This is an RFC whether it would be possible to include UEFI shell into
the debian installer media. I understand that it won't work with
SecureBoot, however under some obscure cases UEFI shell is the only (or
the easiest) way to perform some actions.

For example, on some of old Qualcomm-based laptops EFI vars are not
accessible or are read-only. Thus it is not possible to setup boot
configuration from the running Linux configuration. Being able to boot
to the shell allows us to fix such issues.

With the UEFI shell being available as the Debian package it should be
pretty simple to include it into the generated D-I media. Having it
under the Advanced / Export options would mean that it should not be
used by default, still providing a way to rescue some of the issues.

WDYT?

The menu entry can be hidden when secure boot is enabled.

Isn't it possible to work around this with grub-installer options
"install in the removable media path" and "do not update EFI boot
variables" ?

Source: debian-installer
Version: 20230607+deb12u6
Followup-For: Bug #1077635
X-Debbugs-Cc: Pascal Hambourg <pascal@plouf.fr.eu.org>

Yes

Not really. E.g. on Lenovo Miix 630 winldr gets selected even if
grub is installed in the removable media path. Moreover until DTB
loading issues get sorted out we have to manually modify EFI boot
entries after installing the DtbLoader.efi.