Covering different distributions

In a nutshell:

• To create a DEB package, one need to put some metadata in the source directory (debian/control and debian/rules ) and run dpkg-buildpackage , which installs the package in a temporary directory and archives this directory in the DEB package along with the metadata and on the fly generated md5 checksums (stored in a file in control.tar.gz ).
• To create a RPM package, one need to put the metadata in a spec file and run rpmbuild , which will install the package on the system and archive the specified file in a RPM archive. md5 checksums are created as the archive is built and are part of the archive structure itself.
• To create a TGZ package, one need to put metadata in several files and rely on special Makefile targets provided with the distribution.

Basically, the steps are always the same: create metadata and dump it in an archive with the binaries. The main difference is the format of the different packages. Other differences can be mentioned¹¹:

• TGZ packages don't contain checksums and are not signed.
• DEB checksums are not part of the archive, a packager could omit them.
• TGZ is not differentiable from another tar.gz file.
• DEB and RPM provide support for dependencies resolving, the first one being more complete (recommendations, suggestions, ...)

It is a burden to maintain packages for different distributions. Going through all the steps described above takes a lot of time, for each release. Rather than relying on a conversion tool such as Alien , it would be interesting to build a framework in front of them, defining a grammar to describe metadata for the package and building a parser which will transform this metadata in control or spec files.