debsums
Integrity and confinementPackage: debsums
Compares installed files with their package's checksums. A binary changed without dpkg knowing is either an intrusion or a forgotten emergency cp; either way it is what you needed to know.
What its options do in the lessons
From the same glossary the lessons render under their commands, so the two cannot disagree.
debsums -c- Prints only the changed paths, one per line, with no “OK” lines. Missing files are reported separately, on standard error.
debsums -s- Reports errors only: nothing at all when everything matches. The form for a scheduled check, which should write only when it has something to say.
debsums -a- Also checks configuration files, which debsums leaves out by default because they are expected to have been edited. Without it the output looks cleaner than it is.
debsums -l- Lists installed packages that ship no checksum list. Their files are the ones
dpkg -Vskips in silence, with nothing printed to separate “not checked” from “unchanged”.