6

I'm using Ubuntu 21.10 impish indri.

For some specific hardware support, I'm advised to upgrade to kernel 5.16 (mainline). I tried manually installing the .deb files and installing them using dpkg -i. However, I'm getting dependency issues:

The following packages have unmet dependencies:
 linux-headers-5.16.0-051600-generic : Depends: libssl3 (>= 3.0.0~~alpha1) but it is not installable

I ran sudo apt -f install and it suggested removing the 5.16 kernel packages. So, I removed them for now.

How can I install kernel 5.16 on Ubuntu 21.10 impish indri? I've all the repositories enabled with no additional PPAs.

0

2 Answers 2

9

TL;DR: You can manually install the package from 22.04 repositories.

Ubuntu mainline kernel 5.15.7+ and 5.16 bumps the requirement from libssl1.1 (>= 1.1.0) to libssl3 (>= 3.0.0~~alpha1). However, package libssl3 is not available for Ubuntu 21.10 impish indri.. It's only available for Ubuntu 22.04 jammy jellyfish which is not yet released.

libssl3 further depends on libc6>=2.34 and debconf which are available in 21.10 repositories.

So, you can manually install libssl3 from Jammy Jellyfish repositories. You'll not have any problems in doing that unless you've done something really strange with your system.

To install libssl3 on Ubuntu 21.10, run the following commands:

sudo apt update
sudo apt install libc6 debconf
wget http://mirrors.kernel.org/ubuntu/pool/main/o/openssl/libssl3_3.0.1-0ubuntu1_amd64.deb
sudo dpkg -i libssl3_3.0.1-0ubuntu1_amd64.deb
sudo apt -f install

Now, you can install the kernel 5.16 on Ubuntu 21.10 without any issues.

Keep in mind that mainline kernels have not been tested with their release of Ubuntu. That means YOU are doing the testing. You may encounter the unexpected. Ubuntu prefers stable LTS kernels over unstable mainline kernels.

You can use the following commands to install the unsigned kernel 5.16 (don't worry about unsigned unless you are using secure boot):

wget -c https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.16/amd64/linux-headers-5.16.0-051600_5.16.0-051600.202201092355_all.deb
wget -c https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.16/amd64/linux-headers-5.16.0-051600-generic_5.16.0-051600.202201092355_amd64.deb
wget -c https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.16/amd64/linux-image-unsigned-5.16.0-051600-generic_5.16.0-051600.202201092355_amd64.deb
wget -c https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.16/amd64/linux-modules-5.16.0-051600-generic_5.16.0-051600.202201092355_amd64.deb
sudo dpkg -i linux*.deb
sudo apt -f install
2
  • 7
    Folks who discover this method should keep in mind that PPA kernels have not been tested with their release of Ubuntu. That means YOU are doing the testing. You may encounter the unexpected. Or it might work just fine. We all hope for the best, but when you wander the untracked wilderness, you should be prepared to encounter a bear.
    – user535733
    Jan 27 at 14:11
  • It's true, but for a time I used Arch Linux which uses mainline kernels very shortly after release and I never had any issues. Maybe I was lucky.
    – To Do
    Jan 27 at 14:23
5

As an alternative to manually installing libssl3, you can also pin that package. Pinning is described in the Community Help Wiki.

You need to edit 3 files (create them with sudo touch filename if they don't yet exist):


/etc/apt/apt.conf.d/01ubuntu

APT::Default-Release "impish";

This tells Ubuntu that the default release to install packages from, is impish.


/etc/apt/sources.list.d/ubuntu-jammy.list

deb http://mirror.example.com/ubuntu/ jammy main

This adds the jammy (22.04) repository. You are not actually using it, because of the value of APT::Default-Release. I repeat, and I can't stress this enough: Ubuntu will never ever install any package from this (or any other) jammy repository, unless:

  • you explicitly tell apt to install a specific version that only exists in the jammy repository (this supposes that you know what you are doing!)
  • a (specific version of a) package is pulled in as a dependency
  • you create an exception to the general rule using pinning - see next file.

/etc/apt/preferences.d/libssl3

Package: libssl3
Pin: release n=jammy
Pin-Priority: 900

This tells Ubuntu that you give a higher priority to the package libssl3 coming from the jammy repository, and only that package. So for all packages, impish is the default, and for libssl3 there is an exception.


Now run sudo apt update. Don't run it before you have edited all 3 files!

To see which packages are going to be installed, run apt-cache policy:

$ apt-cache policy libssl3
libssl3:
  Installed: (none)
  Candidate: 3.0.1-0ubuntu1
  Version table:
     3.0.1-0ubuntu1 900
        500 http://mirror.unix-solutions.be/ubuntu jammy/main amd64 Packages
        100 /var/lib/dpkg/status

As you can see, there is only one installation candidate for libssl3, from the jammy repository.

$ apt-cache policy linux-image-generic
linux-image-generic:
  Installed: 5.13.0.35.44
  Candidate: 5.13.0.35.44
  Version table:
     5.15.0.22.24 500
        500 http://mirror.unix-solutions.be/ubuntu jammy/main amd64 Packages
 *** 5.13.0.35.44 990
        990 http://mirror.unix-solutions.be/ubuntu impish-updates/main amd64 Packages
        990 http://mirror.unix-solutions.be/ubuntu impish-security/main amd64 Packages
        100 /var/lib/dpkg/status
     5.13.0.19.30 990
        990 http://mirror.unix-solutions.be/ubuntu impish/main amd64 Packages

The package linux-image-generic is available:

  • at version 5.15.0.22.24, in jammy/main, with priority 500
  • at version 5.13.0.35.44, in impish-updates/main and impish-security/main, with priority 990
  • at version 5.13.0.19.30 (the original version from the USB or DVD installer at release), in impish/main, with priority 990.

The *** indicates which version will be installed.


In my particular use case, I had to install many kernels: 5.13, 5.14, 5.15, 5.16, 5.17. I currently have 35 kernels installed:

$ ls -1 /boot/initrd* | wc --lines
35

To demonstrate that libssl is automatically installed as a dependency when needed, I install the Ubuntu kernel 5.15.0-22-generic, which is also from Jammy:

$ sudo apt install linux-{image,headers,modules,modules-extra}-5.15.0-22-generic
Reading package lists... Done
Building dependency tree... Donesudo apt install linux-{image,headers,modules,modules-extra}-5.15.0-22-generic
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  libssl3 linux-headers-5.15.0-22
Suggested packages:
  fdutils linux-doc | linux-source-5.15.0
The following NEW packages will be installed:
  libssl3 linux-headers-5.15.0-22 linux-headers-5.15.0-22-generic linux-image-5.15.0-22-generic linux-modules-5.15.0-22-generic linux-modules-extra-5.15.0-22-generic
0 upgraded, 6 newly installed, 0 to remove and 0 not upgraded.
Need to get 103 MB of archives.
After this operation, 565 MB of additional disk space will be used.
Do you want to continue? [Y/n]
Reading state information... Done
The following additional packages will be installed:
  libssl3 linux-headers-5.15.0-22
Suggested packages:
  fdutils linux-doc | linux-source-5.15.0
The following NEW packages will be installed:
  libssl3 linux-headers-5.15.0-22 linux-headers-5.15.0-22-generic linux-image-5.15.0-22-generic linux-modules-5.15.0-22-generic linux-modules-extra-5.15.0-22-generic
0 upgraded, 6 newly installed, 0 to remove and 0 not upgraded.
Need to get 103 MB of archives.
After this operation, 565 MB of additional disk space will be used.
Do you want to continue? [Y/n]

As you can see, the package libssl3 is automatically pulled in as a dependency.

If one does not need a 5.15 kernel, then one simply installs libssl3 directly:

$ sudo apt install --yes libssl3

With all of this, one still hasn't installed a mainline kernel, and I strongly agree with all warnings regarding permanently adding a kernel PPA. As an alternative, you can use the Ubuntu Mainline Kernel Installer (UMKI), a graphical tool to install the latest mainline kernels. It fetches the list from the mainline kernel PPA, without actually needing to add the PPA to your sources. You can install the .deb package from the GitHub releases pages, or do this:

sudo add-apt-repository ppa:cappelikan/ppa
sudo apt update
sudo apt install mainline

If you don't like (or can't use) a GUI, it also has a CLI:

$ mainline
mainline 1.0.15
Distribution: Ubuntu 21.10
Architecture: amd64
Running kernel: 5.13.0-22-generic

mainline 1.0.15 - Ubuntu Mainline Kernel Installer

Syntax: mainline <command> [options]

Commands:

  --check             Check for kernel updates
  --notify            Check for kernel updates and notify current user
  --list              List all available mainline kernels
  --list-installed    List installed kernels
  --install-latest    Install latest mainline kernel
  --install-point     Install latest point update for current series
  --install <name>    Install specified mainline kernel(1)
  --uninstall <name>  Uninstall specified kernel(2)
  --uninstall-old     Uninstall kernels older than the running kernel
  --download <name>   Download specified kernels(2)
  --clean-cache       Remove files from application cache

Options:

  --include-unstable  Include unstable and RC releases
  --hide-unstable     Hide unstable and RC releases
  --debug           Enable verbose debugging output
  --yes             Assume Yes for all prompts (non-interactive mode)
  --user            Override user

Notes:
(1) A version string taken from the output of --list
(2) One or more version strings (comma-separated) taken from the output of --list

For example, sudo mainline --install-latest --include-unstable currently installs mainline kernel 5.17.0-rc7.


I have installed 12 different kernels so far using UMKI, and I'm very happy with it.

This method is safe as long as you follow the steps above exactly, only to install libssl. Don't trust it? Fair enough. Try it out for yourself in a safe environment like a virtual machine. Still don't trust it? Remove (or comment out) the file /etc/apt/sources.list.d/ubuntu-jammy.list right after you have installed libssl, and run sudo apt update again.


One more thing to finish: if and when you decide to upgrade from impish to jammy, then you only need to delete (or comment) the 3 files /etc/apt/apt.conf.d/01ubuntu, /etc/apt/sources.list.d/ubuntu-jammy.list, /etc/apt/preferences.d/libssl3 before starting the upgrade. The first one is a must, the other two are some housekeeping because you no longer need them.

10
  • Hi @Someone! 1) by using Apt pinning, you don't actually use jammy repositories. Please refer to the documentation about apt pinning. 2) fair enough. In my specific situation I had to install 5.14, 5.15, 5.16 and 5.17 kernels, both from Ubuntu as well as from mainline. YMMV. 3) It does not. That part of your comment is factually incorrect. Please try it out for yourself in the safe confines of a virtual machine. 4) That is your personal opinion. I would like to refer you to the Ubuntu Code of Conduct: ubuntu.com/community/code-of-conduct Mar 9 at 20:04
  • I am willing to take down (or edit and improve) my answer if you can provide me with a verifiable, repeatable scenario, based on the steps described in my answer, that demonstrates undesired behavior, like installing more packages than the configured one. I have spent a lot of time verifying all steps to be safe when I wrote my answer. I would expect any criticisms on my answer to have the same amount of care and effort. I don't want "he said, she said" discussions, please provide more context. Mar 9 at 20:17
  • Adding that kind of comment works more constructive than "punitive" downvotes. Yes the jammy repository list file exist, and it is completely ignored for the purpose of installing software, with the exception of the pinned package. As for the 5.15 kernel: that was an example to demonstrate that the package libssl3 is automatically pulled in as a dependency. If you want to run sudo apt install libssl3 directly then you can do that. Mar 10 at 10:21
  • To elaborate on APT::Default-Release: should you add another sources list, for example a PPA, or some third party repository, and that repository is not an impish repository, and a package exists both in the main repository and the third party repository, then the version from the main repository will be installed (because that has priority 990), even if the third party version is newer. Only if the package does not exist in the main (impish) repository, will it be installed from the third party repository. Mar 10 at 10:43
  • 1
    Thanks for clarifying. I admit I should have given the whole information at once. I apologise. I have upvoted and accepted your answer as it seems more reasonable as compared to my answer.
    – Someone
    Mar 10 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.