Install a bundle

Run these commands on the Debian or Ubuntu machine the bundle was built for. You need the bundle, the debark Linux binary, and the builder’s public signing key. Get the key through a trusted channel separate from the bundle.

The examples use a folder called bundle and a public key called operator.pub. Commands also accept a .debark.tar.zst archive.

Check the bundle

debark verify ./bundle --key operator.pub

Verification checks the signature and file contents without installing packages. If it fails, read the reported problem and follow Verify a bundle.

You can read the package list and target details with:

debark inspect ./bundle

Preview the changes

debark install ./bundle --key operator.pub --status

The report shows packages to install, upgrade, or remove, along with warnings. --dry-run also previews the installation without applying it; use either flag.

Check that the target release and architecture are correct. A different architecture stops installation with exit code 7. A release mismatch produces a warning; rebuild for the correct release before proceeding.

If you built from a stock base, the report may also list packages that the base assumed were installed but are missing on this machine. A snapshot of the actual target gives a more accurate starting point.

Install

sudo debark install ./bundle --key operator.pub --yes

Installation requires root. --yes accepts apt’s prompts and is required for unattended installs, so review the preview first.

Debark verifies the bundle again, then asks apt to install the exact versions recorded in the lock file. It uses the bundled repository through temporary apt settings. Your normal repository configuration stays in place.

After installation, check the application and the package manager:

sudo apt-get check

Apply bundled upgrades

If the bundle includes an upgrade set, add --upgrade when previewing and installing:

debark install ./bundle --key operator.pub --upgrade --dry-run
sudo debark install ./bundle --key operator.pub --upgrade --yes

Review the full plan, including removals. See Upgrade installed packages for the build commands.

Other installation options

Most installs only need the commands above.

Option	When to use it
--all	Request every package recorded in the bundle, beyond the normal install set. Preview first.
--keyring DIR	Use a directory of trusted public keys.
--gpg-keyring FILE	Use a specific GPG keyring for a GPG-signed bundle.
--allow-unsigned	Accept a bundle without a valid signature. File checks still run, but the builder’s identity is no longer required.

Keep the repository available

--keep-source leaves a permanent apt source pointing at the bundle. Keep the bundle at a stable path protected from untrusted writes.

The source uses Trusted: yes. Later apt commands can install from it without checking Debark’s manifest or signature. Use this option only if you intend to manage that repository yourself.

Advanced fallbacks

--dpkg bypasses apt and runs unpack/configure steps directly. It does not provide apt’s normal dependency planning.

--fast uses noninteractive package configuration and --force-unsafe-io, reducing protection against interrupted disk writes. Neither option is needed for a normal installation.