Migration to 12 fails, apparently on debian upgrade

What type of hardware are you using: VPS bought online
What YunoHost version are you running: 11.3.0.2
How are you able to access your server: SSH
****Are you in a special context or did you perform specific tweaking on your YunoHost instance ?: no

### Describe your issue
System was running the latest version 11 without issues. Upgrading to 12 resulted in lost access via the web, so i reverted to ssh, and can run shell/yunohost command line fine. from trying ‘apt upgrade’ it appears some key packages yunohost depends on are held back, and yunohost itself cannot be upgraded due to lack of GPG key? I tried running the various key update fixes such as:
curl -fsSL https://forge.yunohost.org/yunohost.asc | sudo tee /usr/share/keyrings/yunohost.gpg > /dev/null

But still get ‘NO_PUBKEY 5D09F2273DAC3BD5’
I have looked through the logs at /var/log/yunohost, but nothing apparent there, all seems normal, but could be before the system upgrade took place. Further outputs below.

Share relevant logs or error messages

# apt update**
Hit:1 Index of /debian-security bookworm-security InRelease**
Hit:3 https://repos-droplet.digitalocean.com/apt/droplet-agent main InRelease
Hit:4 Index of /php/ bookworm InRelease ****
Hit:5 Index of /debian bookworm InRelease
Get:2 Index of /debian/ bookworm InRelease [15.4 kB]
Hit:6 Index of /debian bookworm-updates InRelease
Ign:2 Index of /debian/ bookworm InRelease
Fetched 15.4 kB in 1s (11.6 kB/s)
Reading package lists… Done
Building dependency tree… Done
Reading state information… Done
69 packages can be upgraded. Run ‘apt list --upgradable’ to see them.
W: GPG error: Index of /debian/ bookworm InRelease: The following signatures couldn’t be verified because the public key is not available: NO_PUBKEY 5D09F2273DAC3BD5
=====
apt policy yunohost
yunohost:
**** Installed: 11.3.0.2

**** Candidate: 12.0.7****
**** Version table:****
**** 12.0.7 500****
**** 500 Index of /debian/ bookworm/stable amd64 Packages****
**** *** 11.3.0.2 100****
**** 100 /var/lib/dpkg/status****
-----
Trying to force one of the held back packages, it appears there is also a dependency problem:
apt install dovecot-core
Reading package lists… Done
Building dependency tree… Done
**Reading state information… Done **
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
** yunohost : Conflicts: dovecot-core (>= 1:2.3.14) but 1:2.3.19.1+dfsg1-2.1+deb12u1 is to be installed**
** Conflicts: openssl (>= 3.0) but 3.0.15-1~deb12u1 is to be installed**
E: Error, pkgProblemResolver::Resolve generated breaks, this may be caused by held packages.

apt upgrade
Reading package lists… Done
Building dependency tree… Done
Reading state information… Done
Calculating upgrade… Done
The following packages have been kept back:
** dovecot-antispam dovecot-core dovecot-imapd dovecot-ldap dovecot-lmtpd dovecot-managesieved**
** dovecot-sieve fail2ban iptables libalgorithm-diff-xs-perl libclone-perl libdbi-perl libfcgi-perl**
** libfile-fcntllock-perl libgssapi-perl libhtml-parser-perl libhttp-message-perl libip4tc2 libip6tc2**
** libiptc0 liblocale-gettext-perl libnet-dns-sec-perl libnet-libidn-perl libnet-ssleay-perl**
** libnetaddr-ip-perl libnginx-mod-http-auth-pam libnginx-mod-http-cache-purge libnginx-mod-http-dav-ext**
** libnginx-mod-http-echo libnginx-mod-http-fancyindex libnginx-mod-http-geoip libnginx-mod-http-geoip2**
** libnginx-mod-http-headers-more-filter libnginx-mod-http-image-filter libnginx-mod-http-lua**
** libnginx-mod-http-ndk libnginx-mod-http-perl libnginx-mod-http-subs-filter**
** libnginx-mod-http-uploadprogress libnginx-mod-http-upstream-fair libnginx-mod-http-xslt-filter**
** libnginx-mod-mail libnginx-mod-nchan libnginx-mod-stream libnginx-mod-stream-geoip**
** libnginx-mod-stream-geoip2 libsemanage-common libsocket6-perl libterm-readkey-perl**
** libtext-charwidth-perl libtext-iconv-perl libxtables12 nginx-common nginx-extras openssl passwd perl**
** perl-base perl-openssl-defaults redis-server redis-tools slapd**
0 upgraded, 0 newly installed, 0 to remove and 62 not upgraded.

-------
Also tried ‘apt install yunohost’
and got:
47 upgraded, 20 newly installed, 2 to remove and 19 not upgraded.
Need to get 1,435 kB/18.5 MB of archives.
After this operation, 52.7 MB of additional disk space will be used.
Do you want to continue? [Y/n]
Get:1 Index of /debian bookworm/main amd64 slapd amd64 2.5.13+dfsg-5 [1,435 kB]
Fetched 1,435 kB in 0s (34.3 MB/s)
E: This installation run will require temporarily removing the essential package yunohost:amd64 due to a Conflicts/Pre-Depends loop. This is often bad, but if you really want to do it, activate the APT::Force-LoopBreak option.
E: Reverse conflicts early remove for package ‘nginx-extras:amd64’ failed


In the interim i tried to restore the ‘preupgrade’ backup of a wordpress instance that was deleted in the upgrade process, onto another working instance of yunohost i have running, and got these errors:
https://paste.yunohost.org/raw/abunuqucaw

If the migration failed, then please share the logs of the failed migration, not just your attempt at fixing it … You can use yunohost log list and yunohost log share <log_id> to share the log of the failed migration

When it happened, i didn’t see much in the log that seemed helpful, and strange, now i don’t see a relevant log file in /var/log/yunohost/operations, perhaps because after the upgrade failed I mistakenly updated debian directly with apt?

Anyway, In the interim i found that after running ‘apt install --fix-broken’ I was able to patch much of the system together, with the help of another instance of an upgraded yunohost on another machine (i had to copy the file from /var/cache/yunohost/sessions/ from the running system - i suspect there is a better way )… Well the two remaining issues are:

  1. W: GPG error: Index of /debian/ bookworm InRelease: The following signatures couldn’t be verified because the public key is not available: NO_PUBKEY 5D09F2273DAC3BD5

  2. The deleted instance of wordpress, which i think was due to it being an import from squarespace that i had worked on, because the other vanilla install wordpress instances were unaffected by the upgrade.

I was able to use the upgrade-backup of the wordpress instance to extract the /var/www/ directory and import the sql database, but then when i used the yunohost cli to upgrade the wordpress installation, it got deleted again. - here are the logs:

https://paste.yunohost.org/raw/abunuqucaw
https://paste.yunohost.org/raw/aqojisazil

I repeated the manual restore process to put up the web site again, but I wonder if it will get deleted next time there is an upgrade…