Bug#1094493: d-i.debian.org: non-free-firmware opt-out isn't respected on installation

[Loskraes <loskraes@servoj.ch>]

Package: d-i.debian.org
Severity: normal
Tags: d-i

Dear Maintainer,

I've recently reinstall Debian from debian-12.9.0-amd64-netinst.iso in
expert mode in french.

When the installer ask about non-free-firmware, I answers I don't wan
it.

After the installation the package intel-microcode (from non-free-
firmware) is present on my system, and the component non-free-firmware
isn't present in /etc/apt/sources.list.
The component non-free-firmware and contrib (but not non-free) is
present in commented-out line cd-rom in sources.list.

After that I've tested some other configuration installation in KVM :

 - Non-expert mode : the question isn't asked (not a good thing in my
opinion, but well).

 - Expert mode but without Internet : the question isn't asked, I wish
this kind of question is always asked in expert when this gives a
different installation, and non-free-firmware and contrib is present on
active cdrom line in sources.list.

 - Expert mode online : question asked but the answer is only used for
configuring final sources.list, not for the installation.

 - I also tested the image debian-trixie-DI-alpha1-amd64-netinst.iso,
and it has the same problem.

I think there are these problems:

 - Debian-installer should respect the user's choice about non-free
packages (incl. firmware)

 - When a package is installed by debian-install, I think it would be
updated during apt update/upgrade, the absence of security update is a
security risk for user.

My opinion is the question about non-free-firmware should be also asked
on non-expert mode, but I guess this is a Debian decision.

Greeting,

Loskraes