Dear Maintainer,

Setting up a system with "Secure Boot! will prohibit
dynamically loading modules via insmod.

Grub implements the "Boot Loader Interface" with the
bli module. This for ex. allows locating and mounting
boot and esp partitions with systemd-gpt-auto-generator.

For that to work, it needs to be included in the binary,
I havent found a way to do this, I tried:

grub-install --modules=bli ..

Secure-Boot is common with x64, please bundle this module
by default.

Control: reassign -1 src:grub2

You cannot add modules to a signed image. grub-install will build an
unsigned core image embedding the specified modules, but when installing
for secure boot, it will use the monolithic signed image instead of the
resulting unsigned core image (yes, it's a waste).

grub-efi-amd64-signed does not build monolithic images, it just signs
the images provided by grub-efi-amd64-unsigned (and were previously
included in grub-efi-amd64-bin). The list of modules included in
monolithic images is defined in source package grub2, so reassigning
this bug.