .deb. Once the response exists, a client trusts application/vnd.debian.binary-package, not the filename. If you publish both a .deb and an .rpm, they are different formats and different URLs. Do not pick this type for the RPM. An RPM starts with the edd byte sequence of its lead, not with !<arch>.

Content-Type for .deb

Send application/vnd.debian.binary-package and do not add a charset parameter. The body is binary. A charset tells a text decoder to reinterpret bytes that are not text, which corrupts a download and does not help a browser sniff the format.

Content-TypeContent-Type: application/vnd.debian.binary-package

nginx, Apache, and Express

These snippets map .deb to application/vnd.debian.binary-package. nginx reads the types block when it picks a type from the URL's extension. A location that sets default_type, or an application that sets the header itself, overrides that map. Apache AddType applies in the directory context where you put it. The Express static example writes the header for files ending in .deb so a stale mime database in the framework cannot disagree with the type on this page.

nginx# /etc/nginx/mime.types, inside the types { } block
application/vnd.debian.binary-package  deb;

ApacheAddType application/vnd.debian.binary-package .deb

Expressimport express from "express";

const app = express();
app.use(express.static("public", {
  setHeaders(res, filePath) {
    if (filePath.endsWith(".deb")) {
      res.setHeader("Content-Type", "application/vnd.debian.binary-package");
    }
  },
}));

Pitfalls for application/vnd.debian.binary-package

Pitfalls that show up for application/vnd.debian.binary-package, and not for a neighboring type with a similar extension: Sending application/x-debian-package or application/x-deb is what old maps did. The registered type is application/vnd.debian.binary-package. A strict client can reject the alias. A second bug is a repository file that was truncated, so ar can read the magic and not the data member. Check the size against the Packages index. A third is an HTML mirror listing saved as the .deb URL. It will not start with !<arch>. A fourth is installing a package you fetched without verifying the signature in the Release file. The Content-Type proves nothing about who built it.

• The registered type is application/vnd.debian.binary-package. application/x-deb is unofficial.
• The magic is !<arch>, the ar archive header, not PK.
• Member tarballs being gzip does not make the HTTP body application/gzip.
• A source package is a different set of files. This type is the binary .deb.