The new format is described here. Please see deb-old(5) for details of the old format.
The first member is named debian-binary and contains a series of lines, separated by newlines. Currently only one line is present, the format version number, which is currently 2.0. Programs which read new-format archives should be prepared for the minor number to be increased and new lines to be present, and should ignore these if this is the case.
If the major number has changed an incompatible change has been made and the program should stop; if it has not then the program can safely continue, unless it encounters an unexpected member in the archive (except at the end), as described below.
The second required member is named control.tar.gz and is a gzipped ustar containing the package control information, as a series of plain files, of which the file control is mandatory and contains the core control information. See the dpkg Programmers' manual for details of these files. The control tarfile may optionally contain an entry for `.', the current directory.
The third and final required member is named data.tar.gz and contains the filesystem archive as a gzipped ustar.
These members must occur in this order. Further members may be defined in the future, and will if possible be placed after these three. Current implementations should ignore any additional members after data.tar.gz. Additional members defined in the future which need to be inserted before data.tar.gz and which can safely be ignored by older programs will have names starting with an underscore `_'.
New members which cannot safely be ignored will be inserted before data.tar.gz with names starting with something other than underscores, or will cause the major version number to be increased.