feat: add support for Raspberry Pi OS Trixie

[nicomiguelino]

Issues Fixed

Fixes #2532

Description

Raspberry Pi OS Trixie (Debian 13) removes apt-key, which the previous playbook relied on via ansible.builtin.apt_key. This change replaces the deprecated approach with the modern method recommended by Docker and Debian:

• Creates /etc/apt/keyrings/ directory
• Downloads the Docker GPG key to /etc/apt/keyrings/docker.asc using get_url
• Adds signed-by=/etc/apt/keyrings/docker.asc to the Docker apt sources list entry
• Consolidates the separate x86 and Raspberry Pi key tasks into a single task (both use the same Debian Docker repository)

This approach is backward-compatible with Bookworm.

Checklist

• I have performed a self-review of my own code.
• New and existing unit tests pass locally and on CI with my changes.
• I have done an end-to-end test for Raspberry Pi devices.
• I have tested my changes for x86 devices.
• I added a documentation for the changes I have made (when necessary).

[Copilot]

Pull request overview

Updates the installer/playbooks to support Raspberry Pi OS Trixie (Debian 13), primarily by replacing deprecated apt-key usage for Docker and adjusting NetworkManager polkit configuration for newer polkit versions.

Changes:

• Switch Docker APT key handling to /etc/apt/keyrings and add signed-by in the Docker repo entry.
• Add a polkit .rules file for NetworkManager authorization on Debian 13+ and gate legacy .pkla edits to Debian <= 12.
• Modify bin/install.sh defaults/flow (branch/repo URLs and user prompts).

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
bin/install.sh	Changes installer defaults and removes interactive prompting (currently hardcodes fork/branch and forces options).
ansible/roles/system/tasks/main.yml	Migrates Docker repo key setup away from apt_key and adds signed-by to the repo entry.
ansible/roles/network/tasks/main.yml	Adds Debian-version-gated polkit configuration for NetworkManager (rules for 13+, pkla for <=12).

Comments suppressed due to low confidence (1)

ansible/roles/system/tasks/main.yml:314

• Because this task uses lineinfile without a regexp, hosts that already have the previous Docker repo line (without signed-by) will end up with two deb entries in docker.list after reruns/upgrades. Add a regexp (or use replace/template) so the existing Docker repo line is updated in-place rather than duplicated.

- name: Add Docker repo
  ansible.builtin.lineinfile:
    path: /etc/apt/sources.list.d/docker.list
    create: true
    line: "deb [arch={{ architecture }} signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian {{ debian_name.stdout }} stable"
    state: present
    owner: root
    group: root
    mode: "0644"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
3 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud