Lucky 13: a look at Debian trixie
After more than two years of development, the Debian Project has released its new stable version, Debian 13 ("trixie"). The release comes with the usual bounty of upgraded packages and more than 14,000 new packages; it also debuts Advanced Package Tool (APT) 3.0 as the default package manager and makes 64-bit RISC-V a supported architecture. There are few surprises with trixie, which is exactly what many Linux users are hoping for—a free operating system that just works as expected.
Debian's stable releases are aptly named; the project prioritizes stability over shipping the latest software. The freeze schedule for trixie called for a soft freeze in April, which meant that (for example) the KDE Plasma 6.4 release in June was too late to make the cut—even though trixie was not released until August. Users who prefer to live on the edge will want to run another distribution or follow Debian development by running the testing release that previews the next stable version—Debian 14 ("forky"). Truly adventurous users may take their chances with the unstable ("sid") release.
That said, trixie is up-to-date enough for many folks; it includes GNOME 48, KDE Plasma 6.3, Xfce 4.20, GNU Emacs 30.1, GnuPG 2.4.7, LibreOffice 25.2, and more. Under the hood, it includes the most recent Linux LTS kernel (6.12.41), GNU Compiler Collection (GCC) 14.2, GNU C Library (glibc) 2.41, LLVM/Clang 19, Python 3.13, Rust 1.85, and systemd 257. The release notes have a section for well-known software that compares the version in Debian 12 against Debian 13. While some of the versions lag a bit behind the upstream, they are not woefully outdated.
The project now supports six major hardware architectures: x86-64/amd64, 32-bit Arm with a hardware FPU (armhf), 64-bit Arm (arm64), IBM POWER8 or newer (ppc64el), IBM S/390 (s390x), and 64-bit RISC-V. The i386 architecture is not supported for trixie, though the project continues to build some i386 packages to run on 64-bit systems; users with i386 systems cannot upgrade to trixie. The MIPS architectures (mipsel and mis64el) have also been removed in trixie.
The Arm EABI (armel) port that targets older 32-bit Arm devices prior to Arm v7 is still supported with trixie, but this release is the end of the line. There is no installation media for armel systems, but users who have bookworm installed can upgrade to trixie if they have supported hardware: the Raspberry Pi 1, Zero, and Zero W are the only devices mentioned in the release notes.
Upgrades from bookworm are supported, of course. The release notes suggest that users convert APT source files to the DEB822 format before the upgrade. APT 3.0 includes an "apt modernize-sources" command to convert APT data source files to DEB822, but that is not available in bookworm. Users are also expected to remove all third-party packages prior to running the upgrade. I tested the upgrade on one of my servers, after taking a snapshot to roll back to if needed, and all went smoothly. Users who are considering an upgrade should read the release notes carefully before forging ahead; in particular, users should be aware that it's possible (but not certain) for network interface names to change on upgrade.
Installation
For users who want to start fresh, Debian offers a variety of installer images and download methods; users can choose a 64MB minimal ISO image with the netboot installer, all the way up to a set of Blu-ray images. The project recommends using BitTorrent or Jigsaw Download (jigdo) for the largest images. BitTorrent probably needs no introduction, but jigdo is not as well-known. Jigdo is a method of downloading all of the individual packages for an image from multiple mirrors and then assembling them into an ISO image on the user's machine. It was a bit fiddly to use jigdo to download an image, but not overly so—and the speed of the whole process was comparable to simply downloading an ISO of the same size.
Debian's network install ("netinst") image is probably the best option for server installations and for experienced Linux users; it includes the packages required for a base install and then fetches the remaining software from Debian mirrors. Unlike the tiny netboot image, it includes the option of using either the graphical installer or the text-based installer.
The installer is a bit of a throwback to an earlier era when users
were expected to know a lot more about the workings of a Linux system.
Users who have only worked with distributions like Fedora and Ubuntu
will notice that installing Debian requires many more steps than other
popular distributions. For example, many desktop distributions have
eliminated the step of setting a password for the root
user—instead, it is generally assumed that the primary user will
also be the system administrator, so the default is to give the
primary user sudo privileges instead. Debian does not take that
approach; in fact, there is no way to give a user sudo privileges
during installation. Setting up sudo has to be done manually after
the installation is completed Update: Users can skip creation of a root account and the installer will then set up the regular user as an administrator with sudo permissions. Apologies for the error.
For some folks, installing Debian will be a bit of a chore and may even be confusing for users who are new to Linux. For example, the text-mode installer requires users to specify the device for GRUB boot loader installation, without providing a default. If one chooses an invalid partition, the installer tells the user that the operation has failed and drops back to a menu listing all the installation steps. Presumably if one picks the wrong partition it will happily install GRUB to that and render the system unbootable. This is not insurmountable for experienced Linux users, but it would no doubt be a hurdle for many users.
More experienced Linux users are likely to appreciate the amount of control offered by the installer. For example, Fedora's recent web-based installer makes it difficult to even find the option to perform custom partitioning. Debian has a guided partitioning option for those who do not want to fuss with it, but the option to create custom partitions is not hidden from the user.
Debian has a better installation option for newer Linux users, though it is easy to miss: the live install images, which use the Calamares installer. Its workflow is more akin to the installation process one finds with Fedora and Ubuntu; it also sets up the primary user with sudo privileges rather than creating a root password. Unfortunately, the live images are not listed on the main page for installer images—though they are mentioned, briefly, in the release notes.
The Debian installer also has the option of using a Braille display and/or speech synthesizer voice for the installation. I have not tried these options, but they are available for users who need them.
X.org
Many distributions are in the process of phasing out X.org support for GNOME and KDE as the upstream projects have started doing so. For example, Fedora will remove X.org session support for GNOME in Fedora 43, and the plan is for Ubuntu to do the same in its upcoming 25.10 release. GNOME will be completely removing X.org support in GNOME 49, which is planned for September.
Much has already been said about this, of course, and there is likely little new left to be said or that needs to be said. However, for users who still need or want X.org support, Debian 13 includes X.org sessions for GNOME and KDE. In testing trixie, I've spent some time in the GNOME and KDE X.org sessions as well as the Wayland sessions; if there are any gotchas or horrible bugs, I haven't encountered them (yet). This might be a compelling reason for some folks to switch to (or stick with) Debian.
Trying trixie
I use Debian for my personal web site and blogs, but it has been quite some time since I used it as my primary desktop operating system. Debian (and Ubuntu) derivatives, such as Linux Mint and Pop!_OS, yes—but it's been several years since I've used vanilla Debian on the desktop for more than casual tinkering.
The Debian release announcement boasts about the number of packages included in trixie: 64,419 packages total, with 14,100 added and more than 6,000 removed as obsolete since bookworm. That is quite a few packages, but falls short of some other distributions. For example, "dnf repoquery --repo=fedora --available" shows more than 76,000 packages available for Fedora 42.
After installing Debian, I went to install some of my preferred software, such as aerc, Ghostty, niri, and Speech Note. The aerc packages in trixie are current, but Ghostty and niri are not packaged for Debian at all. Ghostty is written in Zig, which is also not available, so users who want to build it from source will need to install Zig separately and then build Ghostty. Speech Note is packaged as a Flatpak, but Debian does not enable Flatpaks or Flathub in the GNOME Software Store by default. Users who want Flatpaks on Debian via Flathub will need to install the flatpak package and manually add the Flathub repo:
flatpak remote-add --if-not-exists flathub \ https://dl.flathub.org/repo/flathub.flatpakrepo
Users will need to add the gnome-software-plugin-flatpak package for Flatpak support in GNOME Software, and plasma-discover-backend-flatpak to add it to KDE Discover.
Trixie ships with the Firefox extended-support release (ESR) by default: Firefox 128, which was released in July 2024. Happily, Mozilla offers a Debian repository for those who want to run more current versions. Even better, there is a little-advertised utility called extrepo that has a curated list of external repositories users might want to enable for Debian. To enable the Mozilla repository, for example, a user only needs to install extrepo, run "extrepo enable mozilla" as root (or with sudo), update the package cache, and look for the regular Firefox package. In all, extrepo includes more than 160 external repositories for applications like Docker CE, Signal, and Syncthing. Unfortunately, the extrepo utility does not have a separate "list" command to show the available repositories, though running "extrepo search" with no search parameter will return all of its DEB822-formatted repository entries. Some of the software is in an external repository due to a non-free license, other software (like Firefox) just has a development cycle that outpaces Debian's.
As one might expect, the Debian desktop experience is not dramatically different from other distributions; GNOME 48 on Debian is little different than GNOME 48 on Fedora, and the same is true for KDE, Xfce, etc. The primary difference is that users can expect more or less the same desktop experience running Debian stable in two years that they have today, which is not necessarily true for other distributions.
Miscellaneous
One of the features in Debian 13 is something that most users won't notice or appreciate at all: a transition to 64-bit time_t on 32-bit architectures, to avoid the Year 2038 problem. The short version is that 32-bit integers cannot hold a Unix epoch timestamp for dates after January 19, 2038. That may seem like a distant concern, even irrelevant for Debian trixie; after all, Debian 13 is only supported by the project until 2030. However, the project expects that some 32-bit embedded systems will still be running trixie in 2038, so Debian developers did the heavy lifting to complete the transition to 64-bit time_t now. LWN covered the early planning for this in 2023.
By now, most users have retired their DSA SSH keys; if not, now is the time to do so. DSA keys were disabled by default with OpenSSH in 2015, and they are entirely disabled now with the openssh-client and openssh-server packages in trixie. If there is a device that can, for some reason, only be connected to with DSA, users can install the openssh-client-ssh1 package and use ssh1 to make the connection.
As we covered in June 2024, Debian 13 has switched to using a tmpfs filesystem for the /tmp directory. By default, Debian allocates up to 50% of memory to /tmp, but this can be changed by following the instructions in the release notes. Note that this also applies to systems that are upgraded to trixie from bookworm.
Forward to forky
Debian Project Leader (DPL) Andreas Tille recently
announced "Debian's 100000th birthday
", so clearly the project has a
bit of experience with putting out solid releases. Granted, he was
reporting the number in binary, but even when converted to decimal
numbers (32 years), it's an impressive track record.
While testing, I installed trixie on a couple of systems, including a new Framework 12-inch laptop. My original intent was to just see whether Debian had any problems with the new hardware (it didn't), but now I'm leaning toward sticking with Debian on this system for a while to see if stability suits me.
With trixie out the door, the Debian Project has already turned its attention to working on forky, which has no release date set. Debian has stuck to a loose schedule of a new stable release roughly every two years. Most likely we will see Debian 14 sometime in 2027. After the forky release, trixie will still receive updates from Debian's security team through 2028, and then from its LTS team through 2030.
As of yet, there are no major new features or changes announced for forky; it seems likely that those will be coming to light in the coming months now that the project has trixie out the door. LWN will, of course, be reporting on those developments as they happen.
Posted Aug 20, 2025 13:54 UTC (Wed)
by bluca (subscriber, #118303)
[Link] (14 responses)
It's been a while, but IIRC if you skip setting a root password in the installer, then the created user will be added automatically to the sudo group
Posted Aug 20, 2025 14:07 UTC (Wed)
by rschroev (subscriber, #4164)
[Link] (4 responses)
> Alternatively, you can lock the root account's password by leaving this setting empty, and instead use the system's initial user account (which will be set up in the next step) to gain administrative privileges. This will be enabled for you by adding that initial user to the 'sudo' group.
Admittedly it's quite a wall of text.
If you do leave the root password empty (and only then) is sudo installed automatically, with a config file that grants sudo access to users in the sudo group, in addition to putting the initial user in that sudo group.
Posted Aug 20, 2025 14:11 UTC (Wed)
by jzb (editor, #7867)
[Link] (2 responses)
Posted Aug 20, 2025 14:17 UTC (Wed)
by rschroev (subscriber, #4164)
[Link] (1 responses)
Posted Aug 21, 2025 11:40 UTC (Thu)
by Karellen (subscriber, #67644)
[Link]
Posted Aug 20, 2025 14:14 UTC (Wed)
by jzb (editor, #7867)
[Link]
Posted Aug 20, 2025 14:09 UTC (Wed)
by jzb (editor, #7867)
[Link] (6 responses)
Posted Aug 20, 2025 17:48 UTC (Wed)
by josh (subscriber, #17465)
[Link] (5 responses)
Posted Aug 21, 2025 10:55 UTC (Thu)
by alx.manpages (subscriber, #145117)
[Link] (4 responses)
I want a root password for login as root,
Which means that with the current installer I currently am forced to set up sudo(8) after installation.
Posted Aug 21, 2025 12:43 UTC (Thu)
by rschroev (subscriber, #4164)
[Link] (3 responses)
Posted Aug 21, 2025 19:07 UTC (Thu)
by alx.manpages (subscriber, #145117)
[Link] (2 responses)
Yup, that's an alternative I always thought should be possible.
I never tried it, though. Since I know my approach works, it always felt risky to try it in the other way. :)
Also, I have a sudoers file that I just cp(1) into /etc/sudoers.d and it works, which is easy. (Although it is painful to install and configure sudo(8) until I actually have sudo(8).)
Posted Aug 30, 2025 21:23 UTC (Sat)
by josh (subscriber, #17465)
[Link] (1 responses)
Posted Aug 31, 2025 5:49 UTC (Sun)
by alx.manpages (subscriber, #145117)
[Link]
- Enter password for root:
- Do you want sudo(8) for the main user?
(Of course, with more wording than that.)
Posted Aug 20, 2025 14:11 UTC (Wed)
by smcv (subscriber, #53363)
[Link] (1 responses)
> To allow direct password-based access via the 'root' account,
Posted Aug 29, 2025 9:26 UTC (Fri)
by emorrp1 (guest, #99512)
[Link]
Posted Aug 20, 2025 16:06 UTC (Wed)
by cjwatson (subscriber, #7322)
[Link]
Posted Aug 20, 2025 17:48 UTC (Wed)
by josh (subscriber, #17465)
[Link]
I see what you did there.
Posted Aug 21, 2025 4:17 UTC (Thu)
by alison (subscriber, #63752)
[Link] (5 responses)
Posted Aug 21, 2025 13:59 UTC (Thu)
by jzb (editor, #7867)
[Link] (2 responses)
If you're getting Firefox ESR from the Debian repositories, then it is updated by the Debian packagers with a number of patches applied. You can examine the patches applied to various versions here: https://sources.debian.org/patches/firefox-esr/. The new ML features postdate Firefox 128, I believe, so it's unclear right now if they'll turn those off or not. I wouldn't be surprised if they do... If you want current-ish Firefox without some of the AI-type stuff, you might check out LibreWolf or other forks.
Posted Aug 22, 2025 4:52 UTC (Fri)
by alison (subscriber, #63752)
[Link] (1 responses)
Posted Aug 29, 2025 13:17 UTC (Fri)
by MKesper (subscriber, #38539)
[Link]
Posted Aug 22, 2025 3:04 UTC (Fri)
by pabs (subscriber, #43278)
[Link]
Posted Aug 29, 2025 9:21 UTC (Fri)
by emorrp1 (guest, #99512)
[Link]
https://tracker.debian.org/pkg/firefox-esr/news/?page=3 (for the exact dates we got 128.3)
If you install from outside of debian (e.g. extrepo) then yes obviously it's cycle will be outside of distro control.
Posted Aug 21, 2025 11:25 UTC (Thu)
by alx.manpages (subscriber, #145117)
[Link] (3 responses)
This is not recommended. testing is the least secure flavour of Debian, as bug fixes are applied to stable (if appropriate), and also arrive at unstable (Sid) as normal patches, but due to migration policies, they can take months to arrive at testing.
See <https://www.debian.org/doc/manuals/debian-faq/choosing.en...>.
Posted Aug 22, 2025 3:14 UTC (Fri)
by pabs (subscriber, #43278)
[Link] (1 responses)
https://wiki.debian.org/DebianTesting#Best_practices_for_...
I have been using this setup for years, it works great.
Posted Aug 22, 2025 7:19 UTC (Fri)
by alx.manpages (subscriber, #145117)
[Link]
Recommending testing over unstable, saying that testing is for the bleeding edge and unstable is for the adventurous, that's at least a dangerous recommendation.
Such a recommendation would need to come with a disclosure that unstable is safer (even if it might crash more often) and explains how to deal with the security issues in testing.
Posted Aug 29, 2025 15:51 UTC (Fri)
by cpacejo (subscriber, #153871)
[Link]
And stable-updates is more conservative still, pulling only from the next point release: <https://wiki.debian.org/StableUpdates>
Posted Aug 21, 2025 14:22 UTC (Thu)
by tcabot (subscriber, #6656)
[Link] (1 responses)
Posted Aug 29, 2025 12:56 UTC (Fri)
by kkremitzki (subscriber, #115703)
[Link]
https://packages.debian.org/trixie/all/extrepo-offline-da...
sudo user
sudo user
sudo user
sudo user
sudo user
sudo user
sudo user
sudo user
sudo user
and I also want sudo(8) for my primary account.
sudo user
sudo user
sudo user
sudo user
sudo user
> you can set the password for that account here.
> .
> Alternatively, you can lock the root account's password
> by leaving this setting empty, and
> instead use the system's initial user account
> (which will be set up in the next step)
> to gain administrative privileges.
> This will be enabled for you
> by adding that initial user to the 'sudo' group.
sudo user
64-bit time_t
aptly named
thanks for the informative article
thanks for the informative article
thanks for the informative article
thanks for the informative article
It's configurable and can also be disabled, if you decide to do so.
I never saw Firefox doing a restart itself, though. It displays a message to restart it myself to be able to continue browsing.
thanks for the informative article
thanks for the informative article
testing is for actually testing. unstable is for users who want the bleeding edge
testing is for actually testing. unstable is for users who want the bleeding edge
testing is for actually testing. unstable is for users who want the bleeding edge
stable-backports and stable-updates
TIL about extrepo
TIL about extrepo