A couple of hours ago, forky (testing) got initramfs-tools 0.151.
Its hard dependency changed from cpio to 3cpio|cpio.
This causes SOME freshly built systems to silently omit AMD microcode.

I think this ONLY affects people who do ALL of the following:

  * opt-out of Recommends;
  * opt-out of Priority: standard; and
  * opt-out of dracut.

Here is the actual warning message:

    # update-initramfs -u -k all
    update-initramfs: Generating /boot/initrd.img-7.0.4+deb14-cloud-amd64
    /usr/share/initramfs-tools/hooks/amd64_microcode: 102: cpio: not found
    /usr/share/initramfs-tools/hooks/amd64_microcode: 104: cpio: not found
    E: amd64-microcode: failed to create or prepend the early initramfs to the initramfs
    live-boot: core filesystems dm-verity devices utils udev blockdev dns.

This is the relevant code:

https://sources.debian.org/src/amd64-microcode/3.20251202.1/debian/initramfs.hook#L94-L110

Here are minimum recipes to reproduce the problem:

    $ mmdebstrap forky /dev/null http://localhost:3142/debian --quiet --dpkgopt=force-confold --essential-hook='mkdir -p $1/etc/default; echo AMD64UCODE_INITRAMFS=early >$1/etc/default/amd64-microcode' --include=linux-image-cloud-amd64,initramfs-tools,amd64-microcode --components=main,non-free-firmware --customize-hook='chroot $1 lsinitramfs /initrd.img | grep microcode; DPKG_ROOT=$1 dpkg-query --show initramfs-tools-core cpio 3cpio'

    kernel/x86/microcode
    kernel/x86/microcode/AuthenticAMD.bin               [expected, all is well]
    etc/modprobe.d/amd64-microcode-blacklist.conf

    3cpio
    cpio	2.15+dfsg-2.1
    initramfs-tools-core	0.151

    $ mmdebstrap forky /dev/null http://localhost:3142/debian --quiet --dpkgopt=force-confold --essential-hook='mkdir -p $1/etc/default; echo AMD64UCODE_INITRAMFS=early >$1/etc/default/amd64-microcode' --include=linux-image-cloud-amd64,initramfs-tools,amd64-microcode --components=main,non-free-firmware --customize-hook='chroot $1 lsinitramfs /initrd.img | grep microcode; DPKG_ROOT=$1 dpkg-query --show initramfs-tools-core cpio 3cpio' --variant=apt

    etc/modprobe.d/amd64-microcode-blacklist.conf
    [unexpected, AuthenticAMD.bin is missing, no fatal error!]

    3cpio	0.14.0-1+b1
    cpio
    initramfs-tools-core	0.151

Here is the same test using the default initrd (dracut), working with both 3cpio and cpio.

    $ mmdebstrap forky /dev/null http://localhost:3142/debian --quiet --dpkgopt=force-confold --essential-hook='mkdir -p $1/etc/default; echo AMD64UCODE_INITRAMFS=early >$1/etc/default/amd64-microcode' --include=linux-image-cloud-amd64,amd64-microcode --components=main,non-free-firmware --customize-hook='chroot $1 lsinitrd | grep microcode; DPKG_ROOT=$1 dpkg-query --show dracut-core cpio 3cpio'
    drwxr-xr-x   2 root     root            0 May 13 04:07 kernel/x86/microcode
    -rw-r--r--   1 root     root       304866 May 13 04:07 kernel/x86/microcode/AuthenticAMD.bin
    3cpio
    cpio	2.15+dfsg-2.1
    dracut-core	110-12

    $ mmdebstrap forky /dev/null http://localhost:3142/debian --quiet --dpkgopt=force-confold --essential-hook='mkdir -p $1/etc/default; echo AMD64UCODE_INITRAMFS=early >$1/etc/default/amd64-microcode' --include=linux-image-cloud-amd64,amd64-microcode --components=main,non-free-firmware --customize-hook='chroot $1 lsinitrd | grep microcode; DPKG_ROOT=$1 dpkg-query --show dracut-core cpio 3cpio' --variant=apt
    drwxr-xr-x   2 root     root            0 May 13 04:09 kernel/x86/microcode
    -rw-r--r--   1 root     root       304866 May 13 04:09 kernel/x86/microcode/AuthenticAMD.bin
    3cpio	0.14.0-1+b1
    cpio
    dracut-core	110-12

I did not test tiny-initramfs.

Can amd64-microcode's debian/initramfs.hook use 3cpio if it is installed (and cpio is not)?

Can "E: amd64-microcode: failed" exit non-zero, so
the build clearly fails,
instead of appearing to work but lacking microcode patches?

I would provide a patch, but I'm not yet familiar with 3cpio myself.

Can 3cpio provide a cpio-is-3cpio compatibility deb, like gpg-from-sq?
Then packages like amd64-microcode would continue to Just Work as-is.