Install latest Linux kernel based on trixie-backports.

trixie-backports.sh

#!/usr/bin/env bash
set -euo pipefail

# 1. Ensure the script is executed with root privileges
if [[ $EUID -ne 0 ]]; then
    echo "[ERROR] This script must be run as root or with sudo." >&2
    exit 1
fi

# 2. Detect Debian codename (defaulting to trixie if undetected)
CODENAME=$(lsb_release -cs 2>/dev/null || grep -oP '(?<=VERSION_CODENAME=).*' /etc/os-release || echo "trixie")
BACKPORTS_SUITE="${CODENAME}-backports"
REPO_FILE="/etc/apt/sources.list.d/${BACKPORTS_SUITE}.list"

echo "[INFO] Configuring repository for suite: ${BACKPORTS_SUITE}"

# 3. Add Backports repository with all necessary firmware sections
cat <<EOF > "${REPO_FILE}"
# Debian Backports repository (configured for kernel & firmware stack)
deb http://deb.debian.org/debian ${BACKPORTS_SUITE} main contrib non-free non-free-firmware
EOF

# 4. Detect CPU architecture/vendor for correct microcode package
MICROCODE_PKG=""
if grep -q "GenuineIntel" /proc/cpuinfo; then
    MICROCODE_PKG="intel-microcode"
elif grep -q "AuthenticAMD" /proc/cpuinfo; then
    MICROCODE_PKG="amd64-microcode"
fi

# 5. Build package list
PACKAGES=(
    "linux-image-amd64"
    "linux-headers-amd64"
    "firmware-linux"
    "firmware-linux-nonfree"
    "firmware-sof-signed"
    "wireless-regdb"
    "linux-cpupower"
    "dkms"
)

if [[ -n "${MICROCODE_PKG}" ]]; then
    PACKAGES+=("${MICROCODE_PKG}")
fi

# 6. Update APT indexes
echo "[INFO] Updating APT package cache..."
apt update

# 7. Install packages target-locked to backports
echo "[INFO] Installing kernel stack: ${PACKAGES[*]}"
apt install -y -t "${BACKPORTS_SUITE}" "${PACKAGES[@]}"

# 8. Rebuild initramfs for all installed kernels
echo "[INFO] Rebuilding initramfs images with updated firmware/microcode..."
update-initramfs -u -k all

echo "[SUCCESS] Backports kernel, firmware, microcode, and tooling installed."
echo "[INFO] Reboot the system to boot into the new kernel ('sudo reboot')."