How do I see the changelog for a debian/ubuntu deb package?

Alternatively if the deb is also in the repository and you want to know older versions changelog, you can use apt-get changelog package to read all the changelog. For example for openssl:

apt-get changelog libssl1.0.0

apt-listchanges is a nice package to have around, but without having a deb file around your best bet most probably is to read the Debian changelog from /usr/share/doc/somepackage/changelog.Debian.gz.

Create a shell function with:

function debchanglog () {
  zless "/usr/share/doc/$1/changelog.Debian.gz"
}

To extend on Janne Pikkarainen's answer, here is an alias that can be used to read the changelog.Debian.gz for any given package:

alias changelog="xargs -I% -- zless /usr/share/doc/%/changelog.Debian.gz <<<"

It can be used like so:

changelog PACKAGE

Please note however that this is a terribly hackish solution and is not recommended under most circumstances. A function or standalone script is a much better solution.

Here is a function that reads all available changelogs for PACKAGE:

changelog(){
    if (( $# != 1 )); then
        echo "Usage: ${FUNCNAME[0]} PACKAGE"
        return 1
    fi

    find -L "/usr/share/doc/$1" -type f -name 'changelog*.gz' -exec zless {} \; 2>/dev/null
}

Here is a function that prints a list of all available changelogs for PACKAGE and queries the user to select which one to read:

changelog(){
    if (( $# != 1 )); then
        echo "Usage: ${FUNCNAME[0]} PACKAGE"
        return 1
    fi

    local changelog changelogs

    readarray -t changelogs < <(find -L "/usr/share/doc/$1" -type f -name 'changelog*.gz' 2>/dev/null)

    if (( ${#changelogs[@]} == 0 )); then
        return 0
    elif (( ${#changelogs[@]} == 1 )); then
        zless "${changelogs[0]}"
        return $?
    fi

    select changelog in "${changelogs[@]}" EXIT; do
        case $changelog in
            '')
                echo "ERROR: Invalid selection" >&2
                continue
                ;;
            EXIT)
                return 0
                ;;
            *)
                zless "$changelog"
                return $?
                ;;
        esac            
    done
}

In Ubuntu 18.04+, the modern version of apt can do this (as opposed to apt-get):

ubuntu18-04:~% apt changelog nginx
nginx (1.14.0-0ubuntu1.9) bionic-security; urgency=medium

  * SECURITY UPDATE: DNS Resolver issues
    - debian/patches/CVE-2021-23017-1.patch: fixed off-by-one write in
      src/core/ngx_resolver.c.
    - debian/patches/CVE-2021-23017-2.patch: fixed off-by-one read in
      src/core/ngx_resolver.c.
    - CVE-2021-23017
...