Comment # 34 on bug 955493 from Raymund Will

Hi $reporter.

please accept the fact, that the bug you've found is *fixed*.

Your remaining trouble stems from a very unfortunate issue with
your firmware, namely forcefully removing our boot entries
on every reboot. This does *not* happen on (the vast majority of)
other machines.

Your work-around of using 'startup.nsh' is not supported (and can
IMHO not even be made "supportable") by us, but we do actually have
another one!

So, if you're still interested in solving the issue on your machine,
please follow these steps:
1. move your 'startup.nsh' out of the way, e.g. with
 # mv /boot/efi/{startup,kickit}.nsh
   (if you get dropped to the EFI shell you can simply run 'kickit'
   to get your system booted)
2. enable secure boot support on the *operating-system* side, e.g. with
 # perl -pi.b35 -e 's{^(SECURE_BOOT=)"no"}{$1"yes"}' /etc/sysconfig/bootloader
   and verify the change with
 # perl -ne 'm{^\s*[^#]+=} && print' /etc/sysconfig/bootloader
 LOADER_TYPE="grub2-efi"
 SECURE_BOOT="yes"
   and
 # diff -U0 /etc/sysconfig/bootloader{.b35,} | grep SECURE
 -SECURE_BOOT="no"
 +SECURE_BOOT="yes"
   IMPORTANT: please do *not* change anything in your firmware setup!
3. now you can deploy this change with
 # update-bootlader --reinit
 # update-bootloader --refresh


If step 2 didn't show the expected output you might want to use 'yast
bootloader' to (re-)establish proper settings with "Boot Loader" set
to 'GRUB2-EFI' and "Enable Secure Boot Support" *activated*.  Accepting
that change should actually cover step 3 as well.

4. reboot and tell us, whether that worked (or not).

Thanks.