PE-8920: fix UKI/secureboot kernel-header install for rotated Ubuntu ABIs#633
Merged
Conversation
…ABIs
The provider-image build pinned an exact-version kernel-headers install
(linux-headers-<kernel>) derived from the base image's shipped modules.
Ubuntu's *-updates pocket only keeps the current HWE kernel ABI, so when
it rotates the ABI (e.g. 6.14.0-36 -> -37) the headers matching the base
image's kernel disappear from the live mirror while the base image still
ships the old modules. apt then fails with "no installation candidate"
(exit 100), breaking the kubeadm secureboot (UKI) ISO build.
Replace the two identical, hard-failing one-liners (kubeadm and
UPDATE_KERNEL paths) with a single generic helper,
scripts/install-kernel-headers.sh, that hardcodes no kernel version,
ABI, Ubuntu release, or snapshot date:
1. skip if matching headers already present
2. exact match from the live mirror (fast path)
3. exact match from snapshot.ubuntu.com (Ubuntu's immutable archive
keeps every historical package, so the ABI-matching headers are
recoverable after the live mirror rotates them out)
4. best-effort fallback (closest ABI, then linux-headers-generic) with
a loud warning but without failing the build, consistent with the
existing SUSE/RHEL branches
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
vipsharm
requested review from
Dr-N00B,
abhinavnagaraj,
nianyush and
santhoshdaivajna
June 18, 2026 16:06
abhinavnagaraj
approved these changes
Jun 18, 2026
Dr-N00B
pushed a commit
that referenced
this pull request
Jul 21, 2026
…ABIs (#633) The provider-image build pinned an exact-version kernel-headers install (linux-headers-<kernel>) derived from the base image's shipped modules. Ubuntu's *-updates pocket only keeps the current HWE kernel ABI, so when it rotates the ABI (e.g. 6.14.0-36 -> -37) the headers matching the base image's kernel disappear from the live mirror while the base image still ships the old modules. apt then fails with "no installation candidate" (exit 100), breaking the kubeadm secureboot (UKI) ISO build. Replace the two identical, hard-failing one-liners (kubeadm and UPDATE_KERNEL paths) with a single generic helper, scripts/install-kernel-headers.sh, that hardcodes no kernel version, ABI, Ubuntu release, or snapshot date: 1. skip if matching headers already present 2. exact match from the live mirror (fast path) 3. exact match from snapshot.ubuntu.com (Ubuntu's immutable archive keeps every historical package, so the ABI-matching headers are recoverable after the live mirror rotates them out) 4. best-effort fallback (closest ABI, then linux-headers-generic) with a loud warning but without failing the build, consistent with the existing SUSE/RHEL branches Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Dr-N00B
added a commit
that referenced
this pull request
Jul 21, 2026
* systemd extension changes * temp changes for hadron * hadron changes * feat: hadron support in Canvos * revert stylus versions * PE-8920: fix UKI/secureboot kernel-header install for rotated Ubuntu ABIs (#633) The provider-image build pinned an exact-version kernel-headers install (linux-headers-<kernel>) derived from the base image's shipped modules. Ubuntu's *-updates pocket only keeps the current HWE kernel ABI, so when it rotates the ABI (e.g. 6.14.0-36 -> -37) the headers matching the base image's kernel disappear from the live mirror while the base image still ships the old modules. apt then fails with "no installation candidate" (exit 100), breaking the kubeadm secureboot (UKI) ISO build. Replace the two identical, hard-failing one-liners (kubeadm and UPDATE_KERNEL paths) with a single generic helper, scripts/install-kernel-headers.sh, that hardcodes no kernel version, ABI, Ubuntu release, or snapshot date: 1. skip if matching headers already present 2. exact match from the live mirror (fast path) 3. exact match from snapshot.ubuntu.com (Ubuntu's immutable archive keeps every historical package, so the ABI-matching headers are recoverable after the live mirror rotates them out) 4. best-effort fallback (closest ABI, then linux-headers-generic) with a loud warning but without failing the build, consistent with the existing SUSE/RHEL branches Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: change supported systemd version to 254 * updating provider versions --------- Co-authored-by: Vipin Sharma <sharma.vipin@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The provider-image build pinned an exact-version kernel-headers install (linux-headers-) derived from the base image's shipped modules. Ubuntu's *-updates pocket only keeps the current HWE kernel ABI, so when it rotates the ABI (e.g. 6.14.0-36 -> -37) the headers matching the base image's kernel disappear from the live mirror while the base image still ships the old modules. apt then fails with "no installation candidate" (exit 100), breaking the kubeadm secureboot (UKI) ISO build.
Replace the two identical, hard-failing one-liners (kubeadm and UPDATE_KERNEL paths) with a single generic helper, scripts/install-kernel-headers.sh, that hardcodes no kernel version, ABI, Ubuntu release, or snapshot date: