Arch Linux

GeneArch

Member

Registered: 2013-07-28

Posts: 112

installing kernels with kernel-install

Following the recent RFC RFC 66 discussion,  I made a package to help me install my own kernel packages using systemd's kenel-install.
I found I really like this approach.

Perhaps its useful to other folks as well. I'm using it with systemd-boot only.
My sd-boot package is now available.

-  githhub source
-  AUR Package

mcloaked

Member

From: Yorkshire, UK

Registered: 2012-02-02

Posts: 1,360

Re: installing kernels with kernel-install

Thank you for doing all the work to get this package released and available. It works superbly well, is easy to install and get going, and it does an excellent job of managing not just new kernels (in my case custom kernels at present, but can be set to manage new Arch kernels also. With systemd-boot it makes kernel updates worry-free, but it is also nice that it manages memtest86 and edk2-shell when they update too.

Last edited by mcloaked (2026-04-22 12:04:45)

---

Mike C

GeneArch

Member

Registered: 2013-07-28

Posts: 112

Re: installing kernels with kernel-install

FYI - i pushed out a new version.  The new version uses compiled binaries in place of bash.
I left the bash code for historical interest.

I have this running on  multiple machines - all working well (for me).
Do let me know any of any issues or thoughts

g

mcloaked

Member

From: Yorkshire, UK

Registered: 2012-02-02

Posts: 1,360

Re: installing kernels with kernel-install

Thank you for this package - I have it running on multiple machines now and the new c-code binary version is significantly faster than the previous bash script version. It handles kernel updates as well as memtest86 updates very efficiently.

---

Mike C

GeneArch

Member

Registered: 2013-07-28

Posts: 112

Re: installing kernels with kernel-install

Quick update as of version 5.4.0

sd-boot has been running here on about a dozen machines with various configurations of mount points for ESP and XBOOTLDR.
All are working well for both efi tools and kernels  Some machines install only one kernel  while others install several. 

Thanks to those who have been testing and those who found a couple bugs that have been fixed.

(a) missing checkdepends item in PKGBUILD
(b) failing to create /var/lib/sd-boot on first run.

Thank you for the reports - the feedback is much appreciateed.

Last edited by GeneArch (2026-06-03 11:57:31)

GeneArch

Member

Registered: 2013-07-28

Posts: 112

Re: installing kernels with kernel-install

Version 6.1.0 was released yesterday. 

Much of the recent work has focused on code review and hardening. Making sure the code handles exceptions appropriately. For example,  if out of memory prevents additional mem allocation, does the code handle this sensibly. 

In case it might be of interest to others, here are some build options we're using (They're all in the meson.build file)

* -fanalyzer :                                    # confirmed there are no warnings at all when sd-boot is compiled with this turned on

Compiler:
* -fstack-protector-strong,            # Protect function calls with stack canaries
* -fstack-clash-protection,             # Prevents stack-clash exploits
* -ftrivial-auto-var-init=zero,         # Eliminate uninitialized stack memory leaks
* -fzero-call-used-regs=used-gpr,     # Wipe general registers before returning
* -mshstk,                                         # Intel Shadow Stack protection
* -fcf-protection,                              # Control-flow enforcement
* -Wshadow,                                     # Warn if local variable/decl shadows another
* -Wconversion,                               # Warn about type conversions that may alter value
* -Wformat=2,                                  # Warn about format/args mismatch printf, scanf etc
* -Werror=format-security,            # Also warn about insecure printf format strings
* -fvisibility=hidden                         # Only explicitly exported symbols are put into the shared lib symbol table
* -Wp,-D_FORTIFY_SOURCE=3       # buffer-overflow protection

Loader:
* -Wl,--as-needed,                          # Limit shared to 'as needed'
* -Wl,-z,relro,                                   # Mark relocation tables read-only
* -Wl,-z,now,                                    # Force immediate binding (Full RELRO)
* -Wl,-z,noexecstack,                     # Strictly enforce non-executable stack
* -Wl,-z,pack-relative-relocs,        # Optimize layout with DT_RELR packing
* -Wl,-z,defs,                                   # Catch unresolved symbols at link time, not at runtime

Some of what we're using are also in Arch /etc/makepkg.conf. Side note.  some of the arch ones are legacy and probably should be reconsidered
(For example -Wl,-O1 and -Wl,--sort-common )

I found Claude quite helpful in this review.