SUSE-RU-2020:2971-1: moderate: Recommended update for shim-susesigned

[sle-updates at lists.suse.com]

   SUSE Recommended Update: Recommended update for shim-susesigned
______________________________________________________________________________

Announcement ID:    SUSE-RU-2020:2971-1
Rating:             moderate
References:         #1177315 
Affected Products:
                    SUSE Linux Enterprise Module for Server Applications 15-SP2
                    SUSE Linux Enterprise Module for Basesystem 15-SP2
                    SUSE Linux Enterprise Module for Basesystem 15-SP1
______________________________________________________________________________

   An update that has one recommended fix can now be installed.

Description:



   This update contains changes needed for Common criteria certification.

   shim:

   * add a temporary shim loader EFI signed by SUSE that contains additional
     checks of Extended Key Usage for Codesigning (bsc#1177315)

   The Common Criteria system role for 15-SP2 was adjusted:

   * Configure alternative shim (bsc#1177315)
   * Remove curve25519-sha256 at libssh.org as it doesn't work in fips mode
   * doc: logrotate is started via timer


Patch Instructions:

   To install this SUSE Recommended Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Module for Server Applications 15-SP2:

      zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP2-2020-2971=1

   - SUSE Linux Enterprise Module for Basesystem 15-SP2:

      zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP2-2020-2971=1

   - SUSE Linux Enterprise Module for Basesystem 15-SP1:

      zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2020-2971=1



Package List:

   - SUSE Linux Enterprise Module for Server Applications 15-SP2 (aarch64 ppc64le s390x x86_64):

      certification-sles-eal4-15.2+git20201015.eccdcab-5.12.2

   - SUSE Linux Enterprise Module for Basesystem 15-SP2 (x86_64):

      shim-15+git47-3.11.2
      shim-debuginfo-15+git47-3.11.2
      shim-debugsource-15+git47-3.11.2

   - SUSE Linux Enterprise Module for Basesystem 15-SP1 (x86_64):

      shim-15+git47-3.11.2
      shim-debuginfo-15+git47-3.11.2
      shim-debugsource-15+git47-3.11.2


References:

   https://bugzilla.suse.com/1177315