ubuntu-kernel-update

A fullscreen picker for the Ubuntu mainline kernel builds: it lists every published version, the newest first, verifies the ones you could move to, downloads the .deb set with progress bars, installs it with dpkg and signs the resulting image with your MOK key so Secure Boot still trusts it.

bun install
bun run update-kernel

The menu

One row per mainline directory, newest at the top. The color says what you may do with it:

color	meaning
white	installed; a ● marks the kernel you are running right now
grey	older than your newest installed kernel — not selectable
dim yellow	being checked right now
yellow	built, but with reservations (a package or the checksums are missing)
bright green	build succeeded, all four packages and their checksums are published
red	the build failed or has no image — not selectable

Every version newer than what you have installed is checked in the background, six at a time: the tool reads <version>/<arch>/status, the directory listing and CHECKSUMS, and confirms that linux-image-unsigned, linux-modules and both linux-headers packages are actually there. A broken build — v6.18.5 is one, amd64 died in drivers/gpu — shows up red with build failed (2).

Arrow keys move, Enter takes the highlighted kernel, Esc leaves. Esc also aborts a download in progress.

Self-tests

The mainline builders also compile tools/testing/selftests, and that step currently fails for every single amd64 build — selftests/user has no Makefile, so compileselftests returns 2 whatever the kernel does. The result is reported in the row (selftests ✗) but does not hold a kernel back. Pass --strict-self-tests to demote those kernels to yellow instead.

Installing

Enter replaces the menu with one progress bar per .deb. Files land in ~/.cache/ubuntu-kernel-update/<version>/, are checked against the published SHA-256 and are reused on the next run. Then, on the normal terminal:

sudo dpkg -i linux-headers-…_all.deb linux-headers-…_amd64.deb linux-modules-….deb linux-image-unsigned-….deb

If dpkg comes back non-zero the kernel is removed again straight away:

sudo dpkg --purge --force-depends linux-image-unsigned-… linux-modules-… linux-headers-…-generic linux-headers-…

The usual reason is a DKMS module — NVIDIA, most often — that will not build against a kernel this new. A kernel whose out-of-tree modules are missing is not worth keeping around, let alone signing, so it goes back out and nothing is written to /boot.

Signing

linux-image-unsigned-* installs an unsigned /boot/vmlinuz-<release>, which a machine with Secure Boot on will not boot. The tool signs it with the MOK pair in /var/lib/shim-signed/mok/:

sudo sbsign --key MOK-Kernel.priv --cert MOK-Kernel.pem --output /boot/vmlinuz-<release>.signed /boot/vmlinuz-<release>
sudo mv --force /boot/vmlinuz-<release>.signed /boot/vmlinuz-<release>
sudo update-grub

sbsign writes to a separate file first on purpose. It will accept the same path for input and output — it holds the whole image in memory before writing — but then a crash or a full disk between reading and writing leaves you with no kernel at all. Signing beside the image and renaming the result into place leaves a complete kernel at /boot/vmlinuz-<release> at every moment. The unsigned original is overwritten rather than kept as …-UNSIGNED: a leftover copy turns into another GRUB entry, one that Secure Boot refuses to boot.

sbsign also appends a signature rather than replacing one, so the image is verified with sbverify --cert MOK-Kernel.pem first and left alone when it already carries your signature. The freshly signed image is verified again, and update-grub then rebuilds the boot menu from what /boot now holds.

Layout

file	what lives there
src/index.ts	the menu, the check queue, the download phase, the install
src/mainline.ts	fetching and parsing the mainline index and per-build files
src/plan.ts	which rows exist, and what a build's files add up to
src/version.ts	version parsing, ordering and the 070203-style ABI names
src/system.ts	dpkg, uname and process plumbing
src/download.ts	streaming downloads, SHA-256, the cache
src/install.ts	dpkg -i, sbsign, sbverify, update-grub
src/ui.ts	row rendering and the palette