Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package shim for openSUSE:Factory checked in at 2026-09-08 16:52:55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/shim (Old) and /work/SRC/openSUSE:Factory/.shim.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "shim" Tue Sep 8 16:52:55 2026 rev:139 rq:1376068 version:16.1 Changes: -------- --- /work/SRC/openSUSE:Factory/shim/shim.changes 2026-06-18 18:39:39.214601566 +0200 +++ /work/SRC/openSUSE:Factory/.shim.new.1265/shim.changes 2026-09-08 16:53:02.531259058 +0200 @@ -1,0 +2,56 @@ +Mon Aug 3 08:35:06 UTC 2026 - Joey Lee <[email protected]> + +- shim-install: Do not update fallback on sl-micro when the fallback + is not in efi default boot path + + The SL-Micro SelfInstall image direct unpackage the raw image to + the hard drive on target machine. The kiwi produced the raw image + by 'shim-install --removable' command. So the raw image does NOT + include fallback.efi in the EFI default boot path (aka. the + removable boot path, EFI/boot/). Looks that SL-Micro does NOT care + the fallback function of SUSE boot entry is lost. + + Normally, with or without fallback.efi should NOT case problem when + booting. Also, the distro (SL-Micro in this case) does NOT care fallback + function. But some issue machine's firmware can ONLY boot with the + removable boot path (aka. the default boot path, /EFI/boot/bootx64.efi). + And issue firmware always modified boot order or even removed SUSE boot + entry. It causes that the fallback.efi always be triggered in every + booting. The outward symptom is an endless cycle of rebooting and showing + the fallback prompt box. + + The above situation NOT be found before we fix bsc#1254336. In + bsc#1254336, the shim-install did NOT update the files in removable boot + path. e.g. /EFI/boot/bootx64.efi or /EFI/boot/fallback.efi. + + So we will NOT update fallback.efi on SL-Micro when shim-install did NOT + see fallback in the removable boot path (EFI/boot/fallback.efi). No + fallback.efi in the removable boot path means that the target system + is installed by wiki raw image. (bsc#1270036) + +------------------------------------------------------------------- +Fri Jul 31 20:44:26 UTC 2026 - Dirk Müller <[email protected]> + +- shim-install: change fgrep to grep -F to avoid warnings + +------------------------------------------------------------------- +Wed Jul 29 02:42:41 UTC 2026 - Joey Lee <[email protected]> + +- shim: Add Microsoft-signed nx-shim for SLE (jsc#PED-15978) + For preparing use nx shim as the default shim binary on SLE. + Add Microsoft-signed nx-shim for SLE: + Source42 shim-sles.nx.x86.efi + Source43 shim-sles.nx.aarch64.efi +- shim-install: Fix the variable name for the source of non-nx shim +- shim-install: Create a white list of SUSE distros for supporing nx shim + (jsc#PED-15978) + +------------------------------------------------------------------- +Fri Jun 26 02:58:21 UTC 2026 - Gary Ching-Pang Lin <[email protected]> + +- shim-install: Improve the detection of SL Micro + + The GRUB_DISTRIBUTOR variable in SL Micro images may contain + "SL Micro" or "SL-Micro" prefix. (bsc#1269084) + +------------------------------------------------------------------- New: ---- shim-sles.nx.aarch64.efi shim-sles.nx.x86.efi ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ shim.spec ++++++ --- /var/tmp/diff_new_pack.JwauE8/_old 2026-09-08 16:53:03.847314271 +0200 +++ /var/tmp/diff_new_pack.JwauE8/_new 2026-09-08 16:53:03.848314313 +0200 @@ -82,6 +82,8 @@ # Microsoft-signed nx-shim Source40: shim-opensuse.nx.x86.efi Source41: shim-opensuse.nx.aarch64.efi +Source42: shim-sles.nx.x86.efi +Source43: shim-sles.nx.aarch64.efi # revoked certificates for dbx Source50: revoked-openSUSE-UEFI-SIGN-Certificate-2013-01.crt Source51: revoked-openSUSE-UEFI-SIGN-Certificate-2013-08.crt @@ -247,11 +249,11 @@ vendor_dbx='vendor-dbx-sles.esl' %ifarch x86_64 ms_shim=%{SOURCE32} - ms_shim_nx="" + ms_shim_nx=%{SOURCE42} %else # sles aarch64 ms_shim=%{SOURCE33} - ms_shim_nx="" + ms_shim_nx=%{SOURCE43} %endif elif test "$suffix" = "devel"; then cert=%{_sourcedir}/_projectcert.crt ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.JwauE8/_old 2026-09-08 16:53:03.933317879 +0200 +++ /var/tmp/diff_new_pack.JwauE8/_new 2026-09-08 16:53:03.939318131 +0200 @@ -1,6 +1,6 @@ -mtime: 1781692294 -commit: b5c000a0d2cba772a60e1f53099b93e3ccb1b5b4fe23f4aa1210f956711aa5d1 +mtime: 1785818081 +commit: 661ad2944d2a9cf78011f27ba7f04b8be07a6a75253fec440cc884c42fc242ff url: https://src.opensuse.org/devel-factory/shim -revision: b5c000a0d2cba772a60e1f53099b93e3ccb1b5b4fe23f4aa1210f956711aa5d1 +revision: 661ad2944d2a9cf78011f27ba7f04b8be07a6a75253fec440cc884c42fc242ff projectscmsync: https://src.opensuse.org/devel-factory/_ObsPrj.git ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-08-04 06:34:41.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ shim-install ++++++ --- /var/tmp/diff_new_pack.JwauE8/_old 2026-09-08 16:53:04.323334242 +0200 +++ /var/tmp/diff_new_pack.JwauE8/_new 2026-09-08 16:53:04.327334410 +0200 @@ -23,16 +23,35 @@ self="`basename $0`" grub_cfg="/boot/grub2/grub.cfg" update_boot=no +check_fallback=no def_grub_efi="${source_dir}/grub.efi" def_boot_efi= [ ! -r /usr/etc/default/shim ] || . /usr/etc/default/shim [ ! -r /etc/default/shim ] || . /etc/default/shim +DEFAULT_NX=false +# A white list of SUSE distros for booting with nx shim +if [ -f /etc/os-release ]; then + . /etc/os-release + case "${NAME}" in + "openSUSE Tumbleweed") + DEFAULT_NX=true + ;; + "SLES") + case "${VERSION_ID}" in + "16.1") + DEFAULT_NX=true + ;; + esac + ;; + esac +fi + +# Default shim if [ -z "$def_shim_efi" -o ! -e ${source_dir}/${def_shim_efi} ] ; then def_shim_efi="shim.efi" fi - source_shim_efi="${source_dir}/${def_shim_efi}" # non-nx shim @@ -40,7 +59,13 @@ if [ ! -e "${source_dir}/${def_shim_non_nx_efi}" ]; then def_shim_non_nx_efi="shim.non-nx.efi" fi -source_shim_nx_efi="${source_dir}/${def_shim_non_nx_efi}" +source_shim_non_nx_efi="${source_dir}/${def_shim_non_nx_efi}" + +# If SUSE distro is NOT in NX list. Set non-nx shim as the default shim +if [ "$DEFAULT_NX" = "false" ] ; then + def_shim_efi="${def_shim_non_nx_efi}" + source_shim_efi="${source_shim_non_nx_efi}" +fi if [ x${arch} = xx86_64 ] ; then grub_install_target="x86_64-efi" @@ -95,8 +120,9 @@ esac # bsc#1230316 Check if the system is encrypted SL-Micro +# bsc#1269084 Detect the "SL Micro" or "SL-Micro" prefix is_encrypted_slm () { - if test "$GRUB_DISTRIBUTOR" = "SL Micro" && test -n "$GRUB_TPM2_SEALED_KEY" ; then + if [[ "$GRUB_DISTRIBUTOR" =~ ^SL[-\ ]Micro ]] && test -n "$GRUB_TPM2_SEALED_KEY" ; then # return true return 0 fi @@ -311,6 +337,7 @@ fi if test -n "$efidir"; then + # shim file names in efi folder for laster creating boot entry efi_file=shim.efi efi_non_nx_file=shim.non-nx.efi efibootdir="$efidir/EFI/boot" @@ -329,6 +356,16 @@ if test "$removable" = "no" -a -f "$efibootdir/$def_boot_efi"; then if test -n "$ca_string" && (grep -q "$ca_string" "$efibootdir/$def_boot_efi"); then update_boot=yes + # We should only update fallback.efi if it is already present. If it is + # not present, we should not create one because it will break the + # images created as removable target (e.g. SL-Micro selfinstall image). + # Remember the purpose here is to update sle distro loaders and also loaders + # in fallback path if they are found to be SUSE owned, but that should not + # instroduce unexpected behavior change from removable to non-removable. + # Some firmware may only support removable boot path. + if [ "$OS_ID" = "sl-micro" ]; then + check_fallback=yes + fi fi else update_boot=yes @@ -349,16 +386,16 @@ if test "$no_nvram" = no && test -n "$bootloader_id"; then # Delete old entries from the same distributor. for bootnum in `$efibootmgr | grep '^Boot[0-9]' | \ - fgrep -i " $bootloader_id" | cut -b5-8`; do + grep -F -i " $bootloader_id" | cut -b5-8`; do $efibootmgr -b "$bootnum" -B done # Delete old entries for non-nx from the same distributor. for bootnum in `$efibootmgr | grep '^Boot[0-9]' | \ - fgrep " $bootloader_id-non-nx" | cut -b5-8`; do + grep -F " $bootloader_id-non-nx" | cut -b5-8`; do $efibootmgr -b "$bootnum" -B done - fi - exit 0 + fi + exit 0 fi cp "${source_dir}/MokManager.efi" "${efidir}" @@ -375,20 +412,27 @@ echo "copying $source_grub_efi to ${efidir}/grub.efi" cp "$source_grub_efi" "${efidir}/grub.efi" -if test "$efidir" != "$efibootdir" ; then +if test "$efidir" != "$efibootdir" ; then + # Copy default shim cp "${source_shim_efi}" "${efidir}/shim.efi" - # copy non-nx shim - cp "${source_shim_nx_efi}" "${efidir}/shim.non-nx.efi" + # Copy non-nx shim. It's a fallback + if [ "$DEFAULT_NX" = "true" ] ; then + cp "${source_shim_non_nx_efi}" "${efidir}/shim.non-nx.efi" + fi if test -n "$bootloader_id"; then echo "shim.efi,${bootloader_id}" | iconv -f ascii -t ucs2 > "${efidir}/boot.csv" fi fi if test "$update_boot" = "yes"; then + # Copy default shim to bootx64.efi/bootaa64.efi + # firmware only support one bootx64.efi, so do not copy bootx64.non-nx.efi as a fallback cp "$source_shim_efi" "${efibootdir}/${def_boot_efi}" - # firmware only support bootx64.efi, NOT support bootx64.non-nx.efi if test "$removable" = "no"; then - cp "${source_dir}/fallback.efi" "${efibootdir}" + if test ${check_fallback} = "yes" && + test -f "${efibootdir}/fallback.efi"; then + cp "${source_dir}/fallback.efi" "${efibootdir}" + fi # bsc#1175626, bsc#1175656 Since shim 15, loading MokManager becomes # mandatory if a MOK request exists. Copy MokManager to \EFI\boot so # that boot*.efi can load MokManager to process the request instead @@ -502,12 +546,12 @@ # Delete old entries from the same distributor. for bootnum in `$efibootmgr | grep '^Boot[0-9]' | \ - fgrep -i " $bootloader_id" | cut -b5-8`; do + grep -F -i " $bootloader_id" | cut -b5-8`; do $efibootmgr -b "$bootnum" -B done # Delete old entries for non-nx from the same distributor. for bootnum in `$efibootmgr | grep '^Boot[0-9]' | \ - fgrep " $bootloader_id-non-nx" | cut -b5-8`; do + grep -F " $bootloader_id-non-nx" | cut -b5-8`; do $efibootmgr -b "$bootnum" -B done @@ -533,19 +577,23 @@ efidir_disk="$("$grub_probe" --target=disk --device-map= -d "$mddev")" efidir_part="$(echo "$efidir_drive" | sed 's/^([^,]*,[^0-9]*//; s/[^0-9].*//')" efidir_d=${mddev#/dev/} - # create boot entry for non-nx shim - $efibootmgr -c -d "$efidir_disk" -p "$efidir_part" -w \ - -L "$bootloader_id-non-nx ($efidir_d)" -l "\\EFI\\$efi_distributor\\$efi_non_nx_file" - # create boot entry for default shim (nx) + # create boot entry for non-nx shim as a fallback + if [ "$DEFAULT_NX" = "true" ] ; then + $efibootmgr -c -d "$efidir_disk" -p "$efidir_part" -w \ + -L "$bootloader_id-non-nx ($efidir_d)" -l "\\EFI\\$efi_distributor\\$efi_non_nx_file" + fi + # create boot entry for default shim $efibootmgr -c -d "$efidir_disk" -p "$efidir_part" -w \ -L "$bootloader_id ($efidir_d)" -l "\\EFI\\$efi_distributor\\$efi_file" done else efidir_part="$(echo "$efidir_drive" | sed 's/^([^,]*,[^0-9]*//; s/[^0-9].*//')" - # create boot entry for default shim (nx) - $efibootmgr -c -d "$efidir_disk" -p "$efidir_part" -w \ - -L "$bootloader_id-non-nx" -l "\\EFI\\$efi_distributor\\$efi_non_nx_file" - # create boot entry for default shim (nx) + # create boot entry for non-nx shim as a fallback + if [ "$DEFAULT_NX" = "true" ] ; then + $efibootmgr -c -d "$efidir_disk" -p "$efidir_part" -w \ + -L "$bootloader_id-non-nx" -l "\\EFI\\$efi_distributor\\$efi_non_nx_file" + fi + # create boot entry for default shim $efibootmgr -c -d "$efidir_disk" -p "$efidir_part" -w \ -L "$bootloader_id" -l "\\EFI\\$efi_distributor\\$efi_file" fi
