On 22/11/2022 at 07:10, Felix Miata wrote:
copying /boot/efi/EFI/debian/grubx64.efi to /boot/efi/EFI/BOOT/grubx64.efi and /boot/efi/EFI/BOOT/bootx64.efi and /boot/efi/EFI/BOOT/BOOTX64.EFI
It won't work if secure boot is enabled with default Microsoft's key only. You need to copy shimx64.efi (signed with Microsoft's key) as /boot/efi/EFI/BOOT/bootx64.efi, not grubx64.efi (signed with Debian's key).
Even better, which is what I've been doing for 4 years, if this machine will ever have multiple installations, edit the config responsible for the name of the UEFI boot entry, /etc/default/grub's GRUB_DISTRIBUTOR=`lsb_release -i -s 2> /dev/null || echo Debian` to read GRUB_DISTRIBUTOR="deb11homer" or any other unique GRUB_DISTRIBUTOR= string, so that each installation will have its own UEFI entry without risk of overwriting any other entry on the ESP or in NVRAM.
It won't work as expected if GRUB is installed for secure boot, which is the default (even if secure boot is disabled in UEFI settings). The GRUB signed image reads /EFI/debian/grub.cfg regardless of which /boot/efi/EFI/$GRUB_DISTRIBUTOR directory it was installed in.