Joenio,
Good question, and it's a complex topic. For the R Project, we (as the R
Foundation, I am part of the board) now support / pay for CRAN to issue a DOI
for each packages (roughly 21k by now, this costs approx $2 per entry as I
recall). It was decided not to version, so one DOI for all releases of a
package. Here is for the example my most widely-used package:
https://doi.org/10.32614/CRAN.package.Rcpp
and the link part just takes you back to the refernce CRAN page.
Before that happened, individual package authors sometimes registered at
zenodo. You could do that for given Debian release, and then cite with that
DOI. Or you could just fudge it (I did in the day) and use a
bibtex-equivalennt of @misc or @manual. It has been done before.
Cheers, Dirk