Netboot initrd is not updated with signed modules

[Roland Kaufmann]

At the time of writing (21-oct-2018) the distribution directory at

http://ftp.ubuntu.com/ubuntu/dists/bionic-updates/main/signed/linux-amd64/

contains kernels for versions 4.15.0-33.36, 4.15.0-34.37 and 4.15.0-36.39, whereas

http://ftp.ubuntu.com/ubuntu/dists/bionic-updates/main/installer-amd64/current/images/netboot/ubuntu-installer/amd64/initrd.gz

contains modules for kernel version 4.15.0-29.

Thus, a signed UEFI netboot image cannot be constructed for the latest point release of Ubuntu Bionic, as the modules don't match the kernel.

I would expect that *either* the modules in the netboot image were updated when a new kernel version was built, *or* that the old kernels that at one time matched the netboot image were still available for download.

[Adam Conrad (adconrad)]

The old kernels that match the netboot image are always available, literally right next to the initrd you pointed to.

[Roland Kaufmann (rlndkfmn+launchpad)]

It used to be that the kernel in main/installer-amd64 was unsigned, which is why my scripts had to go look in main/signed instead. Apparently this changed at some point, which announcement I missed, and as you say the kernel that is stored together with the netboot image is now signed. I am happy, as a fair bunch of bespoke logic to figure out the correct kernel can now be shown the door, and the script becomes significantly simpler. But, I should have checked this beforehand with sbverify. Mea culpa indeed. Sorry for the hassle.