10

Looking at this kernel-ppa, I noticed that the kernel images for amd64 since 4.16.4 are all unsigned.

Is there a reason why Ubuntu stopped publishing signed kernel images?

Improve this question
3
  • Can't confirm but thought someone said you have to pay Microsoft $100 for signing and it involves a lot of work.
    – WinEunuuchs2Unix
    May 22, 2018 at 23:15
  • 1
    This post might be of interest to you: askubuntu.com/questions/1036216/…
    – WinEunuuchs2Unix
    May 23, 2018 at 4:44
  • 1
    I don't think they published signed kernel images on every release. A Kernel maintainer commented on my thread linked above. There used to be a linux-signed-image package separate from linux-image.
    – guyfleeman
    May 23, 2018 at 19:01

2 Answers 2

Reset to default
5

I don't think mainline kernel images have been signed previously either. Latest releases just changed the package names.

To verify I checked images against Canonical certificate: https://github.com/slytomcat/UEFI-Boot/blob/master/keys/canonical-uefi-ca.crt

❯ sudo sbverify --cert canonical-uefi-ca.crt /boot/vmlinuz-4.16.1-041601-generic
warning: file-aligned section .text extends beyond end of file
warning: checksum areas are greater than image size. Invalid section table?
No signature table present
Unable to read signature data from /boot/vmlinuz-4.16.1-041601-generic
Signature verification failed

❯ sudo sbverify --cert canonical-uefi-ca.crt /boot/vmlinuz-4.15.0-23-generic
Signature verification OK
Improve this answer
3

Yes! all the recent Ubuntu maintenance kernels after K4.16.3> are all unsigned, the frustration I have is that there is NO Explanation given for this!.

Heads Up NOTE: Do NOT even try to install these current "unsigned linux-images" not recommended as doing so trashed my system, my system borked when attempting to install said kernel.

IMO wait until the next major kernel release which is K4.17 when I am hoping the linux-images will contain the required signatures.

**Also no notes or explanation for users who don’t have, or use UEFI secure boot based systems i.e. old fashioned Bios. I still have no idea why these kernels don’t work or install. I have read that these signatures are designed to prevent malware invasions. Just would be helpful to have some documentation.

Improve this answer
3
  • To fix broken 4.16.3 see this Q&A: askubuntu.com/questions/1030043/…
    – WinEunuuchs2Unix
    May 23, 2018 at 10:51
  • That's interesting? Did you also install modules? I've been pulling mainline form 4.16-rc series and the 4.17-rc series and have had no issues with installation or stability.
    – guyfleeman
    May 23, 2018 at 18:58
  • I can also install the unsigned modules, but unfortunately for some reason my system wasn't very stable with it so reverted back to 4.16.3. Would like to figure out why this happened though. Even the 4.17 rc series are unsigned.
    – WillZ
    May 23, 2018 at 20:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .