I rechecked 42_2. You are right. It is fixed there. Thanks for looking. Reclose if you want, now that I know what Tumbleweed still doesn't have the fix. Maybe shim should be split into two packages, with the signed file in one package and everything else in the other package.