Update firmware packages from bookworm-backports on Debian 12

Firmware packages in standard Debian repo are too old for recent
kernels, and recent hardware in general. This affects all kernel-latest
versions, but also soon-to-be-default kernel-6.12. This is at least
necessary to support wifi network in NovaCustom laptops, but other
modern systems need that too.
Fresh template builds have firmware from bookworm-backports already
selected, but do that for older versions too.

Build the URL based on `apt-get --print-uris update` output to match
protocol used for the main Debian repo (tor, apt-cacher-ng etc).

Thanks @aronowski for the hint on apt properties.
Fixes QubesOS/qubes-issues#9815

Author: marmarek

vmupdate/agent/source/plugins/firmware_backports.py

@@ -0,0 +1,83 @@
+# coding=utf-8
+#
+# The Qubes OS Project, http://www.qubes-os.org
+#
+# Copyright (C) 2025  Marek Marczykowski-Górecki
+#                             <marmarek@invisiblethingslab.com>
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301,
+# USA.
+
+import os
+import subprocess
+
+sources_list = "/etc/apt/sources.list.d/backports.list"
+base_repo_url = "deb.debian.org/debian/dists/bookworm/InRelease"
+backports_line = (
+    "deb {baseurl} bookworm-backports main contrib non-free-firmware\n"
+)
+prefs_path = "/etc/apt/preferences.d/firmware_backports"
+prefs_data = """\
+Package: src:firmware-nonfree
+Pin: release n=bookworm-backports
+Pin-Priority: 600
+"""
+
+
+def firmware_backports(os_data, log, **kwargs):
+    """
+    Update firmware packages from backports repository.
+
+    https://github.com/QubesOS/qubes-issues/issues/9815
+    """
+    if os_data.get("codename", "") == "bookworm":
+        # do anything only if firmware package is installed already
+        try:
+            output = subprocess.check_output(
+                ["dpkg", "-l", "firmware-linux-nonfree"],
+                stderr=subprocess.DEVNULL,
+            )
+            if b"bpo" in output:
+                # version from backports already installed
+                return
+        except subprocess.CalledProcessError:
+            return
+        # find URL flavor used for deb.debian.org
+        try:
+            output = subprocess.check_output(
+                ["apt-get", "--print-uris", "update"],
+                stderr=subprocess.DEVNULL,
+            )
+        except subprocess.CalledProcessError:
+            return
+        baseurl = None
+        for url in output.decode().splitlines():
+            if not baseurl and base_repo_url in url:
+                baseurl = (
+                    url.split()[0]
+                    .strip("'")
+                    .replace("/dists/bookworm/InRelease", "")
+                )
+            if "/debian/dists/bookworm-backports/" in url:
+                # backports already enabled
+                return
+        # add bookworm-backports if not already there
+        if baseurl and not os.path.exists(sources_list):
+            with open(sources_list, "w") as sources:
+                sources.write(backports_line.format(baseurl=baseurl))
+        # then pin firmware packages to backports repo
+        if not os.path.exists(prefs_path):
+            with open(prefs_path, "w") as prefs:
+                prefs.write(prefs_data)