An alternative to manually installing libssl3
, is to pin that package. Pinning is described in the Community Help Wiki.
You need to edit 3 files. Create them first with sudo touch <filename>
if they don't yet exist. This makes sure that permissions and ownership are set correctly.
/etc/apt/apt.conf.d/01ubuntu
APT::Default-Release "impish";
This makes impish
the default Ubuntu release to install packages from.
/etc/apt/sources.list.d/ubuntu-jammy.list
deb http://mirror.example.com/ubuntu/ jammy main
This adds the jammy
(22.04) repository. Ubuntu is not actually using it by default, because of the value of APT::Default-Release
. I repeat, and I can't stress this enough: Ubuntu will never ever install any package from this (or any other) jammy
repository, unless one of these conditions is true:
- you explicitly tell
apt
to install a specific version that only exists in the jammy
repository (this supposes that you know what you are doing!)
- a (specific version of a) package is pulled in as a dependency
- you create an exception to the general rule using pinning - see next file.
- the package does not exist in the main Ubuntu repository and only exists in an added third-party repository, like a PPA.
/etc/apt/preferences.d/libssl3
Package: libssl3
Pin: release n=jammy
Pin-Priority: 900
This gives a higher priority to the package libssl3
coming from the jammy
repository, and only that package. So for all packages, impish
is the default, and for libssl3
there is an exception.
Now run sudo apt update
. Don't run it before you have edited all 3 files!
To see which packages are going to be installed, run apt-cache policy
:
$ apt-cache policy libssl3
libssl3:
Installed: (none)
Candidate: 3.0.1-0ubuntu1
Version table:
3.0.1-0ubuntu1 900
500 http://mirror.unix-solutions.be/ubuntu jammy/main amd64 Packages
100 /var/lib/dpkg/status
As you can see, there is only one installation candidate for libssl3
, from the jammy
repository.
$ apt-cache policy linux-image-generic
linux-image-generic:
Installed: 5.13.0.35.44
Candidate: 5.13.0.35.44
Version table:
5.15.0.22.24 500
500 http://mirror.unix-solutions.be/ubuntu jammy/main amd64 Packages
*** 5.13.0.35.44 990
990 http://mirror.unix-solutions.be/ubuntu impish-updates/main amd64 Packages
990 http://mirror.unix-solutions.be/ubuntu impish-security/main amd64 Packages
100 /var/lib/dpkg/status
5.13.0.19.30 990
990 http://mirror.unix-solutions.be/ubuntu impish/main amd64 Packages
The package linux-image-generic
is available:
- at version
5.15.0.22.24
, in jammy/main
, with priority 500
- at version
5.13.0.35.44
, in impish-updates/main
and impish-security/main
, with priority 990
- at version
5.13.0.19.30
(the original version from the USB or DVD installer at release), in impish/main
, with priority 990
.
The ***
indicates which version will be installed.
In my particular use case, I had to install many kernels: 5.13
, 5.14
, 5.15
, 5.16
, 5.17
. I currently have 35 kernels installed:
$ ls -1 /boot/initrd* | wc --lines
35
To demonstrate that libssl
is automatically installed as a dependency when needed, I install the Ubuntu kernel 5.15.0-22-generic
, which is also from Jammy:
$ sudo apt install linux-{image,headers,modules,modules-extra}-5.15.0-22-generic
Reading package lists... Done
Building dependency tree... Donesudo apt install linux-{image,headers,modules,modules-extra}-5.15.0-22-generic
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
libssl3 linux-headers-5.15.0-22
Suggested packages:
fdutils linux-doc | linux-source-5.15.0
The following NEW packages will be installed:
libssl3 linux-headers-5.15.0-22 linux-headers-5.15.0-22-generic linux-image-5.15.0-22-generic linux-modules-5.15.0-22-generic linux-modules-extra-5.15.0-22-generic
0 upgraded, 6 newly installed, 0 to remove and 0 not upgraded.
Need to get 103 MB of archives.
After this operation, 565 MB of additional disk space will be used.
Do you want to continue? [Y/n]
Reading state information... Done
The following additional packages will be installed:
libssl3 linux-headers-5.15.0-22
Suggested packages:
fdutils linux-doc | linux-source-5.15.0
The following NEW packages will be installed:
libssl3 linux-headers-5.15.0-22 linux-headers-5.15.0-22-generic linux-image-5.15.0-22-generic linux-modules-5.15.0-22-generic linux-modules-extra-5.15.0-22-generic
0 upgraded, 6 newly installed, 0 to remove and 0 not upgraded.
Need to get 103 MB of archives.
After this operation, 565 MB of additional disk space will be used.
Do you want to continue? [Y/n]
As you can see, the package libssl3
is automatically pulled in as a dependency.
If one does not need a 5.15 kernel, then one simply installs libssl3
directly:
$ sudo apt install --yes libssl3
With all of this, one still hasn't installed a mainline kernel, and I strongly agree with all warnings regarding permanently adding a kernel PPA. As an alternative, you can use the Ubuntu Mainline Kernel Installer (UMKI), a graphical tool to install the latest mainline kernels. It fetches the list from the mainline kernel PPA, without actually needing to add the PPA to your sources. You can install the .deb
package from the GitHub releases pages, or do this:
sudo add-apt-repository ppa:cappelikan/ppa
sudo apt update
sudo apt install mainline
If you don't like (or can't use) a GUI, it also has a CLI:
$ mainline
mainline 1.0.15
Distribution: Ubuntu 21.10
Architecture: amd64
Running kernel: 5.13.0-22-generic
mainline 1.0.15 - Ubuntu Mainline Kernel Installer
Syntax: mainline <command> [options]
Commands:
--check Check for kernel updates
--notify Check for kernel updates and notify current user
--list List all available mainline kernels
--list-installed List installed kernels
--install-latest Install latest mainline kernel
--install-point Install latest point update for current series
--install <name> Install specified mainline kernel(1)
--uninstall <name> Uninstall specified kernel(2)
--uninstall-old Uninstall kernels older than the running kernel
--download <name> Download specified kernels(2)
--clean-cache Remove files from application cache
Options:
--include-unstable Include unstable and RC releases
--hide-unstable Hide unstable and RC releases
--debug Enable verbose debugging output
--yes Assume Yes for all prompts (non-interactive mode)
--user Override user
Notes:
(1) A version string taken from the output of --list
(2) One or more version strings (comma-separated) taken from the output of --list
For example, sudo mainline --install-latest --include-unstable
currently installs mainline kernel 5.17.0-rc7
.
I have installed 12 different kernels so far using UMKI, and I'm very happy with it.
This method is safe as long as you follow the steps above exactly, only to install libssl
. Don't trust it? Fair enough. Try it out for yourself in a safe environment like a virtual machine. Still don't trust it? Remove (or comment out) the file /etc/apt/sources.list.d/ubuntu-jammy.list
right after you have installed libssl
, and run sudo apt update
again.
One more thing to finish: if and when you decide to upgrade from impish
to jammy
, then you only need to delete (or comment) the 3 files /etc/apt/apt.conf.d/01ubuntu
, /etc/apt/sources.list.d/ubuntu-jammy.list
, /etc/apt/preferences.d/libssl3
before starting the upgrade. The first one is a must, the other two are some housekeeping because you no longer need them.
This answer is referenced in Ubuntu Mainline Kernel Installer GitHub issue 127 and forms the basis of their wiki page on installing libssl. You can also read about it on my blog.