SUSE-IU-2026:8638-1: Recommended update of suse/sl-micro/6.1/base-os-container

[sle-container-updates at lists.suse.com]

SUSE Image Update Advisory: suse/sl-micro/6.1/base-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:8638-1
Image Tags        : suse/sl-micro/6.1/base-os-container:2.2.1 , suse/sl-micro/6.1/base-os-container:2.2.1-5.213 , suse/sl-micro/6.1/base-os-container:latest
Image Release     : 5.213
Severity          : critical
Type              : recommended
References        : 1210382 1259096 1264459 1278729 CVE-2026-43284 
-----------------------------------------------------------------

The container suse/sl-micro/6.1/base-os-container was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 777
Released:    Mon Nov  9 09:52:03 2026
Summary:     Recommended update for shim
Type:        recommended
Severity:    critical
References:  1210382,1259096,1264459,1278729,CVE-2026-43284
This update for shim fixes the following issues:

Changes in shim:

* New shim-install includes the following changes:
    - Update shim-install to limit the scope of the 'removable'
      SL-Micro to the image booting with TPM2 unsealing (bsc#1210382)
      from src.opensuse.org/shim
    - shim-install: Do not update fallback on sl-micro when
      the fallback is not in efi default boot path
      - patch is from src.opensuse.org/shim git repo
    - Create non-nx shim boot entry as a fallback option

      Because we apply nx shim as the default shim binary in

                /boot/efi/EFI/opensuse/shim.efi
                /boot/efi/EFI/boot/bootx64.efi or bootaa64.efi

      In case that user got any problem when the machine boots with
      nx-shim, so we create a new boot entry for non-nx shim as a
          fallback option by efibootmgr.

    - shim-install: Create non-NX shim boot entry first to prioritize NX shim

      - Use the NX shim as the default binary for system booting. By
        creating the boot entry for the non-NX shim prior to the default
        NX shim, the standard NX shim entry will automatically gain a
        higher priority in the UEFI BootOrder. This ensures the system
        boots using the secure NX shim by default while keeping the
        non-NX shim as a fallback option.

    - shim-install: Fix the variable name for the source of
      non-nx shim
    - shim-install: Create a white list of SUSE distros for

      supporing nx shim

- Modified the pretrans Lua script to work around the broken DB issue
  caused by buggy firmware when Secure Boot is disabled.
  It is impossible for the db to be empty while Secure Boot is enabled.
  If the db is empty, the installation behavior will be treated the
  same as when Secure Boot is disabled. We allow the shim installation
  process to continue and display a message reminding the user to add
  the appropriate certificate. (bsc#1259096)

- Add Requires tags for checking the grub2 sbat generation at RPM
  level.


The following package changes have been done:

- shim-16.1-slfo.1.1_3.1 updated