When upgrading across RHEL minor releases (e.g., 9.6 -> 9.8), bootupd may skip updating EFI components like shim because the currently installed package has a higher EVR than the one in the target image, even though the target image contains the correct signed binary.
Example
A system running RHEL 9.6 has:
shim-aa64-16.1-8.el9_6.aarch64
The RHEL 9.8 image contains:
shim-aa64-16.1-7.el9.aarch64
bootupd compares these and determines 16.1-8.el9_6 > 16.1-7.el9, so it skips the shim update entirely. However, the 9.8 shim binary has proper signatures and is the one that should be installed for that release.
Should we also check the os-release when comparing EVR?
When upgrading across RHEL minor releases (e.g., 9.6 -> 9.8), bootupd may skip updating EFI components like shim because the currently installed package has a higher EVR than the one in the target image, even though the target image contains the correct signed binary.
Example
A system running RHEL 9.6 has:
shim-aa64-16.1-8.el9_6.aarch64
The RHEL 9.8 image contains:
shim-aa64-16.1-7.el9.aarch64
bootupd compares these and determines 16.1-8.el9_6 > 16.1-7.el9, so it skips the shim update entirely. However, the 9.8 shim binary has proper signatures and is the one that should be installed for that release.
Should we also check the os-release when comparing EVR?