Post History

For dpkg, the backend for apt on Debian based distributions, checksums for files belonging to installed packages are stored in two places.

First, checksums of all non config files are stored in per package `.md5sum` files in `/var/lib/dpkg/info/`.

For example, `/var/lib/dpkg/info/apache2.md5sums` contains:

```
61e049e425ec181a32827c78188a5ad1  usr/lib/systemd/system/apache-htcacheclean.service
df833b11ee47d4fdc9a46eef865527e6  usr/lib/systemd/system/[email protected]
fad8b9c1c85cb90821faa328d276f98a  usr/lib/systemd/system/apache2.service
2cc4631beab008ebec7beccd0fecd201  usr/lib/systemd/system/[email protected]
42e0c758cfcaa9f9db04e3bd8f51f2b1  usr/sbin/a2enmod
a833732e71d6f7bb55e8bc51158738bb  usr/sbin/a2query
014cda6cb0c78b56e8d38f0f9d590136  usr/sbin/apache2ctl
[...]
```

Second, checksums of the config files are stored in `/var/lib/dpkg/status`.

Example excerpt:

```
Package: apache2
[...]
Conffiles:
 /etc/apache2/apache2.conf 354c9e6d2b88a0a3e0548f853840674c
 /etc/apache2/conf-available/charset.conf e6fbb8adf631932851d6cc522c1e48d7
 /etc/apache2/conf-available/localized-error-pages.conf f542d267bfce7815f9453eb1476e5f73
[...]
```

If the checksums do not match when updating a package, depending on settings and environment variables, the files are either replaced with a backup of the current content, left alone with a new file with the new content, or the user is asked on how to proceed with the file.

Files that have been modified outside of the package manager are usually left alone when uninstalling a package. The same goes for directories that belong to the package, but aren't empty after all files belonging to the package are removed.