Debian's non-free-firmware Component: What Changed in Bookworm and Why Your Upgrade Might Be Missing Firmware Updates

The Problem: Wireless Works During Install, Then Stops Updating After Upgrade

You install Debian 12 "Bookworm" on a laptop. The installer detects your Intel Wi-Fi card, loads the firmware blob, and you're online before the first reboot. Six months later you run apt update && apt upgrade and notice firmware-iwlwifi hasn't been touched in months. The package isn't broken—it's just no longer receiving updates because your sources.list is missing the new non-free-firmware component that Debian 12 introduced.

Why Debian Split Firmware Into Its Own Component

For decades Debian separated its archive into three components: main (DFSG-free), contrib (free software depending on non-free), and non-free (everything else). Device firmware blobs—opaque vendor binaries for Wi-Fi, GPU, Bluetooth—lived in non-free alongside utilities like unrar and proprietary fonts.

That created a practical problem: the official installer images contained no firmware, so common laptops arrived at the desktop with dead wireless and no graphical acceleration. A 2022 General Resolution amended the Social Contract to allow non-free firmware in the installer only, while keeping the installed system free by default. The implementation was a new archive component, non-free-firmware, distinct from non-free.

Since Debian 12, the netinst and DVD images bundle firmware packages. The installer loads them only when the hardware demands them. After installation you can drop the component entirely if you want a firmware-free system.

The Upgrade Pitfall: Missing Component Means Stale Firmware

If you upgraded from Debian 11 "Bullseye" to 12 via apt full-upgrade, your sources.list likely still reads:

deb http://deb.debian.org/debian bookworm main contrib non-free

The non-free-firmware component is absent. Firmware packages moved there, so apt never sees new versions. The release notes explicitly call this out, but it's easy to miss during a routine upgrade.

Current stable is Debian 13 "Trixie" (released 2025); Bookworm is now oldstable. The same component structure applies, so the fix is identical regardless of which stable you're on.

Worked Example: Adding the Component and Installing Firmware

Run the following as root (or via sudo) on a Debian 12 or 13 system. The commands modify APT sources and install firmware; they do not change kernel or driver modules directly.

1. Check your current sources

cat /etc/apt/sources.list
cat /etc/apt/sources.list.d/*.sources 2>/dev/null || true

Look for lines containing bookworm or trixie with main contrib non-free but no non-free-firmware.

2. Add the component

Traditional one-line format (/etc/apt/sources.list):

sed -i 's/\(main contrib non-free\)$/\1 non-free-firmware/' /etc/apt/sources.list

deb822 format (/etc/apt/sources.list.d/debian.sources):

sed -i 's/^Components: \(.*\)$/Components: \1 non-free-firmware/' /etc/apt/sources.list.d/debian.sources

Verify the change with cat on the edited file.

3. Update and identify the firmware you need

apt update
lspci -k | grep -A3 -i wireless

The lspci -k output shows the kernel driver in use (e.g., iwlwifi) and the firmware file it expects. Match that to a package:

• Intel Wi-Fi: firmware-iwlwifi
• Realtek Wi-Fi/Bluetooth: firmware-realtek
• AMD GPU: firmware-amd-graphics
• Broadcom: firmware-brcm80211

If unsure, apt search firmware- | grep -i <vendor> helps narrow it down.

4. Install and activate

apt install firmware-iwlwifi
modprobe -r iwlwifi && modprobe iwlwifi
# or simply reboot

Confirm the firmware loaded:

dmesg -T | grep -i firmware

You should see lines like iwlwifi 0000:00:14.3: loaded firmware version XX.XX.XX.

Trade-offs and Limitations

• Ideological purity vs. convenience: The separate component exists so users who reject opaque binaries can exclude non-free-firmware while still getting a working installer. If you keep it, you accept vendor-driven update cadence and unauditable blobs.
• Not a catch-all: Some firmware-adjacent packages (e.g., intel-microcode, amd64-microcode) remain in plain non-free. You may need both components.
• Firmware ≠ driver support: Very new hardware may require a newer kernel from backports even with the correct firmware installed. Firmware alone doesn't guarantee device support.
• Package names vary: Always confirm with lspci -k or dmesg rather than guessing. Installing firmware-misc-nonfree pulls many blobs but adds bulk.

Verify It Works and Plan Ahead

After the steps above, run:

dpkg -l 'firmware-*'
apt policy firmware-iwlwifi

The first lists installed firmware packages; the second shows the candidate version and origin (should reference non-free-firmware).

Debian stable releases arrive roughly every two years, with full security support for about three years plus two more under the LTS team. Firmware updates stop when the release reaches end-of-life, so the long-term fix is upgrading to the next stable. For now, adding non-free-firmware restores the update stream your hardware depends on.