5

I want to test a new kernel for my ubuntu. I want the most recent stable kernel available. How can I do it securely? That is, no http downloads.

11
  • Kernel packages can be downloaded securely using HTTP.
    – user535733
    May 11, 2019 at 20:51
  • @user535733 I've only found way to download old kernels not newest ones May 11, 2019 at 20:54
  • Are you thinking about repositories, or the source tarball?
    – vidarlo
    May 11, 2019 at 20:59
  • Have you read the Ubuntu Kernel Team's Wiki, which has a lot of good resources and advice for new testers?
    – user535733
    May 11, 2019 at 21:01
  • Or are you testing for a specific purpose? For example, to see if a particular bug is fixed? If so, simply try a 19.04 LiveUSB or (soon) a 19.10 testing .iso
    – user535733
    May 11, 2019 at 21:02

2 Answers 2

7

You can download the newest versions of the kernel ready form Ubuntu at https://kernel.ubuntu.com/~kernel-ppa/mainline/

And then use

sudo dpkg --install *.deb

to install it

6
+50

Introduction

The key point in the question is how to do it securely. I've divided this answer into four sections:

  • How to find the newest mainline stable Ubuntu kernels
  • How to download the kernel and checksum files
  • How to verify checksums
  • How to install new kernel

How to find the newest mainline stable Ubuntu kernels

Go to https://kernel.ubuntu.com/~kernel-ppa/mainline and click on date modified two times. The first time sorts by date in ascending order, the second time sorts descending. Your newest kernels will be on top:

mainline kernel 1.png

I'm interested in 4.14.120 which is an LTS (Long Term Support) kernel for five years. I'll click on it and move to the next section:


How to download the kernel and checksum files

mainline kernel 2.png

I've selected the generic packages for downloading:

linux-headers-4.14.120-0414120_4.14.120-0414120.201905161610_all.deb
linux-headers-4.14.120-0414120-generic_4.14.120-0414120.201905161610_amd64.deb
linux-image-unsigned-4.14.120-0414120-generic_4.14.120-0414120.201905161610_amd64.deb
linux-modules-4.14.120-0414120-generic_4.14.120-0414120.201905161610_amd64.deb

Scroll down further and you will find the CHECKSUM files that guarantees what was published is what you actually received:

CHECKSUMS       2019-05-16 21:34    9.0K     
CHECKSUMS.gpg   2019-05-16 21:34    473     

Click both checksums to download them and move onto the next section.


How to verify checksums

After downloading checksum links follow these instructions:

Verifying the mainline build binaries

In order to allow verification that the published builds are the builds made by the mainline build system, the individual files are checksummed and the results of that published as CHECKSUMS in the same directory. This file is in turn signed by the mainline builder using the GPG key below which can be obtained from the Ubuntu Keyserver:

pub 2048R/17C622B0 2008-05-01 Key fingerprint = 60AA 7B6F 3043 4AE6 8E56 9963 E50C 6A09 17C6 22B0 uid Kernel PPA

The verification can be done by running the following commands:

Import the above public key to your keyring (if you haven't already done that):

$ gpg --keyserver hkps://pgp.mit.edu --recv-key "60AA7B6F30434AE68E569963E50C6A0917C622B0"

Download the CHECKSUMS and CHECKSUMS.gpg files from the build directory and verify if the CHECKSUMS is signed with the above key:

$ gpg --verify CHECKSUMS.gpg CHECKSUMS
gpg: Signature made .... using RSA key ID 17C622B0
gpg: Good signature from "Kernel PPA <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.

Verify the checksums of downloaded deb files:

$ shasum -c CHECKSUMS 2>&1 | grep 'OK$'

You should get a line ending with "OK" for each of downloaded deb file and each type of checksums that are given in the CHECKSUMS file.

I've edited the CHECKSUMS file and removed irrelevant kernels (ARM, S390, low-latency, Power PC and 32-Bit) to leave only the checksums for files downloaded above:

# Checksums for v4.14.120, check with the command below:
#     shasum -c CHECKSUMS
#
# Checksums-Sha1:
b26b07d9ae2dcf25648dab3fe2374f6a2df219d1  COMMIT
44d09220f11394adb7067a79ce1693ed8e6e149e  linux-headers-4.14.120-0414120_4.14.120-0414120.201905161610_all.deb
4cea2a7041ddf2655426f9fc4a57c39d0b6e02b8  linux-headers-4.14.120-0414120-generic_4.14.120-0414120.201905161610_amd64.deb
24ae91d3d812ef2fec4527f5d2acd5d089c27cb1  linux-image-unsigned-4.14.120-0414120-generic_4.14.120-0414120.201905161610_amd64.deb
194fbaae734d33ba26ec1bb631f59b1c01740a3d  linux-modules-4.14.120-0414120-generic_4.14.120-0414120.201905161610_amd64.deb

#
# Checksums-Sha256:
c253adc68879d07caffca5037ca997d7d2c7b74e87073093566c33e7a6a517e8  COMMIT
bf32ef3ee0b410f9264f1b6dd2349c5753ba73d02b5977d49010120ac6f1e7aa  linux-headers-4.14.120-0414120_4.14.120-0414120.201905161610_all.deb
4f769f431f99cadb4c564d0da4c6231a2c593307c10c520f81b74834a6149b28  linux-headers-4.14.120-0414120-generic_4.14.120-0414120.201905161610_amd64.deb
b18a6163ec0a42a598795cb181dcde86d0c59e9b9b117a1b9e5d7186e967b59a  linux-image-unsigned-4.14.120-0414120-generic_4.14.120-0414120.201905161610_amd64.deb
8aa8790171b9e948f2d5b0ce8c54a81d2b2bfb9d33ead499d865f841497fcabc  linux-modules-4.14.120-0414120-generic_4.14.120-0414120.201905161610_amd64.deb

Note: For some reason the CHECKSUMS file opened up instead of downloading. I had to copy and paste text to manually created file CHECKSUMS.


How to install new kernel

Assuming checksum verification passed change to your downloads directory and install:

cd ~/Downloads        # Go to our downloads directory
sudo dpkg -i *.deb    # Install all four kernel .deb files downloaded
rm -f *.deb           # Clean up so we don't accidentally install next time around
reboot                # reboot to grub and select new kernel on Advanced Options

Note don't key in # comments those are for explanation purposes and machine ignores them.

1
  • I get a issue with this gpg --keyserver hkps://pgp.mit.edu --recv-key "60AA7B6F30434AE68E569963E50C6A0917C622B0"' : "gpg: échec de réception depuis le serveur de clefs : Fin de fichier" But it works with this `gpg --recv-key "60AA7B6F30434AE68E569963E50C6A0917C622B0"
    – Oli
    Sep 12, 2020 at 14:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .