kernel-installer

Automatic install script for The Linux kernel

Inspired by LinuxKernelBuild

Script to install the latest [stable/mainline/longterm] kernel from source on Debian-based distributions and the Fedora/RHEL family.

Dependencies

Missing packages are installed when running the script.

# Debian/Ubuntu
wget curl git rsync fakeroot cpio kmod build-essential libncurses-dev xz-utils libssl-dev bc lz4 libelf-dev flex bison gawk debhelper dpkg-dev procps apt-transport-https libdw-dev python3
# Fedora/RHEL
wget curl git rsync ca-certificates procps-ng findutils diffutils hostname bc binutils bison dwarves elfutils-devel elfutils-libelf-devel flex gawk gcc make openssl openssl-devel perl python3 ncurses-devel cpio kmod xz lz4 rpm-build dracut grubby

gnupg is also installed on demand when tarball verification needs gpg/gpgv, and kexec-tools when --kexec is used.

On Debian-based systems lsb-release is required; the script offers to install it if it is missing.

Notes

• This script reverts bug #1086172 Enable more ZRAM compression options by default (kernel 6.12 and newer)
  • Sets default compression to zstd (change it with --default-compression), and enables support for the rest of the algorithms
  • Options are:

lz4 compression support (ZRAM_BACKEND_LZ4) [Y/n/?] y
lz4hc compression support (ZRAM_BACKEND_LZ4HC) [Y/n/?] y
zstd compression support (ZRAM_BACKEND_ZSTD) [Y/n/?] y
deflate compression support (ZRAM_BACKEND_DEFLATE) [Y/n/?] y
842 compression support (ZRAM_BACKEND_842) [Y/n/?] y
lzo and lzo-rle compression support (ZRAM_BACKEND_LZO) [Y/n/?] y
Default zram compressor
  1. lzo-rle (ZRAM_DEF_COMP_LZORLE)
  2. lzo (ZRAM_DEF_COMP_LZO)
  3. lz4 (ZRAM_DEF_COMP_LZ4) (NEW)
  4. lz4hc (ZRAM_DEF_COMP_LZ4HC) (NEW)
> 5. zstd (ZRAM_DEF_COMP_ZSTD)
  6. deflate (ZRAM_DEF_COMP_DEFLATE) (NEW)
  7. 842 (ZRAM_DEF_COMP_842) (NEW)

Download the script

Download, review, then run as root:

curl -fsSLO https://github.com/tmiland/kernel-installer/raw/main/kernel_installer.sh
sudo bash kernel_installer.sh            # add options as needed, e.g. --stable

Quick install with default options:

With Curl:

curl -fsSL https://github.com/tmiland/kernel-installer/raw/main/kernel_installer.sh | sudo bash

With Wget:

wget -qO - https://github.com/tmiland/kernel-installer/raw/main/kernel_installer.sh | sudo bash

With options (e.g. --stable):

curl -fsSL https://github.com/tmiland/kernel-installer/raw/main/kernel_installer.sh | sudo bash -s -- --stable

The installer must run as root: pipe into sudo bash (as above) or run sudo bash kernel_installer.sh. A run as a regular user exits immediately with a "must be run as root" error instead of prompting or installing anything.

On systems without sudo, become root first. If the root password is not set:

sudo passwd root

Then:

su root

When run outside a git checkout, a pinned and checksum-verified copy of the function library (src/slib.sh) is fetched automatically.

For latest release

curl -s https://api.github.com/repos/tmiland/kernel-installer/releases/latest \
| grep "browser_download_url.*sh" \
| cut -d : -f 2,3 \
| tr -d \" \
| wget -qi -

For main branch

wget https://github.com/tmiland/kernel-installer/raw/main/kernel_installer.sh

Set execute permission:

chmod +x kernel_installer.sh

For usage, run:

./kernel_installer.sh -h

Help output

Usage:  kernel_installer.sh [options]
  If called without arguments, installs stable kernel 7.2.11 using /opt/linux-kernel

--help                 |-h   display this help and exit
--kernel               |-k   kernel version of choice
--stable               |-s   stable kernel version 7.2.11
--mainline             |-m   mainline kernel version 7.3-rc7
--longterm             |-l   longterm kernel version 6.18.57
--dir                  |-d   install directory
--kexec                |-x   load new kernel without reboot
--config               |-c   set configuration target
--custom-config        |-cc  set custom configuration directive, can be used multiple times
--verbose              |-v   increase verbosity
--get-verified-tarball |-gvt cryptographically verify kernel tarball (default)
--nproc                |-n   set the number of processing units to use
--enable-debug-info    |-edi enable debug info
--lowlatency           |-low convert generic config to lowlatency
--list-installed       |-li  list installed kernels
--default-compression  |-dc  select default compression algorithm
--changelog            |-cl  view changelog for kernel version
--update               |-upd check for script update
--uninstall            |-u   uninstall kernel (use with -k option)

The versions shown are looked up live from kernel.org each time the script runs.

To use opt --kernel:

./kernel_installer.sh --kernel 5.17.8

Else use:

./kernel_installer.sh --stable, --mainline or --longterm separately

To use --dir opt:

./kernel_installer.sh --dir /path/to/dir

The source is downloaded and built in a linux-kernel subdirectory (here /path/to/dir/linux-kernel, default /opt/linux-kernel), which is removed after a successful install. The script refuses to use a directory that is not empty unless it created it in a previous run. To load kernel without reboot:

./kernel_installer.sh --kexec

To use --config:

./kernel_installer.sh --config menuconfig

default is olddefconfig

Configuration targets

As listed by make help in the kernel source (7.3); older kernels may lack some of them. With the default olddefconfig, the kernel build picks up the running kernel's configuration (e.g. /boot/config-$(uname -r)) as the base when one is available.

config          - Update current config utilising a line-oriented program
nconfig         - Update current config utilising a ncurses menu based program
menuconfig      - Update current config utilising a menu based program
xconfig         - Update current config utilising a Qt based front-end
gconfig         - Update current config utilising a GTK+ based front-end
oldconfig       - Update current config utilising a provided .config as base
localmodconfig  - Update current config disabling modules not loaded
localyesconfig  - Update current config converting local mods to core
defconfig       - New config with default from ARCH supplied defconfig
savedefconfig   - Save current config as ./defconfig (minimal config)
allnoconfig     - New config where all options are answered with no
allyesconfig    - New config where all options are accepted with yes
allmodconfig    - New config selecting modules when possible
alldefconfig    - New config with all symbols set to default
randconfig      - New config with random answer to all options
yes2modconfig   - Change answers from yes to mod if possible
mod2yesconfig   - Change answers from mod to yes if possible
mod2noconfig    - Change answers from mod to no if possible
listnewconfig   - List new options
helpnewconfig   - List new options and help text
olddefconfig    - Same as oldconfig but sets new symbols to their default value without prompting
tinyconfig      - Configure the tiniest possible kernel

Custom configuration directives

In order to enable specific kernel configs, one can use --custom-config like the following example:

./kernel_installer.sh --custom-config "scripts/config --set-val CONFIG_DM_VDO m"

The directive must be a scripts/config command; raw CONFIG_* assignments (e.g. CONFIG_DM_VDO=y) are not accepted.

Note that --custom-config can be used multiple times like:

./kernel_installer.sh --custom-config "scripts/config --set-val CONFIG_DM_VDO m" --custom-config "scripts/config --set-val CONFIG_KERNEL_ZSTD y"

Tarball verification

Stable, longterm and --kernel tarballs are cryptographically verified by default (--get-verified-tarball is accepted but no longer needed). The sha256sums.asc file is checked against the kernel.org autosigner key, and the tarball against the Linus Torvalds / Greg Kroah-Hartman signatures, fetched via WKD.

• Linux kernel releases PGP signatures
• Source script get-verified-tarball
• Installs gnupg if gpg/gpgv are not available
• Keys are kept in $GNUPGHOME (default ~/.gnupg); run with GNUPGHOME= (empty) to use a throwaway keyring instead
• Mainline snapshots from git.kernel.org are not signed and are not verified

To skip verification:

GET_VERIFIED_TARBALL=0 ./kernel_installer.sh

Used together:

./kernel_installer.sh --stable --config menuconfig --kexec --dir /path/to/dir

Watch install log:

tail -f /var/log/kernel_installer.log

• installation log in /var/log/kernel_installer.log, started fresh on every install; the previous install's log is kept as /var/log/kernel_installer.log.1, and --list-installed / --uninstall leave both alone
• set LOGFILE to log somewhere else, e.g. LOGFILE=/root/kernel-build.log ./kernel_installer.sh
• when the output is not a terminal (a pipe, a file, CI), the spinner and colors are turned off
• ./src/slib.sh function script is sourced remotely if not found locally
  • This script is a combination of functions for spinners, colors and logging
    • Source: Spinner: swelljoe/spinner
    • Source: Run ok: swelljoe/run_ok
    • Source: Slog: swelljoe/slog
    • Source: Slib: virtualmin/slib

Full write-up on the blog: https://tmiland.com/kernel-installer/

Uninstall kernel

To uninstall previously installed kernel:

./kernel_installer.sh --uninstall --kernel 5.17.7

• The linux-image-<version> and linux-headers-<version> packages (Fedora/RHEL: kernel-<version> and kernel-devel-<version>) are removed
• On Debian-based systems apt asks for confirmation; on Fedora/RHEL they are removed without a prompt

Testing

Tested and working on: Debian 12/13, Ubuntu 22.04/24.04 and Fedora 44 (see test-install.yml)

• Each CI run uploads the installer log of every distro as a workflow artifact (kernel-installer-logs-<distro>) on the Actions page

Maintenance

Updating the vendored slib

src/slib.sh is a curated subset of virtualmin/slib (tracked via tmiland/slib). Updates are two-phase, and CI enforces the second one on main:

# Phase 1 - vendor the new file (defaults to tmiland/slib@master)
scripts/update-slib.sh
git add src/slib.sh && git commit -m 'chore: update vendored slib.sh' && git push

# Phase 2 - pin the pushed commit (updates SLIB_REV / SLIB_SHA256)
scripts/update-slib.sh --finalize <commit>
git add kernel_installer.sh && git commit -m 'chore: bump slib pin' && git push

• Use --source virtualmin/slib to pull upstream directly. Sync your fork first with gh repo sync tmiland/slib -b master.
• Sources contain extra Virtualmin-only helpers and are not lint-clean as-is (e.g. #!/bin/sh shebang); the vendored copy is a trimmed, lint-clean subset. Review git diff src/slib.sh and the helper's shellcheck output before committing.
• Until phase 2 lands on main, the slib pin CI job fails (that is the reminder).

Feature request and bug reports

• Bug report
• Feature request

Donations

• PayPal me
• [BTC] : 33mjmoPxqfXnWNsvy8gvMZrrcG3gEa3YDM

Disclaimer

*** Use at own risk ***

License

MIT License