MNT Reform apt repository

Table of Contents


If you are an experienced user and know what you are doing, then you might just need this: reform_bookworm.sources. For more information on how to convert an existing installation from the official MNT system image to Bookworm just read on.

These instructions are not relevant if you installed your system using the system image or Debian installer image from Those already ship with the correct apt sources for Bookworm packages from this repository.

In contrast to the apt repository provided by MNT Research, this repository provides its content based on Debian stable (Bookworm) instead of unstable for a more reliable computing experience. The the packages in this repository are signed with a GPG key that is part of the Debian Developer keyring shipped by the debian-keyring package on your system and thus there exists a trust path from your existing installation to this repository.

The MNT Reform system image from uses Debian unstable. If you haven’t upgraded your system since the release of Debian bookworm, then you can easily turn your Debian unstable into a Debian stable (codename bookworm) system. The advantage of doing so is, that you then no longer have to worry about running apt upgrade breaking your running system due to some RC bug. Doing the switch from unstable to bookworm involves changing two aspects of your apt configuration and the final update and upgrade.

Step 1: Adjust apt sources

The default /etc/apt/sources.list on a Reform system image looks like this:

deb unstable main
deb [arch=arm64 trusted=yes] reform main

The first line configures Debian unstable as the source for the packages you install and upgrade to. The second line configures the official MNT mirror. To switch to bookworm and the package repository provided by, you have to

  1. replace unstable with bookworm in the first line,
  2. add stable update and security mirrors and
  3. replace the MNT mirror with the mirror.

Your resulting /etc/apt/sources.list should look like this:

deb bookworm main
deb bookworm-updates main
deb bookworm-security main

You can choose between three different ways to enable the mirror:

Method A: Using extrepo

Install the package extrepo and then run:

extrepo enable

This will create /etc/apt/sources.list.d/ with the correct contents automatically using GPG signed repository descriptions from the central extrepo mirror. If you rather trust the locally installed extrepo-data package you can also run:

extrepo enable --offlinedata

Method B: Manually downloading deb822 sources file

You can also manually download reform_bookworm.sources and place it in /etc/apt/sources.list.d like this:

sudo env --chdir=/etc/apt/sources.list.d wget

If you go this route instead of using extrepo, see below for a method to verify that the GPG key attached to your downloaded reform_bookworm.sources is indeed the one that is also present in your /usr/share/keyrings/debian-keyring.gpg.

Method C: Manually adding one-line entry

If you prefer to use the one-line format of /etc/apt/sources.list instead of the deb822 format of reform_bookworm.sources, you have to download the key to a custom location (for example to /etc/apt/keyrings/ and add this line to your /etc/apt/sources.list:

deb [arch=arm64 signed-by=/etc/apt/keyrings/] bookworm main

See below for a method to extract the right key from /usr/share/keyrings/debian-keyring.gpg and store it in /etc/apt/keyrings/ or another location of your choosing and referenced by the signed-by option in your one-line apt sources entry.

Step 2: Adjust apt preferences

The original MNT Reform system image contains a preference file which prioritizes packages from the repository over packages coming from elsewhere. You need to do the same with the repository. Without setting up this pinning, you run the risk of accidentally upgrading to package versions from for those packages patched by in the small time window before managed to rebuild new package versions with the reform-specfic patches on top. To this end, comment out or remove the existing content of /etc/apt/preferences.d/reform.pref and add this:

Package: *
Pin: origin ""
Pin-Priority: 999

Step 3: Upgrading

You can now resynchronize the package index files from their sources by running:

sudo apt update

You can verify that your apt sources are set up correctly by ensuring that the output of the following command does include and does NOT include

apt-get indextargets --format '$(SITE)' 'Created-By: Packages' | sort -u

You can verify that apt pinning via apt preferences worked as expected by verifying the apt pin value of linux-image-arm64 was indeed set to 999 and comes from

apt-cache policy linux-image-arm64 | grep "999"

If everything checks out, you can run these commands to finish the conversion:

sudo apt upgrade --without-new-pkgs
sudo apt full-upgrade

GPG signature

The repository is signed by a subkey of the following key:


This key is part of the keyring shipped by the debian-keyring package 2023.07.22 or later in /usr/share/keyrings/debian-keyring.gpg. To extract the key from the keyring you can run:

gpg --no-options --no-default-keyring --export --armour \
  --keyring /usr/share/keyrings/debian-keyring.gpg \
  --export-options export-minimal,export-clean \
  --export-filter keep-uid="uid = Johannes Schauer Marin Rodrigues <>" \
  --export-filter drop-subkey="fpr <> 3AC6EB840FA5CE3FF31BAD80EF93221F8A44FEB2" \

Depending on which method you chose to set up your apt sources, this key should either:


The Linux kernel from bookworm-backports is provided for support for more features (suspend on imx8mq) and more platforms (a311d). To enable the backports repository, follow method B or C from above but replace bookworm with bookworm-backports. For example for method B, do:

sudo env --chdir=/etc/apt/sources.list.d wget

Or, for method C, execute:

deb [arch=arm64 signed-by=/etc/apt/keyrings/] bookworm-backports main

And then install the correct kernel using:

sudo apt install linux-image-arm64/bookworm-backports


The packages are generated by the following script: