[Solved] how make sure not installing non free software? debian 12

[hthi]

debian-12.0.0-amd64-DVD-1.iso

when installing how can you avoid getting non free software on the pc, in
particular the non free firmware matter?

If you install on a pc which does not require non free software and you delete non free
firmware from the sources list after installation, you know that there is
no non free firmware on the pc?
Thanks.

Solution.
Start debian 12 iso
Press e
Before --- quiet
enter
firmware=never
Press ctrl+x.

After installation.
In order to verify if non free firmware has been installed
command apt policy *nonfree
returns
Installed: (none)
about all packages.

command apt search firmware
returns
firmware-linux-free [installed,automatic]
verifying free linux firmware has been installed.

You may want to edit the sources.list file.

[Random_Troll]

I think blocking the relevant kernel module(s) from loading (via the kernel command line in the bootloader screen) will stop the firmware from being installed. Not tried it though so I might be wrong.

Once the system is installed it can be cleansed with

Code: Select all

# apt install vrms
# apt purge --autoremove $(vrms -s)

Check the output before agreeing though, just in case APT tries to autoremove your desktop. If it tries to do that see viewtopic.php?f=16&t=104157 for a coping strategy.

[hthi]

blocking the relevant kernel module(s)

That is likely to complicated for me.

Once the system is installed it

After installation identifying non free firmware packages
and then uninstall them sounds more viable. Followed by deleting
non free firmware repositories from the
sources list.

vrms

https://packages.debian.org/source/book ... fsg-status

I have heard that these programs sometimes miss
identifying installed non free software packages. Do you know if check-dfsg-status
and vrms will identify any and all non free firmware packages if run after
installation of debian 12?

[Random_Troll]

They should do. If they don't file a bug report against it.

You could also use

Code: Select all

aptitude search '?narrow(?installed,?section(non-free))'
aptitude search '~n~i~scontrib'

https://www.debian.org/doc/manuals/apti ... 05.en.html

[wizard10000]

...when installing how can you avoid getting non free software on the pc, in
particular the non free firmware matter?

The installer will prompt you for both non-free firmware and non-free software. The installer defaults to yes for non-free firmware and no for non-free software but all you have to do to disable non-free firmware in the installer is change a checkbox from yes to no.

[oysterboy]

debian-12.0.0-amd64-DVD-1.iso

when installing how can you avoid getting non free software on the pc, in
particular the non free firmware matter?

If you install on a pc which does not require non free software and you delete non free
firmware from the sources list after installation, you know that there is
no non free firmware on the pc?
Thanks.

Non-free software is never installed by default - only non-free firmware, since bookworm, and only when deemed necessary by the hardware.

There is a boot parameter to ensure absolutely no non-free software gets installed:

"Users who wish to disable firmware lookup entirely can do so by setting the firmware=never boot parameter. It's an alias for the longer hw-detect/firmware-lookup=never form."

from https://www.debian.org/releases/bookworm/amd64/ch02s02

[sunrat]

Computers without devices requiring non-free-firmware are quite rare these days. Are you absolutely sure you don't need any?

[Onsemeliot]

When I tested Debian 12 installation recently I didn't notice any option to disable non-free firmware. Do I need to use the advanced installation routine to get it? (I did use the normal non-graphical installer.) BTW: I use 10+ years old laptops.

[kent_dorfman766]

in simplest terms, to answer the question, don't install anything from the non-free repos. You select which repos you want under /etc/apt/sources.list

IOW, remove non-free from the lists in the file.

[Onsemeliot]

You seem to talk about how I can remove non-free software after having installed the system. But I am talking about ensuring to not installing non-free firmware in the first place. This doesn't seem to be the same thing. It seems I will have to run an other test. Hopefully I will see the option now that I know what I am looking for.

[Random_Troll]

There are two (2) solutions listed in this thread that will prevent non-free firmware from being installed. Have you tried them both yet?

[Onsemeliot]

I didn't try the kernel command line version since I am uncertain if I am knowledgable enough to do so sensibly. Hence, I would prefer using the option mentioned by wizard10000 later where I just can select not including non-free firmware in a menu. Unfortunately, I didn't notice this option when I tried. Therefore, I asked if it is only given in the expert installation routine so that I can use the adequate routine in my next attempt.
I do use the netinstall image because my USB stick isn't large enough to hold the full live image. Isn't an editable sources list only available when installing from a live system? Besides, I see no good reason to edit configuration files by hand (introducing the risk for making an error) if there is a built-in menu option to do the same thing.

Edit: Ok, now I tried it again on a different system. At least with the expert install I did get asked if I want to include non-free firmware.

Edit2: I by the way red an article from Libreleah (from libreboot) in which she convinced me that it is actually a good thing to include non-free firmware. This however doesn't apply to non-free software, but Debian still doesn't include that by default.

[hthi]

with the expert install I did get asked if I want to include non-free firmware.

Can you in detail write how you navigated the menu during installation and thereby
excluded non free software?

include non-free firmware.

Is microcode and firmware not two different matters? Libreboot does not consider microcode
being software therefore it is not non free or free software. Non free
firmware stays not a part of libreboot.
Correct?

If you install debian 12 from debian-12.0.0-amd64-DVD-1.iso then install check-dfsg-status and
run check-dfsg-status -s it returns
firmware-misc-nonfree
intel-microcode

My understanding of libreboot is, that the debian intel-microcode package can stay
on a free software system because it is not software. The debian firmware-misc-nonfree package is non free
software and should not be on a free software system.

[sunrat]

intel-microcode is copyright Intel Corporation. Not open source so therefore non-free.
https://github.com/intel/Intel-Linux-Pr ... in/license

It's code, whether you call it software is just semantics.

[baptx]

I also had this issue in August when installing Debian 12 LXQt ISO on a new laptop with a live USB graphical install.
It installed many proprietary firmware without my consent, most of them were useless, for example raspi-firmware because I did not use Raspberry Pi.
Can you ask user consent in the future with the normal graphical install? And detect which firmware is necessary? Or at least let the user choose the firmware they need?
Is it possible that proprietary firmware included in Debian default installation contains spyware that hides somewhere else (like viruses that are able to duplicate themselves in several locations) even after uninstalling all unnecessary packages we see with the command vrms? I was wondering if I need to reinstall the whole operating system without proprietary firmware to have a clean installation.

[None1975]

Can you ask user consent in the future with the normal graphical install? And detect which firmware is necessary? Or at least let the user choose the firmware they need?
Is it possible that proprietary firmware included in Debian default installation contains spyware that hides somewhere else (like viruses that are able to duplicate themselves in several locations) even after uninstalling all unnecessary packages we see with the command vrms? I was wondering if I need to reinstall the whole operating system without proprietary firmware to have a clean installation.

This is exactly what the Debian installer does. It automatically scans and installs only essential closed source packages. In addition, if you have to select "expert mode" in the installer menu, you will be asked during the installation whether to use closed source firmware.

It installed many proprietary firmware without my consent, most of them were useless, for example raspi-firmware because I did not use Raspberry Pi.

By the way, this error in the installer has been fixed a long time ago.

[baptx]

The issue was not fixed in August when I did an install from the file debian-live-12.0.0-amd64-lxqt.iso.
Here are all proprietary firmware packages that were installed when I checked vrms:

Code: Select all

               Non-free packages installed on debian

amd64-microcode                     Processor microcode firmware for AMD CPUs
atmel-firmware                      Firmware for Atmel at76c50x wireless networking chips.
bluez-firmware                      Firmware for Bluetooth devices
dahdi-firmware-nonfree              DAHDI non-free firmware
firmware-amd-graphics               Binary firmware for AMD/ATI graphics chips
firmware-ast                        Binary firmware for ASpeed Technologies graphics chips
firmware-atheros                    Binary firmware for Qualcomm Atheros wireless cards
firmware-bnx2                       Binary firmware for Broadcom NetXtremeII
firmware-bnx2x                      Binary firmware for Broadcom NetXtreme II 10Gb
firmware-brcm80211                  Binary firmware for Broadcom/Cypress 802.11 wireless c
firmware-cavium                     Binary firmware for Cavium Ethernet adapters
firmware-intel-sound                Binary firmware for Intel sound DSPs
firmware-ipw2x00                    Binary firmware for Intel Pro Wireless 2100, 2200 and
firmware-ivtv                       Binary firmware for iTVC15-family MPEG codecs (ivtv an
firmware-iwlwifi                    Binary firmware for Intel Wireless cards
firmware-libertas                   Binary firmware for Marvell wireless cards
firmware-linux-nonfree              Binary firmware for various drivers in the Linux kerne
firmware-misc-nonfree               Binary firmware for various drivers in the Linux kerne
firmware-myricom                    Binary firmware for Myri-10G Ethernet adapters
firmware-netronome                  Binary firmware for Netronome network adapters
firmware-netxen                     Binary firmware for QLogic Intelligent Ethernet (3000
firmware-nvidia-tesla-gsp           NVIDIA GSP firmware (Tesla version)
firmware-qcom-soc                   Binary firmware for Qualcomm SoCs
firmware-qlogic                     Binary firmware for QLogic HBAs
firmware-realtek                    Binary firmware for Realtek wired/wifi/BT adapters
firmware-realtek-rtl8723cs-bt       Bluetooth firmware for Realtek RTL8723CS
firmware-samsung                    Binary firmware for Samsung MFC video codecs
firmware-siano                      Binary firmware for Siano MDTV receivers
firmware-sof-signed                 Intel SOF firmware - signed
firmware-ti-connectivity            Binary firmware for TI Connectivity wifi and BT/FM/GPS
firmware-zd1211                     binary firmware for the zd1211rw wireless driver
intel-microcode                     Processor microcode firmware for Intel CPUs
raspi-firmware                      Raspberry Pi family GPU firmware and bootloaders

  33 non-free packages, 1.4% of 2344 installed packages.

I only needed the proprietary package firmware-atheros for Bluetooth and the recommended proprietary package intel-microcode for security patches.
It would be nice if the graphical installer only installed these necessary proprietary packages on my laptop and asked user consent without expert mode (in case the user forgot to select it or if we want to use the graphical interface).

Let me know, if someone has an idea for my other question about security. But I guess this would only be technically possible with software packages, not firmware packages.

[baptx]

For information, the firmware=never parameter did not work at all when using the LXQt ISO file (I tested with the one I downloaded a few months ago debian-live-12.0.0-amd64-lxqt.iso), the non-free firmware packages were installed. And with the LXQt ISO file, the graphical expert install as well as the text expert install did not ask me if I want the non-free firmware packages, they were installed automatically.
I noticed the firmware=never parameter only worked with the netinst ISO file.
For the automatic detection of needed non-free firmware packages, it only worked with the netinst ISO file as well (the LXQt ISO file installed all non-free firmware packages). But even with netinst ISO file, it seems it is only guessing the non-free firmware packages needed since several were not needed to make my laptop work correctly (firmware-realtek, firmware-sof-signed).
I hope you will fix these issues.
Edit: the package firmware-misc-nonfree was only needed for hardware acceleration on the integrated Intel GPU, otherwise software like glxgears used the CPU.

It would also be useful to have the firmware=never parameter added in a menu in the normal graphical installation (for people who don't want the complexity of the expert installation), since it is more convenient to have it in a menu and also avoids mistakes when typing firmware=never (I accidentally typed firmzare due to my AZERTY keyboard and the QWERTY input). It would be a good idea to warn the user if the entered parameter / value does not exist, to avoid unwanted results like installing non-free firmware.

[Aki]

For information, the firmware=never parameter did not work at all when using the LXQt ISO file [..]

Please open a new discussion and report the installer log (/var/log/installer/syslog).

You can report logs in one the following ways:

• paste them into the Debian Pastezone service (https://paste.debian.net) and report the URL/link of the paste in a follow-up message

• attaching the logs to a follow-up forum message as a compressed zip or gz file

• paste logs into the body of a follow-up message between code tags (if they fit the size of a forum message)

[baptx]

I reformatted my computer after this issue so I don't have the logs anymore.
But everybody should be able to reproduce the issue with the LXQt ISO file (debian-live-12.0.0-amd64-lxqt.iso or newer version).