A little more than 2 months after Debian, we’re finally releasing Mobian Trixie as our new stable release! We’re also taking this opportunity to start rotating the PGP/GPG keys we’re using for signing both our images and package archive.

Trixie has landed!

Over 2 years in the making, and with a small delay following the Debian release, we’re proud to finally announce Mobian Trixie has just been released and is therefore our new stable!

This release offers images based on Phosh 46.0 and Plasma Mobile 6.3, running a 6.12 kernel for almost all supported devices (the Librem 5 is still using a 6.6 kernel), the list of which is growing as we now provide stable images for the following phones and tablets:

  • PINE64 PinePhone, PinePhone Pro and PineTab
  • Purism Librem 5
  • Google Pixel 3a and 3a XL
  • OnePlus 6 and 6T
  • Xiaomi Pocophone F1

Trixie images are also available for the following devices, although important hardware features (such as e.g. WiFi or audio) are not working:

  • Fairphone 4 and 5
  • PINE64 PineTab 2
  • SHIFT6mq

Please check our installation instructions and download the image for your device.

Upgrade procedure

Although we do our best to provide a smooth upgrade path for each Mobian release, as a downstream Debian derivative, and the mobile software stack being a quickly moving target, major Mobian upgrades are usually trickier than we’d hoped for. This time is no exception, and therefore we highly recommend that you backup all your personal data, flash your device with a fresh Trixie image, then restore your files.

If you feel brave enough to go the “manual upgrade” route, here are a few tricks you should know:

  1. keep your device plugged to a power source: such an upgrade can be a rather long process, you don’t want to run out of battery half-way there!
  2. backup all your personal data
  3. really, we mean it: backup all your personal data!
  4. install openssh-server and execute the entire upgrade process over SSH (and preferrably using screen or a similar tool, so the upgrade can carry on even if the network connection is lost)
  5. ensure your Bookworm installation is fully up-to-date; as the GPG key we use for signing the package repository has expired since the Bookworm release, you’ll probably need to run apt update && apt dist-upgrade at least twice: the first time it will update the Mobian keyring package, the second invocation will pull in the latest updates for Mobian-specific packages
  6. reboot, then edit both /etc/apt/sources.list and /etc/apt/sources.list.d/mobian.list, replacing all occurences of bookworm with trixie in both files; you should then stop the greetd service (this will stop all running graphical applications, and is why SSH is needed!) and run apt update && apt dist-upgrade once again
  7. write down the list of packages removed by apt dist-upgrade which start with mobian- as those will have to be reinstalled later on to restore full functionality of your device; please note that some packages have been renamed/replaced in Trixie, so it can be expected to see e.g. phog or pinephonepro-tweaks in the list of removed packages
  8. reinstall all mobian-* packages removed in the previous step; this will remove pulseaudio from the system, which is to be expected as Mobian now relies on (and mandates the use of) PipeWire
  9. run apt autoremove to clean up unneeded packages

FDE installs

Unfortunately, we haven’t been able to fix the issues preventing us from providing installer images for Trixie. However, you can still install Trixie with full disk encryption, even though the process is a tiny bit less user-friendly.

First, you’ll have to download (and unpack) or clone the mobian-recipes repository:

  git clone https://salsa.debian.org/Mobian-team/mobian-recipes.git -b mobian-trixie

Once this is complete, enter the mobian-recipes folder and:

  1. install the required dependencies listed in the README.md file
  2. execute the following command:
  ./build.sh -t <device> -c -R <password>

This will generate an encrypted image you can flash directly to your device and decrypt using the provided <password>. <device> can be one of the following:

  • amd64 for x86-64 computers
  • librem5 for the Purism Librem 5
  • rockchip for the PINE64 PinePhone Pro and PineTab 2
  • sc7280 for devices based on the Qualcomm SC7280 SoC (Fairphone 5)
  • sdm670 for devices based on the Qualcomm SDM670 SoC (Google Pixel 3a/3a XL)
  • sdm845 for devices based on the Qualcomm SDM845 SoC (OnePlus 6/6T, Pocophone F1, SHIFT6mq)
  • sm6350 for devices based on the Qualcomm SM6350 SoC (Fairphone 4)
  • sunxi for the PINE64 PinePhone and PineTab

Rotating GPG keys

We have been using a single GPG key since we first started to sign our images and package repositories. Replacing it has been on our roadmap for quite a while, but we needed to ensure our users would have a painless upgrade path.

We therefore decided to stick with the current key for Trixie (at least for now) and use new keys for the subsequent releases. As a matter of fact, we’ve created 4 new keys:

  • 1 for each of the forky, staging and trixie package repositories
  • 1 key (fingerprint 782C 6C58 B583 FE96 6CEE 44EB F8BD AB78 BEE2 46C2) will be dedicated to signing the images

Moreover, we’re now using a signing-only subkey rather than the main key, allowing the latter to be passphrase-protected. They’re being deployed according to the following agenda:

  • the forky package archive is already being signed with the corresponding key (fingerprint B174 17D5 C4B1 6F65 EE4F B75A 2DB8 7A16 935C 56F1)
  • the staging repository will switch to the new key (fingerprint 5F17 F59A 9615 87EA A5D1 1E44 A207 DED0 81BB FABF) once the updated mobian-archive-keyring package hits Debian testing, a few days from now
  • we haven’t decided when we’ll be using the trixie key (fingerprint 248C 06CE D075 774B FD69 9C09 E8B4 9A42 1214 09B5) for the corresponding archive; the only certainty is that we won’t deploy it before an updated version of mobian-archive-keyring is available in Debian stable
  • the images-signing key is in use since October 12th and has been used to sign the Trixie images

Should you encounter errors updating your Mobian packages, please ensure first that you have a recent enough version of the mobian-archive-keyring package (which is 20251011.0 at the time of this writing). If the problem persists, feel free to reach out on Matrix for additional help (please start by searching through the recent conversation history, as this issue may have been already discussed and solved).

Those keys can also be manually downloaded using the following link.