Dear Maintainer,

   * What led up to the situation?

        Was attempting to uninstall grub after switching to systemd-boot
    and adding it via mokutil to the allowed binaries for shim-signed.

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

        Effective workaround after shim-signed got uninstalled and system
    could no longer boot Linux: Extracted the shim-signed bootloader from
    the .deb and manually copied the file back into place as a stopgap.

        Side effect of workaround:

        No automatic updates when updates to shim-signed is released, need
    to notice it + unpack the update manually.

   * What was the outcome of this action?

        Initially: System no longer booted to Linux successfully.

        Work stopgap workarond: System continues to boot with Secure Boot
    enabled without needing to juggle enrolling custom keys versus using
    the Microsoft keys.

   * What outcome did you expect instead?

        shim-signed to stay installed when uninstalling grub, as there's no
    direct requirement to pair it with grub, it just has the signatures for
    grub pre-registered.

Hello Wolf, maintainers,
(...)

I guess shim-signed depends on grub2-common and grub-efi-amd64-bin
packages because its postinst script calls grub-install to reinstall
GRUB+shim files in the EFI partition on install or update. So even if
the package dependency was removed and shim-signed could be installed
without grub*, shim files in the EFI partition still would not be updated.

I am not the maintainer, but here is my opinion on this topic:

Calling grub-install in shim-signed postinst script is messy and wrong.
- It duplicates code from grub-efi-amd64 postinst script and must be
kept in sync with it, e.g. to handle new debconf settings
(force-extra-removable, no-nvram...).
- Also it runs grub-install even if grub-efi-amd64 is not installed.

Wouldn't a dpkg trigger to run grub-efi-amd64 (or any other bootloader
using shim) postinst script on shim-signed update be a better option ?

The way
https://sources.debian.org/src/shim-signed/1.40/debian/shim-signed.postinst/
is written, I would also assume triggering grub installation would be
enough. Would it be possible to change that code? 

I am also a systemd-boot user and would like to finally remove grub, as
it introduces an unnecessary attack surface and wrongly overrides the
boot order on upgrade. This bug seems the last item blocking the
transition.

Cheerio,
Matteo