turnkey Trixie lcx containers | TurnKey GNU/Linux

hi all my collegue have set up for us a proxmox server and he set up some turnkey appliances..it was easy for him and working for us.. everything is working out of the box.. so big thank you for your work. Now my collegue is busy and i tried to upgrade proxomox from 7 to up to date ..which went fine.. but i have issues with lcx containers where apt is saying that pgp keys are invalid. unfortunately i listened to chatgpt and tried with him to update pgp keys so i might as well destroy original pgp files..i updated one lcx container with apt option to skip repo pgp validating and it did upgrade and its working.. but its not a proper way ..im pretty unexpirianced in server administration so am asking for step by step instruction how to upgrade turnkey lcx containers to trixie.. our most important lcx containers are reverse proxy gateway, nextcloud and wp for webpage.. server was for too long based on proxmox 7 but dont know what are lcx turnkey versions... so how do i upgrade them up to date? im willing to wait since everything is working just want to properly upgrade. .thank you

Replies (4)

Unfortunately we don't actually have Trixie builds yet :(

Reply 1 2026-01-27

Unfortunately we don't actually have Trixie based appliance builds yet :(

FYI - when we do, they will be v19.x.

Anyway, I'm assuming that you've already updated your existing TurnKey (v18.x/Bookworm) server to a Trixie base? If not, then go for it and it should "just work" - because TurnKey is Debian under the hood. Either way, beyond the key problem (which my previous post should resolve) everything should continue to work, although there is a possibility that some other tweaks may be required (i.e. related to upstream Debian changes).

As I think I noted in my previous post, you won't get any TurnKey specific changes (to our custom software or tweaks we are making in the appliance build code). But with the 'turnkey trixie' repo enabled, the updated TurnKey custom packages will appear as available to upgrade to as soon as I push them to the "main" apt repo. If you want to assist with testing our custom packages, then you can add the 'turnkey trixie-testing' repo and upgrade to the ones there if you want. Otherwise the ones from v18.x/bookworm should continue to work fine.

is it same for all LCX?

Reply 2 2026-01-27

Hi is this procedure same for all your trixie lcx containers? regards

The keys are in our "common" github repo

Reply 3 2026-01-12

The new Trixie keys are in our "common" github repo - but I've actually built a package that contains them. Although obviously currently you have a chicken and egg problem. The easiest workaround is to just manually download and install the package:

wget https://archive.turnkeylinux.org/debian/pool/trixie/main/t/turnkey-keys/turnkey-keys_0.1_all.deb

Then double check that the checksum matches:

echo '98b472f4989fcb3b0c264b9791b80dc98ae94a2e0ce181231522b3052c7b2d00294b7df9a1ec4dfaeb8790ea65811f03fd1864e6f35cfdb9f3007e746ccf5af0' ; \
sha512sum turnkey-keys_0.1_all.deb

The first line will echo the correct checksum and the second will show the checksum of the file you downloaded.

Assuming that they match, then install the package:

apt install ./turnkey-keys_0.1_all.deb

That package contains the new key and the location is:

/usr/share/keyrings/tkl-archive-keyring.gpg

Last step is to update the key path for the turnkey apt sources - in /etc/apt/sources.list.d/sources.list & /etc/apt/sources.list.d/security.sources.list

Then if you run "apt update" you shouldn't get any errors.

Please note though that our new Trixie based release (v19.x) is waaaay behind schedule so there aren't actually any packages in our Trixie apt repo. Hopefully they will be there soon...

deb packages for debian 13 trixie

Reply 4 2026-04-03

Hi, sorry for questions on eatern, but I've tried to install the keys for the trixie packages:

deb http://archive.turnkeylinux.org/debian trixie main
deb http://archive.turnkeylinux.org/debian trixie-security main

with:

wget https://archive.turnkeylinux.org/debian/pool/trixie/main/t/turnkey-keys/turnkey-keys_0.1_all.deb

but I get the following errors:

--2026-04-03 09:46:18--  https://archive.turnkeylinux.org/debian/pool/trixie/main/t/turnkey-keys/turnkey-keys_0.1_all.deb
Resolving archive.turnkeylinux.org (archive.turnkeylinux.org)... 54.83.15.172
Connecting to archive.turnkeylinux.org (archive.turnkeylinux.org)|54.83.15.172|:443... connected.
ERROR: The certificate of 'archive.turnkeylinux.org' is not trusted.
ERROR: The certificate of 'archive.turnkeylinux.org' doesn't have a known issuer.
ERROR: The certificate of 'archive.turnkeylinux.org' has expired.
The certificate has expired

Can anybody help? Thanks a lot!