Upgrades across minor/major RHEL/Fedora releases can skip bootloader updates due to EVR comparison
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 196
- Forks
- 55
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 14
Description
When upgrading across RHEL minor releases (e.g., 9.6 -> 9.8), bootupd may skip updating EFI components like shim because the currently installed package has a higher EVR than the one in the target image, even though the target image contains the correct signed binary.
Example
A system running RHEL 9.6 has:
shim-aa64-16.1-8.el9_6.aarch64
The RHEL 9.8 image contains:
shim-aa64-16.1-7.el9.aarch64
bootupd compares these and determines 16.1-8.el9_6 > 16.1-7.el9, so it skips the shim update entirely. However, the 9.8 shim binary has proper signatures and is the one that should be installed for that release.
Should we also check the os-release when comparing EVR?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the bootloader update path that compares installed and target package EVRs, then inspect how the target os-release is identified. Reproduce the RHEL 9.6-to-9.8 case with the differing shim versions; done means a correctly signed target-release EFI component is not skipped solely because its EVR is lower.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100