At the end of an upgrade the error message "Migration failed.“ is shown and a repository rollback was performed

(548/770) Installing: kernel-default-5.14.21-150500.55.52.1.x86_64 [............................................................................................
dracut: Executing: /usr/bin/dracut -f /boot/initrd-5.14.21-150500.55.52-default 5.14.21-150500.55.52-default
dracut: dracut module 'systemd-networkd' will not be installed, because command 'networkctl' could not be found!
dracut: dracut module 'systemd-networkd' will not be installed, because command '/usr/lib/systemd/systemd-networkd' could not be found!
dracut: dracut module 'systemd-networkd' will not be installed, because command '/usr/lib/systemd/systemd-networkd-wait-online' could not be found!
dracut: dracut module 'systemd-repart' will not be installed, because command 'systemd-repart' could not be found!
dracut: dracut module 'systemd-resolved' will not be installed, because command 'resolvectl' could not be found!
dracut: dracut module 'systemd-resolved' will not be installed, because command '/usr/lib/systemd/systemd-resolved' could not be found!
dracut: dracut module 'dbus-broker' will not be installed, because command 'dbus-broker' could not be found!
.
.
dracut: memstrack is not available
dracut: If you need to use rd.memdebug>=4, please install memstrack and procps-ng
dracut: dracut module 'squash' will not be installed, because command 'mksquashfs' could not be found!
dracut: dracut module 'squash' will not be installed, because command 'unsquashfs' could not be found!
dracut: *** Including module: systemd ***
dracut: *** Including module: systemd-initrd ***
dracut: *** Including module: i18n ***
dracut: No KEYMAP configured.
dracut: *** Including module: kernel-modules ***
dracut: *** Including module: kernel-modules-extra ***
dracut: *** Including module: rootfs-block ***
dracut: *** Including module: suse-btrfs ***
dracut: *** Including module: suse-xfs ***
dracut: *** Including module: terminfo ***
dracut: *** Including module: udev-rules ***
dracut: Skipping udev rule: 40-redhat.rules
dracut: Skipping udev rule: 50-firmware.rules
dracut: Skipping udev rule: 50-udev.rules
dracut: Skipping udev rule: 91-permissions.rules
dracut: Skipping udev rule: 80-drivers-modprobe.rules
dracut: *** Including module: dracut-systemd ***
dracut: *** Including module: haveged ***
dracut: *** Including module: usrmount ***
dracut: *** Including module: base ***
dracut: *** Including module: fs-lib ***
dracut: *** Including module: shutdown ***
dracut: *** Including module: suse ***
dracut: *** Including module: suse-initrd ***
dracut: *** Including modules done ***
dracut: *** Installing kernel module dependencies ***
dracut: *** Installing kernel module dependencies done ***
dracut: *** Resolving executable dependencies ***
dracut: *** Resolving executable dependencies done ***
dracut: *** Hardlinking files ***
dracut: Mode:           real
dracut: Files:          1677
dracut: Linked:         2 files
dracut: Compared:       0 xattrs
dracut: Compared:       591 files
dracut: Saved:          738 B
dracut: Duration:       0.010746 seconds
dracut: *** Hardlinking files done ***
dracut: *** Generating early-microcode cpio image ***
dracut: *** Store current command line parameters ***
dracut: Stored kernel commandline:
dracut:  root=UUID=98dd41fd-30fc-4bb4-bcd0-ad816abb6621 rootfstype=xfs rootflags=rw,relatime,attr2,inode64,logbufs=8,logbsize=32k,noquota
dracut: *** Stripping files ***
dracut: *** Stripping files done ***
dracut: *** Creating image file '/boot/initrd-5.14.21-150500.55.52-default' ***
dracut: *** Creating initramfs image file '/boot/initrd-5.14.21-150500.55.52-default' done ***
Failed to get root password hash
Failed to import /etc/uefi/certs/76B6A6A0.crt
warning: %post(kernel-default-5.14.21-150500.55.52.1.x86_64) scriptlet failed, exit status 255
done]
.
.
Since the last system boot core libraries or services have been updated.
Reboot is suggested to ensure that your system benefits from these updates.' (exit status 107)

Migration failed.


Performing repository rollback...

Starting to sync system product activations to the server. This can take some time...

Executing '/usr/bin/zypper --disable-repositories --xmlout --non-interactive products -i'
Executing '/usr/bin/zypper --non-interactive removeservice SUSE_Linux_Enterprise_Server_for_SAP_Applications_x86_64'
.
.
Executing '/usr/bin/zypper --non-interactive removeservice SUSE_Linux_Enterprise_Live_Patching_x86_64'
Executing '/usr/bin/zypper --non-interactive removeservice SUSE_Linux_Enterprise_Live_Patching_x86_64'
Executing '/usr/bin/zypper --non-interactive removeservice SUSE_Linux_Enterprise_Live_Patching_x86_64'
Executing '/usr/bin/zypper --non-interactive addservice -t ris plugin:/susecloud?credentials=SUSE_Linux_Enterprise_Live_Patching_x86_64&path=/services/2511 SUSE_Linux_Enterprise_Live_Patching_x86_64'
Executing '/usr/bin/zypper --non-interactive modifyservice -r SUSE_Linux_Enterprise_Live_Patching_x86_64'
Executing '/usr/bin/zypper --non-interactive refs SUSE_Linux_Enterprise_Live_Patching_x86_64'
Executing '/usr/bin/zypper --non-interactive --releasever 15.5 ref -f'

Rollback successful.

[22;27;31;49m'/usr/lib/zypper/commands/zypper-migration' exited with status 1[0m

1- Make sure that both required "Secure Boot" packages are installed:

sles-sap-12-sp5-gen2:~ # rpm -qa shim
shim-15.7-150300.4.16.1.x86_64


sles-sap-12-sp5-gen2:~ # rpm -qa mokutil
mokutil-0.4.0-150200.4.6.1.x86_64



2- Enable "Secure Boot" using command line:

sles-sap-12-sp5-gen2:~ # cat /etc/sysconfig/bootloader 
DEFAULT_APPEND="USE_BY_UUID_DEVICE_NAMES=1 earlyprintk=ttyS0 console=ttyS0 rootdelay=300 multipath=off net.ifnames=0 dis_ucode_ldr scsi_mod.use_blk_mq=1 root=UUID=98dd41fd-30fc-4bb4-bcd0-ad816abb6621 rw "
FAILSAFE_APPEND="USE_BY_UUID_DEVICE_NAMES=1 earlyprintk=ttyS0 console=ttyS0 rootdelay=300 multipath=off net.ifnames=0 dis_ucode_ldr scsi_mod.use_blk_mq=1 root=UUID=98dd41fd-30fc-4bb4-bcd0-ad816abb6621 rw  ide=nodma apm=off noresume edd=off nomodeset 3 "
LOADER_LOCATION=none
LOADER_TYPE=grub2-efi
SECURE_BOOT="yes"



3- For the upgrade set a temporary "root" password:

sles-sap-12-sp5-gen2:~ # passwd



4- Reinitialize the bootloader by refreshing the config and reinstall it:

sles-sap-12-sp5-gen2:~ # /sbin/update-bootloader --reinit



5- Verify "Secure boot" setup:

sles-sap-12-sp5-gen2:~ # efibootmgr -v
BootCurrent: 0001
Timeout: 0 seconds
BootOrder: 0003,0001,0000
Boot0000* EFI Network    AcpiEx(VMBus,,)/VenHw(9b17e5a2-0891-42dd-b653-80b5c22809ba,635161f83edfc546913ff2d2f965ed0e8d3a0d00c6cf0d003a8dcfc6000d3a8d)/MAC(000000000000,0)/IPv4(0.0.0.00.0.0.0,0,0)
Boot0001* EFI SCSI Device    AcpiEx(VMBus,,)/VenHw(9b17e5a2-0891-42dd-b653-80b5c22809ba,d96361baa104294db60572e2ffb1dc7f1a78b3f8821e1848a1c363d806ec15bb)/SCSI(0,0)
Boot0002* EFI SCSI Device    AcpiEx(VMBus,,)/VenHw(9b17e5a2-0891-42dd-b653-80b5c22809ba,d96361baa104294db60572e2ffb1dc7f1a78b3f8821e1848a1c363d806ec15bb)/SCSI(0,1)
Boot0003* sles-secureboot    HD(2,GPT,3c5f99ae-f3e4-4d71-b167-f7e492abc7df,0x1800,0x100000)/File(\EFI\sles\shim.efi)

-

sles-sap-12-sp5-gen2:~ # ll -R /boot/efi/EFI/
/boot/efi/EFI/:
total 16
drwxr-xr-x 2 root root 8192 Jan 23 15:10 BOOT
drwxr-xr-x 2 root root 8192 Mar 26 08:24 sles

/boot/efi/EFI/BOOT:
total 152
-rwxr-xr-x 1 root root 143360 Mar 26 08:24 bootx64.efi
-rwxr-xr-x 1 root root    128 Jan 23 15:10 grub.cfg

/boot/efi/EFI/sles:
total 3136
-rwxr-xr-x 1 root root  852408 Mar 26 08:24 MokManager.efi
-rwxr-xr-x 1 root root      50 Mar 26 08:24 boot.csv
-rwxr-xr-x 1 root root     120 Mar 26 08:24 grub.cfg
-rwxr-xr-x 1 root root 1222656 Mar 26 08:24 grub.efi
-rwxr-xr-x 1 root root  143360 Mar 26 08:24 grubx64.efi
-rwxr-xr-x 1 root root  953800 Mar 26 08:24 shim.efi



6- Install required patches:

sles-sap-12-sp5-gen2:~ # zypper patch



7- Reboot the instance and verify if all patches were applied:

sles-sap-12-sp5-gen2:~ # reboot 

sles-sap-12-sp5-gen2:~ # zypper patch



8- Start the SLES OS upgrade:

sles-sap-12-sp5-gen2:~ # zypper migration -v



Result:

sles-sap-12-sp5-gen2:~ # zypper migration -v 
.
.
dracut:  root=UUID=98dd41fd-30fc-4bb4-bcd0-ad816abb6621 rootfstype=xfs rootflags=rw,relatime,attr2,inode64,logbufs=8,logbsize=32k,noquota
dracut: *** Stripping files ***
dracut: *** Stripping files done ***
dracut: *** Creating image file '/boot/initrd-5.14.21-150500.55.52-default' ***
dracut: *** Creating initramfs image file '/boot/initrd-5.14.21-150500.55.52-default' done ***
CA enrolled. Skip /etc/uefi/certs/76B6A6A0.crt
done]
.
.



sles-sap-12-sp5-gen2:~ # echo $?
0