Debian repository key change

We have been working on some changes to our Debian/Ubuntu package repository. If you use our repository to keep up to date with new Prosody packages, you need to take action before 4th August 2025 to continue receiving updates smoothly.

New repository instructions

The ‘apt’ utility has been moving towards a new format for specifying package repositories. If you are familiar with putting deb lines in a sources.list file, that method is changing.

The new preferred format for package repository configuration, known as “deb822”, has a number of advantages. One of them is simplified configuration of additional package repositories such as ours.

The new configuration format is already supported in Debian 12 (bookworm) and Ubuntu 22.04 LTS (jammy), which means you can use it right now.

If you already have our package repository configured, simply remove it and use the new instructions to add our updated configuration.

Signing key update

The reason existing deployments should do this before the 4th August is because from that day, we will be rolling our repository signing key to a new key. The old key is being retired because it is using older and weaker algorithms which are being phased out.

If you do not update the repository configuration on your system, apt will complain that our repository is not signed by a trusted key (typically a NO_PUBKEY error).

Old key fingerprint:

107D65A0A148C237FDF00AB47393D7E674D9DBB5 (short version: 7393D7E674D9DBB5)

New key fingerprint:

AD3B912769C5F962DCBA7956F7A37EB33D0B25D7 (short version: F7A37EB33D0B25D7)

To ensure you are ready for the new key, remove the existing configuration for our repository from your system, and follow the new instructions to configure our repository.

Support and questions

If you have any questions about this change, we’re always happy to help answer them in our community chat. Come and join us!