[Bug 1799070] Re: Netboot initrd is not updated with signed modules

[Roland Kaufmann]

It used to be that the kernel in main/installer-amd64 was unsigned,
which is why my scripts had to go look in main/signed instead.
Apparently this changed at some point, which announcement I missed, and
as you say the kernel that is stored together with the netboot image is
now signed. I am happy, as a fair bunch of bespoke logic to figure out
the correct kernel can now be shown the door, and the script becomes
significantly simpler. But, I should have checked this beforehand with
sbverify. Mea culpa indeed. Sorry for the hassle.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to debian-installer in Ubuntu.
https://bugs.launchpad.net/bugs/1799070

Title:
  Netboot initrd is not updated with signed modules

Status in debian-installer package in Ubuntu:
  Invalid

Bug description:
  At the time of writing (21-oct-2018) the distribution directory at

  http://ftp.ubuntu.com/ubuntu/dists/bionic-updates/main/signed/linux-
  amd64/

  contains kernels for versions 4.15.0-33.36, 4.15.0-34.37 and
  4.15.0-36.39, whereas

  http://ftp.ubuntu.com/ubuntu/dists/bionic-updates/main/installer-
  amd64/current/images/netboot/ubuntu-installer/amd64/initrd.gz

  contains modules for kernel version 4.15.0-29.

  Thus, a signed UEFI netboot image cannot be constructed for the latest
  point release of Ubuntu Bionic, as the modules don't match the kernel.

  I would expect that *either* the modules in the netboot image were
  updated when a new kernel version was built, *or* that the old kernels
  that at one time matched the netboot image were still available for
  download.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/debian-installer/+bug/1799070/+subscriptions