not a valid DEB package

[lang_zh]
今天在用 ar 取代 .deb 裡面的 control.tar.gz 跟 data.tar.gz 時（關於 ar 跟 deb，請見我之前提過的這篇，發現做出來的 deb 會讓 apt-get install 叫 "not a valid DEB package"。雖然只是 warning，不過看了很不爽。

經過這篇 Creating Debian Packages 的提示，發現要用 dpkg-deb 做才不會有這個 warning。於是我好奇地拿兩個方法做出來的 deb 解開看，內容（包括 data 跟 control）完全一模一樣。但 dinary diff 之後的確有一小段差異，不知道是不是什麼 comment @@

不過.. 我要寫的東西只是將 package 裡面的少數幾個檔案換掉。所以用 ar 來做，所需的步驟大概是:

1. ar x 解開


2. gunzip data.tar.gz


3. tar uf data.tar my_file


4. gzip data.tar


5. ar r data.tar.gz

但是用 dpkg-deb 的話，就必須把整個 data.tar.gz 「全解開」，丟我的檔案進去，tgz 起來... 有時間再來看看那段疑似 comment/signature 的東西是什麼 @@
[/lang_zh]

[lang_en]
I was trying to "replace" control.tar.gz and data.tar.gz in a .deb package using ar(1) command. Yes it works, but the new package make apt-get cry "not a valid DEB package." Although it's just a warning, it makes me feel bad.

I searched this problem with google and found Creating Debian Packages. It said you have to use dpkg-deb(1) to build .deb to free the warning. Curiously, I checked the two .deb (generated by ar and dpkg-deb) by extracting the package, but they were all the same. Then I took a look at the binary diff of these two, they really had some bytes of different. I don't know if they were comment or so.

Actually, what I want to do is to replace a few files in a deb package. Do it with ar(1), I only need to:

1. ar x to extract
   
2. gunzip data.tar.gz
   
3. tar uf data.tar my_file
   
4. gzip data.tar
   
5. ar r data.tar.gz
   

However, with dpkg-deb(1), I have to extract the whole data.tar.gz, putting my file in, and then re-tgz it, which is very bad. I'll try to figure what the magic bytes is later.
[/lang_en]