Debian 13 (trixie) repo / install instructions

[Robert Lister]

Hi,

In the process of upgrading to Debian 13 (trixie) which is current stable release. I'm having some problems with it.


1. Documentation for APT install is out of date:

a) apt-key tool is no longer available as of Debian trixie.


Any old gpg keys installed with apt-key should be removed prior to upgrading or adding the new gpg key. Previous Debian versions try to use this key instead of the one specified in sources.list.d file.

If upgrading from Debian 11/12 (bullseye/bookworm), you may need to delete any old/current keys in deprecated trusted.gpg / /etc/apt/trusted.gpg.d (aka apt-key)

Debian changed their minds several times on file locations and what should/should not be in trusted.gpg. If you have old mysql keys before upgrade from previous installs, just delete them and add as below:

$ sudo /usr/bin/apt-key del 467B942D3A79BD29
$ sudo /usr/bin/apt-key del B7B3B788A8D3785C

b) The docs suggest using keyserver pgp.mit.edu to get the key, but this server seems to be permanently broken and just returns an error when you try to fetch a key:

$ sudo apt-key adv --keyserver pgp.mit.edu --recv-keys A8D3785C
Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).
Executing: /tmp/apt-key-gpghome.mimomkCxS8/gpg.1.sh --keyserver pgp.mit.edu --recv-keys B7B3B788A8D3785C
gpg: keyserver receive failed: No data

It is available via keyserver.ubuntu.com, however.

The following works on older versions of gpg, but NOT trixie / GnuPG 2.4.7:

$ sudo gpg --homedir /tmp --no-default-keyring --keyring /usr/share/keyrings/mysql-apt-config.gpg --keyserver keyserver.ubuntu.com --recv-keys B7B3B788A8D3785C

# Add the repository to a `.list` file
echo "deb [signed-by=/usr/share/keyrings/mysql-apt-config.gpg] http://repo.mysql.com/apt/debian/ trixie mysql-8.4-lts" | sudo tee /etc/apt/sources.list.d/mysql.list > /dev/null

- Unfortunately, importing this using gnupg no longer saves it in a format compatible with apt:

Hit:2 http://repo.mysql.com/apt/debian trixie InRelease
Err:2 http://repo.mysql.com/apt/debian trixie InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is: Error: Failed to parse keyring 
"/usr/share/keyrings/mysql-apt-config.gpg"  Caused by:     0: Reading "/usr/share/keyrings/mysql-apt-config.gpg": EOF
     1: EOF

To quote from https://manpages.debian.org/unstable/apt/apt-secure.8.en.html:

Quote

To generate keys suitable for use in APT using GnuPG, you will need to use the gpg --export-options export-minimal [--armor] --export command. Earlier solutions involving --keyring file --import no longer work with recent GnuPG versions as they use a new internal format ("GPG keybox database").

- Possible solutions to this:



Try updated options for gpg, and set permissions +r on the file so apt can read it:

$ sudo gpg --homedir /tmp --no-default-keyring --no-permission-warning \
  --keyring gnupg-ring:/usr/share/keyrings/mysql-apt-config.gpg --keyserver keyserver.ubuntu.com \
  --recv-keys B7B3B788A8D3785C && sudo chmod +r /usr/share/keyrings/mysql-apt-config.gpg
gpg: key B7B3B788A8D3785C: "MySQL Release Engineering <[e-mail]>" 1 new signature
gpg: Total number processed: 1
gpg:         new signatures: 1

Another option is to use sq instead of gnupg:-

# install sq if not present:
$ test ! -x /usr/bin/sq && sudo apt-get -y install sq
$ sudo sq network keyserver --server hkps://keyserver.ubuntu.com search "B7B3B788A8D3785C" \
   --overwrite --output /usr/share/keyrings/mysql-apt-config.asc

Found 1 certificate related to the query:

 - BCA43417C3B485DD128EC6D4B7B3B788A8D3785C
   - MySQL Release Engineering <[e-mail]> (UNAUTHENTICATED)
   - created 2023-10-23 17:26:50 UTC
   - found via: hkps://keyserver.ubuntu.com

- This will work as before, /etc/apt/sources.list.d/mysql.list something like:-

deb [signed-by=/usr/share/keyrings/mysql-apt-config.asc] http://repo.mysql.com/apt/debian/ trixie mysql-apt-config
deb [signed-by=/usr/share/keyrings/mysql-apt-config.asc] http://repo.mysql.com/apt/debian/ trixie mysql-8.4-lts
deb [signed-by=/usr/share/keyrings/mysql-apt-config.asc] http://repo.mysql.com/apt/debian/ trixie mysql-tools
# deb-src [signed-by=/usr/share/keyrings/mysql-apt-config.asc] http://repo.mysql.com/apt/debian/ trixie mysql-8.4-lts

Another option is to just request the ascii key without using gpg and use that instead, then update sources to use that.
ASCII-armoured openpgp format is now supported by apt anyway.


- As mentioned in another post , For some reason the current pgp key is not available as a file like the previous key was at https://repo.mysql.com/RPM-GPG-KEY-mysql-2023.

It would be useful if the current key was also available. This gets it from keyserver.ubuntu.com:

$ sudo curl -fsSL -o /etc/apt/keyrings/mysql-archive.asc "https://keyserver.ubuntu.com/pks/lookup?op=get&options=mr&search=0xB7B3B788A8D3785C";

# update repo if needed:
$ echo "deb [signed-by=/etc/apt/keyrings/mysql-archive.asc] http://repo.mysql.com/apt/debian/ trixie mysql-8.4-lts" | sudo tee /etc/apt/sources.list.d/mysql.list > /dev/null

2. For some reason the Packages file for trixie/ mysql-8.0 is blank:


https://repo.mysql.com/apt/debian/dists/trixie/mysql-8.0/binary-amd64/Packages


compare to:

https://repo.mysql.com/apt/debian/dists/bookworm/mysql-8.0/binary-amd64/Packages


- I'm not sure if that is intended, but this means after upgrading to trixie, apt will not install, for example , if you have this in your mysql.list:

deb [signed-by=/usr/share/keyrings/mysql-apt-config.gpg] http://repo.mysql.com/apt/debian/ trixie mysql-8.0

# apt-get install mysql-community-client
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
E: Unable to locate package mysql-community-client

Using mysql-8.4-lts works though.


3. Although APT sources.list is still supported, it is recommended to use the new deb822-style format .sources file instead.

Example /etc/apt/sources.list.d/mysql.sources to replace /etc/apt/sources.list.d/mysql.list:

Types: deb deb-src
URIs:  http://repo.mysql.com/apt/debian/
Suites: trixie
Components: mysql-8.4-lts mysql-tools
Enabled: yes
Signed-By: /usr/share/keyrings/mysql-apt-config.gpg

(Note: I've omitted mysql-apt-config because running this would put back the .list file and break apt.)