SUSE-RU-2026:23882-1: moderate: Recommended update for python-kiwi

[SLE-UPDATES]

# Recommended update for python-kiwi

Announcement ID: SUSE-RU-2026:23882-1  
Release Date: 2026-09-23T11:54:08Z  
Rating: moderate  
References:

  
Affected Products:

  * SUSE Linux Micro 6.2
  * SUSE Linux Micro Extras 6.2

  
  
An update that can now be installed.

## Description:

This update for python-kiwi fixes the following issues:

Changes in python-kiwi:

  * Fix LUKS header checksum reference for reencryption

The origin LUKS header checksum stored in /root/.luks.header is used by the kiwi
dracut code to decide if the initial reencryption of the root device should
happen. The checksum is calculated over the header backup file which is at the
same time the file the resulting checksum gets written to.

Since the checksum handler returned by get_checksum_handler() calculates the
digest lazily when digest() is called, and the call happened inside the
open(..., 'w') context, the header backup was already truncated at that point.
The stored reference was therefore always the digest of an empty file
(e3b0c442... for sha256) and could never match the digest calculated at boot
time. As a consequence reencrypt_luks() silently skipped the reencryption and
the image stayed encrypted with the build time credentials.

Calculate the digest before the file is opened for writing.

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Micro Extras 6.2  
    zypper in -t patch SUSE-SLE-Micro-Extras-6.2-1746

## Package List:

  * SUSE Linux Micro Extras 6.2 (aarch64 ppc64le s390x x86_64)
    * python3-kiwi-10.2.33-160000.7.1
    * kiwi-systemdeps-core-10.2.33-160000.7.1

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20260929/6a29b667/attachment.htm>