<div class="container">
<h1>Recommended update for python-kiwi</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-RU-2026:23905-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-09-23T12:00:07Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>moderate</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Server 16.0</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP applications 16.0</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that can now be installed.</p>
<h2>Description:</h2>
<p>This update for python-kiwi fixes the following issues:</p>
<p>Changes in python-kiwi:</p>
<ul>
<li>Fix LUKS header checksum reference for reencryption</li>
</ul>
<p>The origin LUKS header checksum stored in /root/.luks.header is
used by the kiwi dracut code to decide if the initial reencryption
of the root device should happen. The checksum is calculated over
the header backup file which is at the same time the file the
resulting checksum gets written to.</p>
<p>Since the checksum handler returned by get_checksum_handler()
calculates the digest lazily when digest() is called, and the
call happened inside the open(..., 'w') context, the header backup
was already truncated at that point. The stored reference was
therefore always the digest of an empty file
(e3b0c442... for sha256) and could never match the digest
calculated at boot time. As a consequence reencrypt_luks()
silently skipped the reencryption and the image stayed encrypted
with the build time credentials.</p>
<p>Calculate the digest before the file is opened for writing.</p>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP applications 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-1746</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-1746</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (ppc64le x86_64)
<ul>
<li>dracut-kiwi-lib-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-bootloaders-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-image-validation-10.2.33-160000.7.1</li>
<li>python3-kiwi-10.2.33-160000.7.1</li>
<li>dracut-kiwi-overlay-10.2.33-160000.7.1</li>
<li>kiwi-man-pages-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-iso-media-10.2.33-160000.7.1</li>
<li>dracut-kiwi-oem-repart-10.2.33-160000.7.1</li>
<li>dracut-kiwi-verity-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-core-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-filesystems-10.2.33-160000.7.1</li>
<li>dracut-kiwi-live-10.2.33-160000.7.1</li>
<li>dracut-kiwi-verity-debuginfo-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-containers-wsl-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-containers-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-disk-images-10.2.33-160000.7.1</li>
<li>dracut-kiwi-oem-dump-10.2.33-160000.7.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
<ul>
<li>kiwi-bash-completion-10.2.33-160000.7.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (x86_64)
<ul>
<li>kiwi-pxeboot-10.2.33-160000.7.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64)
<ul>
<li>dracut-kiwi-lib-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-bootloaders-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-image-validation-10.2.33-160000.7.1</li>
<li>python3-kiwi-10.2.33-160000.7.1</li>
<li>dracut-kiwi-overlay-10.2.33-160000.7.1</li>
<li>kiwi-man-pages-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-iso-media-10.2.33-160000.7.1</li>
<li>dracut-kiwi-oem-repart-10.2.33-160000.7.1</li>
<li>dracut-kiwi-verity-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-core-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-filesystems-10.2.33-160000.7.1</li>
<li>dracut-kiwi-live-10.2.33-160000.7.1</li>
<li>dracut-kiwi-verity-debuginfo-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-containers-wsl-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-containers-10.2.33-160000.7.1</li>
<li>kiwi-systemdeps-disk-images-10.2.33-160000.7.1</li>
<li>dracut-kiwi-oem-dump-10.2.33-160000.7.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 16.0 (noarch)
<ul>
<li>kiwi-bash-completion-10.2.33-160000.7.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 16.0 (x86_64)
<ul>
<li>kiwi-pxeboot-10.2.33-160000.7.1</li>
</ul>
</li>
</ul>
</div>