diff -Nru linux-restricted-signatures-intel-iotg-5.15-5.15.0/debian/changelog linux-restricted-signatures-intel-iotg-5.15-5.15.0/debian/changelog
--- linux-restricted-signatures-intel-iotg-5.15-5.15.0/debian/changelog	2023-06-11 15:17:48.000000000 +0000
+++ linux-restricted-signatures-intel-iotg-5.15-5.15.0/debian/changelog	2023-07-04 20:06:23.000000000 +0000
@@ -1,3 +1,20 @@
+linux-restricted-signatures-intel-iotg-5.15 (5.15.0-1033.38~20.04.1+2) focal; urgency=medium
+
+  * standardise ancillary naming to simplify backporting (LP: #2019299)
+    - [Packaging] convert to v7.6.1 autogen form
+
+ -- Andy Whitcroft <apw@canonical.com>  Tue, 04 Jul 2023 21:06:23 +0100
+
+linux-restricted-signatures-intel-iotg-5.15 (5.15.0-1033.38~20.04.1+1) focal; urgency=medium
+
+  * standardise ancillary naming to simplify backporting (LP: #2019299)
+    - [Packaging] convert to v7.6 autogen form
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (adhoc/2023.05.15)
+
+ -- Andy Whitcroft <apw@canonical.com>  Tue, 04 Jul 2023 17:36:29 +0100
+
 linux-restricted-signatures-intel-iotg-5.15 (5.15.0-1033.38~20.04.1) focal; urgency=medium
 
   * Master version: 5.15.0-1033.38~20.04.1
@@ -22,3 +39,12 @@
 
  -- Jian Hui Lee <jianhui.lee@canonical.com>  Thu, 25 May 2023 13:35:49 +0800
 
+linux-restricted-signatures-intel-iotg-5.15 (5.15.0-1030.35~20.04.1) focal; urgency=medium
+
+  * Master version: 5.15.0-1030.35~20.04.1
+
+  * Miscellaneous Ubuntu changes
+    - debian/tracking-bug -- update from master
+
+ -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Tue, 09 May 2023 17:39:23 -0300
+
diff -Nru linux-restricted-signatures-intel-iotg-5.15-5.15.0/debian/control linux-restricted-signatures-intel-iotg-5.15-5.15.0/debian/control
--- linux-restricted-signatures-intel-iotg-5.15-5.15.0/debian/control	2023-06-11 15:17:48.000000000 +0000
+++ linux-restricted-signatures-intel-iotg-5.15-5.15.0/debian/control	2023-07-04 20:06:23.000000000 +0000
@@ -9,9 +9,10 @@
  curl,
  dkms,
  gawk,
- linux-restricted-generate-intel-iotg-5.15 (= 5.15.0-1033.38~20.04.1),
- linux-objects-nvidia-525-open-5.15.0-1033-intel-iotg (>= 5.15.0-1033.38~20.04.1) [amd64 ],
- linux-objects-nvidia-530-open-5.15.0-1033-intel-iotg (>= 5.15.0-1033.38~20.04.1) [amd64 ],
+ linux-restricted-generate-intel-iotg-5.15 (= 5.15.0-1033.38~20.04.1+2),
+ linux-objects-nvidia-525-open-5.15.0-1033-intel-iotg (>= 5.15.0-1033.38~20.04.1+2) [amd64 ],
+ linux-objects-nvidia-535-open-5.15.0-1033-intel-iotg (>= 5.15.0-1033.38~20.04.1+2) [amd64 ],
+ linux-objects-nvidia-535-server-open-5.15.0-1033-intel-iotg (>= 5.15.0-1033.38~20.04.1+2) [amd64 ],
  lsb-release,
  python3,
  python3-apt,
@@ -51,22 +52,42 @@
  which will ensure that upgrades work correctly, and that supporting packages are
  also installed.
 
-Package: linux-modules-nvidia-530-open-5.15.0-1033-intel-iotg
+Package: linux-modules-nvidia-535-open-5.15.0-1033-intel-iotg
 Build-Profiles: <!stage1>
 Architecture: amd64 
 Section: kernel
 Priority: optional
-Built-Using: ${dkms:nvidia-530-open-modules}
+Built-Using: ${dkms:nvidia-535-open-modules}
 Depends:
  ${misc:Depends},
  ${shlibs:Depends},
  linux-image-5.15.0-1033-intel-iotg | linux-image-unsigned-5.15.0-1033-intel-iotg,
- ${nvk:nvidia-530-open},
+ ${nvk:nvidia-535-open},
 Description: Linux kernel nvidia modules for version 5.15.0-1033
  This package pulls together the Linux kernel nvidia modules for
  version 5.15.0-1033 with the appropriate signatures.
  .
  You likely do not want to install this package directly. Instead, install the
- one of the linux-modules-nvidia-530-open-intel-iotg* meta-packages,
+ one of the linux-modules-nvidia-535-open-intel-iotg* meta-packages,
+ which will ensure that upgrades work correctly, and that supporting packages are
+ also installed.
+
+Package: linux-modules-nvidia-535-server-open-5.15.0-1033-intel-iotg
+Build-Profiles: <!stage1>
+Architecture: amd64 
+Section: kernel
+Priority: optional
+Built-Using: ${dkms:nvidia-535-server-open-modules}
+Depends:
+ ${misc:Depends},
+ ${shlibs:Depends},
+ linux-image-5.15.0-1033-intel-iotg | linux-image-unsigned-5.15.0-1033-intel-iotg,
+ ${nvk:nvidia-535-server-open},
+Description: Linux kernel nvidia modules for version 5.15.0-1033
+ This package pulls together the Linux kernel nvidia modules for
+ version 5.15.0-1033 with the appropriate signatures.
+ .
+ You likely do not want to install this package directly. Instead, install the
+ one of the linux-modules-nvidia-535-server-open-intel-iotg* meta-packages,
  which will ensure that upgrades work correctly, and that supporting packages are
  also installed.
diff -Nru linux-restricted-signatures-intel-iotg-5.15-5.15.0/debian/dkms-versions linux-restricted-signatures-intel-iotg-5.15-5.15.0/debian/dkms-versions
--- linux-restricted-signatures-intel-iotg-5.15-5.15.0/debian/dkms-versions	2023-06-11 15:17:48.000000000 +0000
+++ linux-restricted-signatures-intel-iotg-5.15-5.15.0/debian/dkms-versions	2023-07-04 20:06:23.000000000 +0000
@@ -1,13 +1,12 @@
 nvidia-graphics-drivers-390 390.157-0ubuntu0.20.04.1 arch=amd64
-nvidia-graphics-drivers-470 470.182.03-0ubuntu0.20.04.1 arch=amd64 transition=nvidia-graphics-drivers-465 transition=nvidia-graphics-drivers-460 transition=nvidia-graphics-drivers-455 transition=nvidia-graphics-drivers-450 transition=nvidia-graphics-drivers-440 transition=nvidia-graphics-drivers-435
-nvidia-graphics-drivers-510 510.108.03-0ubuntu0.20.04.1 arch=amd64 transition=nvidia-graphics-drivers-495
-nvidia-graphics-drivers-515 515.105.01-0ubuntu0.20.04.1 arch=amd64
-nvidia-graphics-drivers-525 525.116.04-0ubuntu0.20.04.1 arch=amd64 transition=nvidia-graphics-drivers-520
-nvidia-graphics-drivers-530 530.41.03-0ubuntu0.20.04.2 arch=amd64
-nvidia-graphics-drivers-525 525.116.04-0ubuntu0.20.04.1 arch=amd64 variant=open
-nvidia-graphics-drivers-530 530.41.03-0ubuntu0.20.04.2 arch=amd64 variant=open
+nvidia-graphics-drivers-470 470.199.02-0ubuntu0.20.04.1 arch=amd64 transition=nvidia-graphics-drivers-465 transition=nvidia-graphics-drivers-460 transition=nvidia-graphics-drivers-455 transition=nvidia-graphics-drivers-450 transition=nvidia-graphics-drivers-440 transition=nvidia-graphics-drivers-435
+nvidia-graphics-drivers-525 525.125.06-0ubuntu0.20.04.3 arch=amd64 transition=nvidia-graphics-drivers-520 transition=nvidia-graphics-drivers-515 transition=nvidia-graphics-drivers-510 transition=nvidia-graphics-drivers-495
+nvidia-graphics-drivers-525 525.125.06-0ubuntu0.20.04.3 arch=amd64 variant=open
+nvidia-graphics-drivers-535 535.54.03-0ubuntu0.20.04.4 arch=amd64 transition=nvidia-graphics-drivers-530
+nvidia-graphics-drivers-535 535.54.03-0ubuntu0.20.04.4 arch=amd64 variant=open transition=nvidia-graphics-drivers-530-open
 nvidia-graphics-drivers-418-server 418.226.00-0ubuntu0.20.04.2 arch=amd64
-nvidia-graphics-drivers-450-server 450.236.01-0ubuntu0.20.04.1 arch=amd64 transition=nvidia-graphics-drivers-440-server
-nvidia-graphics-drivers-470-server 470.182.03-0ubuntu0.20.04.1 arch=amd64 transition=nvidia-graphics-drivers-460-server
-nvidia-graphics-drivers-515-server 515.105.01-0ubuntu0.20.04.1 arch=amd64 transition=nvidia-graphics-drivers-510-server
-nvidia-graphics-drivers-525-server 525.105.17-0ubuntu0.20.04.1 arch=amd64
+nvidia-graphics-drivers-450-server 450.248.02-0ubuntu0.20.04.1 arch=amd64 transition=nvidia-graphics-drivers-440-server
+nvidia-graphics-drivers-470-server 470.199.02-0ubuntu0.20.04.1 arch=amd64 transition=nvidia-graphics-drivers-460-server
+nvidia-graphics-drivers-525-server 525.125.06-0ubuntu0.20.04.2 arch=amd64 transition=nvidia-graphics-drivers-515-server transition=nvidia-graphics-drivers-510-server
+nvidia-graphics-drivers-535-server 535.54.03-0ubuntu0.20.04.1 arch=amd64
+nvidia-graphics-drivers-535-server 535.54.03-0ubuntu0.20.04.1 arch=amd64 variant=open
diff -Nru linux-restricted-signatures-intel-iotg-5.15-5.15.0/debian/scripts/generate-rules linux-restricted-signatures-intel-iotg-5.15-5.15.0/debian/scripts/generate-rules
--- linux-restricted-signatures-intel-iotg-5.15-5.15.0/debian/scripts/generate-rules	2023-06-09 13:41:13.000000000 +0000
+++ linux-restricted-signatures-intel-iotg-5.15-5.15.0/debian/scripts/generate-rules	2023-07-03 06:11:45.000000000 +0000
@@ -205,8 +205,8 @@
 	install -d debian/linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour}
 	install -d debian/linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour}/usr/lib/linux/triggers
 	\$(call install_control,linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour},${flavour},open,${suffix_short},postinst postrm); \\
-	stream="${src_genr_version}/${src_abi}-${flavour}/open/nvidia-${suffix_minus}"; \\
-	nvidia=\$\$(basename "\$\$stream"); \\
+	stream="${src_genr_version}/${src_abi}-${flavour}/open/nvidia-${suffix_short}"; \\
+	nvidia="nvidia-${suffix_short}"; \\
 	install -d debian/linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour}/lib/modules/kernel/\$\$nvidia; \\
 	for sig in \$\$stream/*.ko.sig; \\
 	do \\
diff -Nru linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/debian/rules.in linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/debian/rules.in
--- linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/debian/rules.in	1970-01-01 00:00:00.000000000 +0000
+++ linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/debian/rules.in	2023-07-04 16:36:28.000000000 +0000
@@ -0,0 +1,30 @@
+##export DH_VERBOSE := 1
+
+arch = $(shell dpkg-architecture -qDEB_HOST_ARCH)
+
+%:
+	dh $@
+
+override_dh_auto_build:
+	./download-signed "$(src_genr_package)" "$(src_genr_version)" "$(src_genr_package)"
+
+override_dh_auto_install: nvidia-$(arch)
+	dh_install
+
+override_dh_gencontrol:
+	dh_gencontrol -- $(gencontrol_flags)
+
+gencontrol_flags :=
+
+define install_control =
+	for which in $(5);							\
+	do									\
+		template="debian/templates/$(3).$$which.in";			\
+		script="debian/$(1).$$which";					\
+		sed -e 's/@abiname@/$(src_abi)/g'				\
+		    -e 's/@localversion@/-$(2)/g'				\
+		    -e 's/@image-stem@/$(instfile)/g'				\
+		    -e 's/@nvidia-ver@/$(4)/g'					\
+			<"$$template" >"$$script";				\
+	done
+endef
diff -Nru linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/debian/scripts/generate-rules linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/debian/scripts/generate-rules
--- linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/debian/scripts/generate-rules	1970-01-01 00:00:00.000000000 +0000
+++ linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/debian/scripts/generate-rules	2023-07-04 16:36:28.000000000 +0000
@@ -0,0 +1,256 @@
+#!/bin/bash
+set -e
+
+validate_unique()
+{
+	[ "$#" = "2" ]
+	local duplicates=$(echo $2 | tr " " "\n" | sort | uniq -d)
+	if [ "$duplicates" ]; then
+		echo "EE: duplicate values in $1" 1>&2
+		exit 1
+	fi
+}
+
+# Pick out relevant version and package information including our predecessor
+# packages: linux-restricted-generate -> linux-restricted-signatures -> linux-restricted-modules
+src_package=$(LC_ALL=C dpkg-parsechangelog -SSource)
+src_version=$(LC_ALL=C dpkg-parsechangelog -SVersion)
+src_abi=$(echo "${src_version}" | sed -ne 's/\([0-9]*\.[0-9]*\.[0-9]*\-[0-9]*\)\..*/\1/p')
+src_series=$(LC_ALL=C dpkg-parsechangelog -SDistribution | sed -e 's/-\(security\|updates\|proposed\)$//')
+
+# linux/5.8.0-41.46
+src_main_package=$(echo "${src_package}" | sed -e 's/-restricted-signature//')
+src_main_version=$(echo ${src_version} | sed -e 's/+[0-9][0-9\.]*$//')
+
+# linux-restricted-generate/5.8.0-41.46[+1]
+src_genr_package=$(echo "${src_package}" | sed -e 's/-restricted-signatures/-restricted-generate/')
+src_genr_version=${src_version}
+
+# linux-restricted-signatures/5.8.0-41.46[+1]
+
+# linux-restricted-modules/5.8.0-41.46[+1]
+src_lrm_package=$(echo "${src_package}" | sed -e 's/-restricted-signatures/-restricted-modules/')
+src_lrm_version=${src_version}
+
+cat - "debian/rules.in" >"debian/rules.gen" <<EOL
+#! /usr/bin/make -f
+
+src_package := ${src_package}
+src_version = ${src_version}
+src_abi = ${src_abi}
+src_series = ${src_series}
+src_genr_package = ${src_genr_package}
+src_genr_version = ${src_genr_version}
+
+EOL
+
+echo " ${src_genr_package} (= ${src_genr_version})," >"debian/control.interlock-up"
+
+build_archs=
+while read command flavour archs
+do
+	case "$command" in
+	build)		;;
+	*)		continue ;;
+	esac
+
+	for arch in $archs
+	do
+		case " $build_archs " in
+		*\ $arch\ *)	;;
+		*)		build_archs="$buildarchs $arch" ;;
+		esac
+	done
+done <"debian/package.config"
+
+while read command flavour archs
+do
+	case "$command" in
+	build)		;;
+	*)		continue ;;
+	esac
+
+	validate_unique "archs" "$archs"
+	targets=$(echo "$archs" | sed -e 's/\</nvidia-/g')
+
+	echo "II: build linux-signatures-nvidia-${src_abi}-${flavour} for ${archs}"
+
+	cat - >>"debian/rules.gen" <<EOL
+
+$targets::
+	for stream in "${src_genr_version}/${src_abi}-${flavour}/signatures"/*; \\
+	do \\
+		nvidia=\$\$(basename "\$\$stream"); \\
+		echo "\$\$stream/* /lib/modules/${src_abi}-${flavour}/kernel/\$\$nvidia/bits" >>debian/linux-signatures-nvidia-${src_abi}-${flavour}.install; \\
+	done
+EOL
+
+	cat - >>"debian/control.signatures" <<EOL
+
+Package: linux-signatures-nvidia-${src_abi}-${flavour}
+Build-Profiles: <!stage1>
+Architecture: ${archs}
+Section: kernel
+Priority: optional
+Depends: linux-image-${src_abi}-${flavour} | linux-image-unsigned-${src_abi}-${flavour},
+Built-Using: \${linux:BuiltUsing}
+Description: Linux kernel signatures for nvidia modules for version ${src_abi}-${flavour}
+ This package contains the Linux kernel signatures nvidia modules for
+ version ${src_abi}-${flavour}.
+ .
+ You likely do not want to install this package directly.
+EOL
+done <"debian/package.config"
+
+nvidia_desktop=
+nvidia_server=
+nvidia_ignore=
+while read command arg
+do
+	case "$command" in
+	option)		;;
+	suppress)		nvidia_ignore="$nvidia_ignore $arg"; continue ;;
+	*)		continue ;;
+	esac
+
+	case "$arg" in
+	desktop)	nvidia_desktop=y ;;
+	server)		nvidia_server=y ;;
+	esac
+done <"debian/package.config"
+
+: >"debian/control.open"
+while read command flavour archs
+do
+	case "$command" in
+	build)		;;
+	*)		continue ;;
+	esac
+
+	validate_unique "archs" "$archs"
+
+	while read package version extra
+	do
+		case "$package" in
+		nvidia-graphics-drivers-*-server)
+			[ -z "$nvidia_server" ] && continue
+			;;
+		nvidia-graphics-drivers-*)
+			[ -z "$nvidia_desktop" ] && continue
+			;;
+		*) continue ;;
+		esac
+		case " $nvidia_ignore " in
+		*\ $package\ *)		continue ;;
+		esac
+
+		case " $extra " in
+		*\ signonly\ *)		continue ;;
+		esac
+
+		# If package specifies arch= keys, only build it on
+		# the intersection of kernel flavour arches & the
+		# package arches, otherwise build for all kernel
+		# flavour arches.
+		pkg_archs=
+		variant=
+		for cmd in $extra
+		do
+			case "$cmd" in
+			arch=*)		pkg_archs="$pkg_archs ${cmd#arch=}" ;;
+			variant=*) variant="-${cmd#variant=}" ;;
+			esac
+		done
+
+		if [ "$variant" != "-open" ]; then
+			continue
+		fi
+
+		# No package arches set, build for everything
+		if [ -z "$pkg_archs" ]; then
+			pkg_archs=$archs
+		else
+			# Package arches set, build for intersection
+			validate_unique "pkg_archs" "$pkg_archs"
+			pkg_archs=$(sort <(echo $archs | tr " " "\n") <(echo $pkg_archs | tr " " "\n") | uniq -d | tr "\n" " ")
+			# No intersection, skip
+			if [ -z "$pkg_archs" ]; then
+				continue
+			fi
+		fi
+
+		targets=$(echo "$pkg_archs" | sed -e 's/\</nvidia-/g')
+		suffix_minus=$(echo "$package$variant" | sed -e 's/nvidia-graphics-drivers-//')
+		suffix_under=$(echo "$suffix_minus" | sed -e 's/-/_/g')
+		suffix_short=$(echo "$suffix_minus" | sed -e 's/-server/srv/g')
+		suffix_minus_common=$(echo "$package" | sed -e 's/nvidia-graphics-drivers-//')
+
+		echo "II: build $package for $flavour $pkg_archs"
+
+		cat - >>"debian/control.interlock-up" <<EOL
+ linux-objects-nvidia-${suffix_minus}-${src_abi}-${flavour} (>= ${src_lrm_version}) [${pkg_archs}],
+EOL
+
+		# debian/rules.gen
+		cat - >>"debian/rules.gen" <<EOL
+
+# $package $version $suffix_minus $suffix_under
+dkms_nvidia_${suffix_under}_version="$version"
+nvidia_${suffix_under}_upstream_version=\$(shell echo "\$(dkms_nvidia_${suffix_under}_version)" | cut -d '-' -f 1)
+gencontrol_flags += -Vdkms:nvidia-${suffix_minus}-modules="nvidia-dkms-${suffix_minus} (= \$(dkms_nvidia_${suffix_under}_version))"
+gencontrol_flags += -Vnvk:nvidia-${suffix_minus}="nvidia-kernel-common-${suffix_minus_common} (<= \$(nvidia_${suffix_under}_upstream_version)-1), nvidia-kernel-common-${suffix_minus_common} (>= \$(nvidia_${suffix_under}_upstream_version))"
+test::
+	@echo $package $version $suffix_minus $suffix_under $suffix_short $targets
+$targets::
+	install -d debian/linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour}
+	install -d debian/linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour}/usr/lib/linux/triggers
+	\$(call install_control,linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour},${flavour},open,${suffix_short},postinst postrm); \\
+	stream="${src_genr_version}/${src_abi}-${flavour}/open/nvidia-${suffix_minus}"; \\
+	nvidia=\$\$(basename "\$\$stream"); \\
+	install -d debian/linux-modules-nvidia-${suffix_minus}-\$(src_abi)-${flavour}/lib/modules/kernel/\$\$nvidia; \\
+	for sig in \$\$stream/*.ko.sig; \\
+	do \\
+		ko=\$\$(basename "\$\$sig" ".sig"); \\
+		cat "/lib/modules/${src_abi}-${flavour}/kernel/\$\$nvidia/\$\$ko" "\$\$sig" >"\$\$stream/\$\$ko"; \\
+		echo "\$\$stream/\$\$ko /lib/modules/${src_abi}-${flavour}/kernel/\$\$nvidia" >>debian/linux-modules-nvidia-${suffix_minus}-${src_abi}-${flavour}.install; \\
+	done
+EOL
+
+		# debian/control.d/nvidia
+		cat - >>"debian/control.open" <<EOL
+
+Package: linux-modules-nvidia-${suffix_minus}-${src_abi}-${flavour}
+Build-Profiles: <!stage1>
+Architecture: ${pkg_archs}
+Section: kernel
+Priority: optional
+Built-Using: \${dkms:nvidia-${suffix_minus}-modules}
+Depends:
+ \${misc:Depends},
+ \${shlibs:Depends},
+ linux-image-${src_abi}-${flavour} | linux-image-unsigned-${src_abi}-${flavour},
+ \${nvk:nvidia-${suffix_minus}},
+Description: Linux kernel nvidia modules for version ${src_abi}
+ This package pulls together the Linux kernel nvidia modules for
+ version ${src_abi} with the appropriate signatures.
+ .
+ You likely do not want to install this package directly. Instead, install the
+ one of the linux-modules-nvidia-${suffix_minus}-${flavour}* meta-packages,
+ which will ensure that upgrades work correctly, and that supporting packages are
+ also installed.
+EOL
+
+	done <"debian/dkms-versions"
+done <"debian/package.config"
+
+cat "debian/control.common" "debian/control.signatures" "debian/control.open" | sed \
+	-e "/@BUILD-INTERLOCK@/{"		\
+	-e " r debian/control.interlock-up"	\
+	-e " d"					\
+	-e " }"					\
+	-e "s/@SRCPKGNAME@/${src_package}/g"	\
+	-e "s/@ABI@/${src_abi}/g"		\
+	-e "s/@SERIES@/${src_series}/g"		\
+    >"debian/control"
+
+rm -f "debian/control.interlock-up" "debian/control.signatures" "debian/control.open"
diff -Nru linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/debian/templates/open.postinst.in linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/debian/templates/open.postinst.in
--- linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/debian/templates/open.postinst.in	1970-01-01 00:00:00.000000000 +0000
+++ linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/debian/templates/open.postinst.in	2023-07-04 16:36:28.000000000 +0000
@@ -0,0 +1,20 @@
+#!/bin/sh
+set -e
+
+version=@abiname@@localversion@
+image_path=/boot/@image-stem@-$version
+
+if [ "$1" != configure ]; then
+    exit 0
+fi
+
+depmod -a -F /boot/System.map-$version $version || true
+if [ -d /etc/kernel/postinst.d ]; then
+    cat - >/usr/lib/linux/triggers/$version <<EOF
+DEB_MAINT_PARAMS="$*" run-parts --report --exit-on-error --arg=$version \
+	    --arg="$image_path" /etc/kernel/postinst.d
+EOF
+    dpkg-trigger --no-await linux-update-$version
+fi
+
+exit 0
diff -Nru linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/debian/templates/open.postrm.in linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/debian/templates/open.postrm.in
--- linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/debian/templates/open.postrm.in	1970-01-01 00:00:00.000000000 +0000
+++ linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/debian/templates/open.postrm.in	2023-07-04 16:36:28.000000000 +0000
@@ -0,0 +1,26 @@
+#!/bin/sh
+set -e
+
+version=@abiname@@localversion@
+image_path=/boot/@image-stem@-$version
+
+if [ "$1" != remove ]; then
+    exit 0
+fi
+
+depmod -a -F /boot/System.map-$version $version 2>/dev/null || true
+#
+# See the commentary on extra.postrm.in for why this is disabled.
+#
+#if [ -d /etc/kernel/postinst.d ]; then
+#    # We want to behave as if linux-image (without us) was installed, therefore
+#    # we do not want the postinst support to know we are being removed, claim
+#    # this is an installation event.
+#    cat - >/usr/lib/linux/triggers/$version <<EOF
+#DEB_MAINT_PARAMS="configure" run-parts --report --exit-on-error --arg=$version \
+#	--arg="$image_path" /etc/kernel/postinst.d
+#EOF
+#    dpkg-trigger --no-await linux-update-$version
+#fi
+
+exit 0
diff -Nru linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/download-signed linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/download-signed
--- linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/download-signed	1970-01-01 00:00:00.000000000 +0000
+++ linux-restricted-signatures-intel-iotg-5.15-5.15.0/linux-restricted-signatures-intel-iotg-5.15/download-signed	2023-07-04 16:36:28.000000000 +0000
@@ -0,0 +1,183 @@
+#! /usr/bin/python3
+
+import hashlib
+import argparse
+import os
+import re
+import sys
+import tarfile
+from urllib import request
+from urllib.error import HTTPError
+from urllib.parse import (
+    urlparse,
+    urlunparse,
+    )
+
+import apt
+
+# package_name: package containing the objects we signed
+# package_version: package version containing the objects we signed
+# src_package: source package name in dists
+# signed_type: 'signed' or 'uefi' schema in the url
+
+parser = argparse.ArgumentParser()
+parser.add_argument(
+    "package_name",
+    help="package containining the objects we signed")
+parser.add_argument(
+    "package_version",
+    help="package version containing the objects we signed, or 'current'")
+parser.add_argument(
+    "src_package",
+    help="source package name in dists")
+parser.add_argument(
+    "signed_type",
+    nargs='?',
+    default='signed',
+    help="subdirectory type in the url, 'signed' or 'uefi'")
+args = parser.parse_args()
+
+
+class SignedDownloader:
+    """Download a block of signed information from dists.
+
+    Find a block of signed information as published in dists/*/signed
+    and download the contents.  Use the contained checksum files to
+    identify the members and to validate them once downloaded.
+    """
+
+    def __init__(self, package_name, package_version, src_package, signed_type='signed'):
+        self.package_name = package_name
+        self.package_version = package_version
+        self.src_package = src_package
+
+        # Find the package in the available archive repositories.  Use a _binary_
+        # package name and version to locate the appropriate archive.  Then use the
+        # URI there to look for and find the appropriate binary.
+        cache = apt.Cache()
+
+        self.package = None
+        if self.package_version == "current":
+            self.package = cache[package_name].candidate
+        else:
+            for version in cache[package_name].versions:
+                if version.version == self.package_version:
+                    self.package = version
+                    break
+
+        if not self.package:
+            raise KeyError("{0}: package version not found".format(self.package_name))
+
+        origin = self.package.origins[0]
+        pool_parsed = urlparse(self.package.uri)
+        self.package_dir = "%s/%s/%s/%s-%s/%s/" % (
+            origin.archive, 'main', signed_type,
+            self.src_package, self.package.architecture, self.package_version)
+
+        # Prepare the master url stem and pull out any username/password.  If present
+        # replace the default opener with one which offers that password.
+        dists_parsed_master = list(pool_parsed)
+        if '@' in dists_parsed_master[1]:
+            (username_password, host) = pool_parsed[1].split('@', 1)
+            (username, password) = username_password.split(':', 1)
+
+            dists_parsed_master[1] = host
+
+            # Work out the authentication domain.
+            domain_parsed = [ dists_parsed_master[0], dists_parsed_master[1], '/', None, None, None ]
+            auth_uri = urlunparse(domain_parsed)
+
+            # create a password manager
+            password_mgr = request.HTTPPasswordMgrWithDefaultRealm()
+
+            # Add the username and password.
+            # If we knew the realm, we could use it instead of None.
+            password_mgr.add_password(None, auth_uri, username, password)
+
+            handler = request.HTTPBasicAuthHandler(password_mgr)
+
+            # create "opener" (OpenerDirector instance)
+            opener = request.build_opener(handler)
+
+            # Now all calls to urllib.request.urlopen use our opener.
+            request.install_opener(opener)
+
+        self.dists_parsed = dists_parsed_master
+
+    def download_one(self, member, filename, hash_factory=None):
+        directory = os.path.dirname(filename)
+        if not os.path.exists(directory):
+            os.makedirs(directory)
+
+        dists_parsed = list(self.dists_parsed)
+        dists_parsed[2] = re.sub(r"/pool/.*", "/dists/" + self.package_dir + \
+            member, dists_parsed[2])
+        dists_uri = urlunparse(dists_parsed)
+
+        print("Downloading %s ... " % dists_uri, end='')
+        sys.stdout.flush()
+        try:
+            with request.urlopen(dists_uri) as dists, open(filename, "wb") as out:
+                hashobj = None
+                if hash_factory:
+                    hashobj = hash_factory()
+                for chunk in iter(lambda: dists.read(256 * 1024), b''):
+                    if hashobj:
+                        hashobj.update(chunk)
+                    out.write(chunk)
+                checksum = True
+                if hashobj:
+                    checksum = hashobj.hexdigest()
+        except HTTPError as e:
+            if e.code == 404:
+                print("not found")
+            else:
+                raise
+        else:
+            print("found")
+            return checksum
+        return None
+
+    def download(self, base):
+        """Download an entire signed result from dists."""
+
+        # Download the checksums and use that to download the contents.
+        sums = 'SHA256SUMS'
+        sums_local = os.path.join(base, self.package_version, sums)
+        if not self.download_one(sums, sums_local):
+            print('download-signed: {0}: not found'.format(sums))
+            sys.exit(1)
+
+        # Read the checksum file and download the files it mentions.
+        here = os.path.abspath(base)
+        with open(sums_local) as sfd:
+            for line in sfd:
+                line = line.strip()
+                (checksum_expected, member) = (line[0:64], line[66:])
+                filename = os.path.abspath(os.path.join(base, self.package_version, member))
+                if not filename.startswith(here):
+                    print('download-signed: {0}: member outside output directory'.format(member))
+                    sys.exit(1)
+
+                # Download and checksum this member.
+                checksum_actual = self.download_one(member, filename, hashlib.sha256)
+                if checksum_expected != checksum_actual:
+                    print('download-signed: {0}: member checksum invalid'.format(member))
+                    sys.exit(1)
+
+        # If this is a tarball result then extract it.
+        here = os.path.abspath(os.path.join(base, self.package_version))
+        tarball_filename = os.path.join(base, self.package_version, 'signed.tar.gz')
+        if os.path.exists(tarball_filename):
+            with tarfile.open(tarball_filename) as tarball:
+                for tarinfo in tarball:
+                    if not filename.startswith(here):
+                        print('download-signed: {0}: tarball member outside output directory'.format(member))
+                        sys.exit(1)
+                for tarinfo in tarball:
+                    print('Extracting {0} ...'.format(tarinfo.name))
+                    tarball.extract(tarinfo, base)
+
+
+downloader = SignedDownloader(**vars(args))
+downloader.download('.')