Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
Since about 2 years i run my amd64 debian/bookworm with secureboot enabled.
Some time ago my PC could not boot anymore as the secureboot let not start
shimx64.efi anymore from by debian entry in UEFI.

   * What exactly did you do (or not do) that was effective (or
     ineffective)?
I disabled secureboot in my UEFI and it booted again. For about three month i
didnt care too much. Now i read about the bootkit.efi and i wanted to reenable
it.
Checked the sha1sums from the installed efi binaries in /boot/EFI/EFI/debian

sha1sum /boot/EFI/EFI/debian/shimx64.efi
3dd4abb9f7af061c1a7916f9c31f9e5d0be5558a  /boot/EFI/EFI/debian/shimx64.efi

This were the sha1sums from the installed shim-signed
sha1sum /usr/lib/shim/shimx64.efi*
b3ad049321cfbafe24ad16ba26cd38693ac4a34c  /usr/lib/shim/shimx64.efi
52f4735800ff01fb526a23e309a3bf3bf0d9b7b4  /usr/lib/shim/shimx64.efi.signed

At this stage i run grub-install (as root) and /boot/EFI/EFI/debian/shimx64.efi
had the same sha1sum as /usr/lib/shim/shimx64.efi.signed

   * What was the outcome of this action?
Booted again.

Now my question is: Is it intended that the efi binaries in
/boot/EFI/EFI/debian/ are not updated? Is this a bug or a feature? If there is
an update from shim-signed do i need to run grub-install manually or should it
update by the upgrade process?

Hi Georg,

This should all work automatically for you, assuming you have
appropriate packages installed.

Could you please run the following and show us the output?

$ dpkg -l 'grub*' 'shim*'

Please include the CC to the bug (1088696@bugs.debian.org) - I'm not
the only one who might help here.

Here is the requested information:
LANG="C" dpkg -l 'grub*' 'shim*' > /tmp/info.txt

The EFI partition mount point should be /boot/efi, not /boot/EFI.

Appropriate package are installed, otherwise manually running
grub-install [1] would not work.

shim-signed postinst script runs grub-install [2] only if
/boot/efi/EFI/$bootloader_id (default=debian) exists and is a directory.
If /boot is in a case-sensitive filesystem, /boot/EFI will not match.

[1] I was surprised that grub-install does not mind using /boot/EFI, but
indeed it tries /boot/EFI if /boot/efi does not exist or is not a directory.

[2] IMO running grub-install in shim-signed postinst script is wrong;
shim-signed should trigger the active boot loader instead because just
having grub-install present does not mean that grub-efi-amd64-signed is
the active boot loader. But this is another issue.

<https://salsa.debian.org/pham/shim-signed/-/commits/efidir_case/>
I can create a merge request if you are interested in supporting this
edge case.