Strategy for apt upgrade

This is my first time using debian away from stable. I’m used to periodic apt update && apt upgrade but I suspect that’s probably not good practice on unstable or that I should at least ask. Web search got me nothing useful.

Any suggestions on good practices here?

Should work fine. Normally if there’s a problem the problem packages will show up as ‘held back’. Packages with known bugs will show you the bugs and ask you if you still want to proceed.

I’m the person who maintains the machinery building Debian packages for the Reform repository (reform-debian-packages repo), the scripts that build the system image (reform-system-image repo) and who maintains the reform-tools package.

But, I’m also not using any of that myself. :grin:

Instead, I’m going to use this thread for a shameless plug of which offers system images and a package repository tracking Debian stable (bookworm) instead of Debian unstable like the MNT repo.

If you find any bugs in the stuff shipped by reform.d.n, please do not hesitate to contact me. The website will also soon get a rework with the release of the Pocket Reform and the rk3588 module for the big Reform.


Stable is the way to go. Using the reform repos will get you all the current stuff for the Reform itself. Best of both worlds.

Thanks Josch for your efforts in this regard! It is greatly appreciated!

I totally agree it would be better for me to be on bookworm!

The recommended method A not working for me.

extrepo installed ok but complains:

$ extrepo enable
Repository does not exist! at /usr/share/perl5/Debian/ExtRepo/Commands/ line 33.

extrepos is looking for config in /etc/apt/sources.list.d/extrepo_*.sources which does not exist.

Now my /etc/apt/sources.list did not match what was alleged to be there. My sources.list is below. Thinking that maybe installing extrepos would have installed the necessary configuration containing I tried apt reinstall but extrapos doesn’t exist in the repositories now configured (and didn’t, when I first installed in with the “before I started” repos.


# Contents before I started:
#deb unstable main non-free-firmware

# Should have been, according to
# deb unstable main
# deb [arch=arm64 trusted=yes] reform main

# as per changes
deb bookworm main
deb bookworm-updates main
deb bookworm-security main

Given the above, and sources.list as shown, apt update runs to completion with no error except, as expected:

N: Missing Signed-By in the sources.list(5) entry for ''

In a local directory I attempted to extract the subkey via the given gpg command, which results in:

gpg: keybox '/usr/share/keyrings/debian-keyring.gpg' created
gpg: WARNING: nothing exported

I suspect this means that I do not have the 2023.07.22 keyring, but at this point I’m a bit over my head. I understand apt pretty well but the intricacies of gpg/pgp, not much.

Hi there, this last error is normal, the repo on our website is not signed, as we don’t have a really secure signing process in place that could be automated. So HTTPS is the only authentication mechanism there at the moment.

Ah! OK cool then.

I was responding to josch’s suggestions about switching to bookworm, here, which I took to mean there was a key:

If you go this route instead of using extrepo, see below for a method to verify that the GPG key attached to your downloaded reform_bookworm.sources is indeed the one that is also present in your /usr/share/keyrings/debian-keyring.gpg.

Following josch’s suggestions I don’t think I’m setup correctly. Nowhere in the /etc/apt tree is referrence to the new repository,

“switching to bookworm” cannot be done by converting your Debian “unstable” installation to bookworm. Doing so would mean to downgrade packages to their version in bookworm and that is very dangerous and will lead to file-loss. Debian (and to my knowledge all its derivatives) only support upgrades but do not support downgrades of package versions.

The extrepo method does not work for you because extrepo correctly identified that your system is actually Debian unstable but the repository provided at is for bookworm and not compatible with unstable and hence does not show it to you nor lets you enable it.

If you want to use Debian bookworm instead of unstable on your Reform (unless your Debian unstable installation was not updated for over a year) you can only do that via doing a fresh installation but you cannot downgrade.

Thank you for your feedback. I’m going to add a short version of what I explained here to reform.d.n.

1 Like

OK understood. I hadn’t considered that in fact stable/bookworm would be a downgrade.

OK this all makes sense. I’ll stay in unstable since wholesale change has no immediate value to me, other than less vigilance for occasional bad packages. I’ll put a note in my sources.list regarding this should I get to a point where reinstall makes sense.

Thanks for taking the time to explain.