How to securely verify that package-installed files match originals?

I understand that I can run the following command to verify the installation footpring of a package: dpkg -V The reason why I am carrying out this audit is, however, because I somehow suspect that the system could be compromised. If the attacker has managed to subvert , he could also have manag

verifying Debian packages

hat debcheckroot will indeed turn out to be the ideal solution to monitor Debian VM systems running on top of something like the Qubes hypervisor, assuming that it will be reproducible-build some day. Thanks! Erik Poupaert