Comment # 10 on bug 1209985 from Fabian Vogt

A colleage hit this exact issue after installing updates on a Lenovo laptop
running (only) Leap 15.4. No custom kernel. The last update installation
updated grub, but unless I somehow missed it in the zypp history, not shim.

With SB disabled, the system booted fine and I ran:

mokutil --set-verbosity true
mokutil --set-sbat-policy delete

This didn't fix it, MokManager hit the security violation as well, presumably
before doing anything.

I also cleared the EFI partition + bootorder and ran "shim-install" and
"shim-install --removable --no-nvram" for good measure, no difference.

For the time being SB had to be disabled.