diff -pruN 2.14~git20250718.0e36779-1/debian/build-efi-images 2.14~git20250718.0e36779-1ubuntu4/debian/build-efi-images
--- 2.14~git20250718.0e36779-1/debian/build-efi-images	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/build-efi-images	2025-09-08 10:56:27.000000000 +0000
@@ -111,7 +111,6 @@ CD_MODULES="
 	ext2
 	fat
 	font
-	f2fs
 	gettext
 	gfxmenu
 	gfxterm
@@ -201,7 +200,6 @@ GRUB_MODULES="$CD_MODULES
 	gcry_twofish
 	gcry_whirlpool
 	luks
-	luks2
 	lvm
 	mdraid09
 	mdraid1x
@@ -251,15 +249,18 @@ echo "Including modules $NET_MODULES in
 # Special network boot image for d-i to use. Just the same as the
 # normal network boot image, but with a different value baked in for
 # the prefix setting
-echo "Including modules $NET_MODULES in $outdir/grubnet$efi_name-installer.efi"
-"$grub_mkimage" \
-    -O "$platform" \
-    -o "$outdir/grubnet$efi_name-installer.efi" \
-    -c "$workdir/grub-bootstrap.cfg" \
-    -d "$grub_core" \
-    -m "$workdir/memdisk-netboot.squashfs" \
-    -p "/${efi_vendor}-installer/$deb_arch/grub" \
-    --sbat "$sbat_csv" \
-    $NET_MODULES
+#
+# but not on Ubuntu LP: #1863994
+#
+#echo "Including modules $NET_MODULES in $outdir/grubnet$efi_name-installer.efi"
+#"$grub_mkimage" \
+#    -O "$platform" \
+#    -o "$outdir/grubnet$efi_name-installer.efi" \
+#    -c "$workdir/grub-bootstrap.cfg" \
+#    -d "$grub_core" \
+#    -m "$workdir/memdisk-netboot.squashfs" \
+#    -p "/${efi_vendor}-installer/$deb_arch/grub" \
+#    --sbat "$sbat_csv" \
+#    $NET_MODULES
 
 exit 0
diff -pruN 2.14~git20250718.0e36779-1/debian/canonical-uefi-ca.crt 2.14~git20250718.0e36779-1ubuntu4/debian/canonical-uefi-ca.crt
--- 2.14~git20250718.0e36779-1/debian/canonical-uefi-ca.crt	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/canonical-uefi-ca.crt	2025-08-19 13:14:06.000000000 +0000
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIENDCCAxygAwIBAgIJALlBJKAYLJJnMA0GCSqGSIb3DQEBCwUAMIGEMQswCQYD
+VQQGEwJHQjEUMBIGA1UECAwLSXNsZSBvZiBNYW4xEDAOBgNVBAcMB0RvdWdsYXMx
+FzAVBgNVBAoMDkNhbm9uaWNhbCBMdGQuMTQwMgYDVQQDDCtDYW5vbmljYWwgTHRk
+LiBNYXN0ZXIgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTEyMDQxMjExMTI1MVoX
+DTQyMDQxMTExMTI1MVowgYQxCzAJBgNVBAYTAkdCMRQwEgYDVQQIDAtJc2xlIG9m
+IE1hbjEQMA4GA1UEBwwHRG91Z2xhczEXMBUGA1UECgwOQ2Fub25pY2FsIEx0ZC4x
+NDAyBgNVBAMMK0Nhbm9uaWNhbCBMdGQuIE1hc3RlciBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC/WzoWdO4hXa5h
+7Z1WrL3e3nLz3X4tTGIPrMBtSAgRz42L+2EfJ8wRbtlVPTlU60A7sbvihTR5yvd7
+v7p6yBAtGX2tWc+m1OlOD9quUupMnpDOxpkNTmdleF350dU4Skp6j5OcfxqjhdvO
++ov3wqIhLZtUQTUQVxONbLwpBlBKfuqZqWinO8cHGzKeoBmHDnm7aJktfpNS5fbr
+yZv5K+24aEm82ZVQQFvFsnGq61xX3nH5QArdW6wehC1QGlLW4fNrbpBkT1u06yDk
+YRDaWvDq5ELXAcT+IR/ZucBUlUKBUnIfSWR6yGwk8QhwC02loDLRoBxXqE3jr6WO
+BQU+EEOhAgMBAAGjgaYwgaMwHQYDVR0OBBYEFK2RmQvCKrH1FwSMI7ZlWiaONFpj
+MB8GA1UdIwQYMBaAFK2RmQvCKrH1FwSMI7ZlWiaONFpjMA8GA1UdEwEB/wQFMAMB
+Af8wCwYDVR0PBAQDAgGGMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly93d3cuY2Fu
+b25pY2FsLmNvbS9zZWN1cmUtYm9vdC1tYXN0ZXItY2EuY3JsMA0GCSqGSIb3DQEB
+CwUAA4IBAQA/ffZ2pbODtCt60G1SGgODxBKnUJxHkszAlHeC0q5Xs5kE9TI6xlUd
+B9sSqVb62NR2IOvkw1Hbmlyckj8Yc9qUaqGZOIykiG3B/Dlx0HR2FgM+ViM11VVH
+WxodQcLTEkzc/64KkpxiChcBnHPgXrH9vNa1GRF6fs0+A35m21uoyTlIUf9T4Zwx
+U5EbOxB1Axe65oECgJRwTEa3lLA9Fc0fjgLgaAKP+/lHHX2iAcYHUcSazO3dz6Nd
+7ZK7vtH95uwfM1FzBL48crB9CPgB/5h9y5zgaTl3JUdxiLGNJ6UuqPc/X4Bplz6p
+9JkU284DDgtmxBxtvbgnd8FClL38agq8
+-----END CERTIFICATE-----
diff -pruN 2.14~git20250718.0e36779-1/debian/changelog 2.14~git20250718.0e36779-1ubuntu4/debian/changelog
--- 2.14~git20250718.0e36779-1/debian/changelog	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/changelog	2025-09-09 15:55:15.000000000 +0000
@@ -1,3 +1,110 @@
+grub2 (2.14~git20250718.0e36779-1ubuntu4) questing; urgency=medium
+
+  [ Tobias Heider ]
+  * Add Snapdragon quirk
+
+  [ Mate Kukri ]
+  * Do not attempt to load the bli module
+  * d/control: Re-add grub-common as dummy transitional package (LP: #2122124)
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Tue, 09 Sep 2025 16:55:15 +0100
+
+grub2 (2.14~git20250718.0e36779-1ubuntu3) questing; urgency=medium
+
+  * Fix upstream typo in bash-completion Makefile
+  * Bash-completions no longer live in one file, remove symlinks
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Tue, 19 Aug 2025 15:28:38 +0100
+
+grub2 (2.14~git20250718.0e36779-1ubuntu2) questing; urgency=medium
+
+  * Fup grub-common -> grub2-common merger in Ubuntu specific delta
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Wed, 13 Aug 2025 14:57:58 +0100
+
+grub2 (2.14~git20250718.0e36779-1ubuntu1) questing; urgency=medium
+
+  * Merge from Debian experimental; remaining changes:
+    - Add Ubuntu sbat data
+    - build-efi-images: do not produce -installer.efi.signed. LP #1863994
+    - grub-common: Install canonical-uefi-ca.crt
+    - Check signatures
+    - Support installing to multiple ESP (LP #1871821)
+    - Split out unsigned artefacts into grub2-unsigned
+    - Vcs-Git: Point to ubuntu packaging branch
+    - Relax dependencies on grub-common and grub2-common
+    - UBUNTU: Do not link grub-efi-*-unsigned docs to grub-common
+    - UBUNTU: Default timeout changes
+    - UBUNTU: Replace grub-install-extra-removable
+    - UBUNTU: Revert "Add jfs module to signed UEFI images. Closes: #950959"
+    - UBUNTU: Revert "Add f2fs module to signed UEFI images"
+    - UBUNTU: Drop luks2
+    - Install grub-initrd-fallback.service again
+    - Build using -O1 on s390x to avoid misoptimization
+    - grub-check-signatures: Support gzip compressed kernels
+    - forward port fix for LP #1926748
+    - Forward port the fix for LP #1930742 and make it conditional (xenial/bionic only)
+    - Build grub2-unsigned packages with xz compression
+    - Drop i386 from grub-efi-amd64*
+    - Turn depends on grub-efi-amd64/arm64 unversioned
+    - Install grub-sort-version
+    - rules: Add DPKG_BUILDPACKAGE_OPTIONS to generate-grub2-unsigned
+    - d/postinst.in: Make empty "grub-pc/install_devices" non-fatal in "noninteractive" mode
+    - Add debconf options "grub-{efi,pc}/cloud_style_installation"
+    - grub-common.service: Add After/Requires=boot-complete.target (LP #1992643)
+    - d/postinst.in: Remove upgrade check for GRUB version we can no longer upgrade from
+    - Disable ELF metadata injection
+    - Provide pre-built BIOS and IEEE1275 El-Torito images (LP #2086841)
+    - Removed patches:
+      + install-signed.patch with
+      + grub-install-extra-removable.patch
+      + grub-install-removable-shim.patch
+    - Added patches:
+      + ubuntu-install-signed.patch
+      + ubuntu-grub-install-extra-removable.patch
+      + ubuntu-zfs-enhance-support.patch
+      + ubuntu-zfs-mkconfig-ubuntu-recovery.patch
+      + ubuntu-zfs-mkconfig-ubuntu-distributor.patch
+      + ubuntu-zfs-mkconfig-signed-kernel.patch
+      + ubuntu-zfs-gfxpayload-keep-default.patch
+      + ubuntu-zfs-gfxpayload-dynamic.patch
+      + ubuntu-zfs-vt-handoff.patch
+      + ubuntu-zfs-mkconfig-recovery-title.patch
+      + ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch
+      + ubuntu-support-initrd-less-boot.patch
+      + ubuntu-shorter-version-info.patch
+      + ubuntu-add-initrd-less-boot-fallback.patch
+      + ubuntu-mkconfig-leave-breadcrumbs.patch
+      + ubuntu-fix-lzma-decompressor-objcopy.patch
+      + ubuntu-add-devicetree-command-support.patch
+      + ubuntu-boot-from-multipath-dependent-symlink.patch
+      + ubuntu-resilient-boot-ignore-alternative-esps.patch
+      + ubuntu-resilient-boot-boot-order.patch
+      + ubuntu-speed-zsys-history.patch
+      + ubuntu-dont-verify-loopback-images.patch
+      + ubuntu-recovery-dis_ucode_ldr.patch
+      + ubuntu-add-initrd-less-boot-messages.patch
+      + rhboot-f34-make-exit-take-a-return-code.patch
+      + rhboot-f34-dont-use-int-for-efi-status.patch
+      + suse-grub.texi-add-net_bootp6-document.patch
+      + ubuntu-verifiers-last.patch
+      + ubuntu-os-prober-auto.patch
+      + grub-sort-version.patch
+      + Revert-kern-ieee1275-init-ppc64-Display-upper_mem_limit-w.patch
+      + Revert-kern-ieee1275-init-ppc64-Fix-a-comment.patch
+      + Revert-kern-ieee1275-ieee1275-Display-successful-memory-c.patch
+      + Revert-loader-powerpc-ieee1275-Use-new-allocation-functio.patch
+      + Revert-kern-ieee1275-cmain-ppc64-Introduce-flags-to-ident.patch
+      + Revert-kern-ieee1275-init-ppc64-Rename-regions_claim-to-g.patch
+      + Revert-kern-ieee1275-init-ppc64-Add-support-for-alignment.patch
+      + Revert-kern-ieee1275-init-ppc64-Return-allocated-address-.patch
+      + Revert-kern-ieee1275-init-ppc64-Decide-by-request-whether.patch
+      + Revert-kern-ieee1275-init-ppc64-Introduce-a-request-for-r.patch
+      + grub-install-efi-title.patch
+  * Add grub.ubuntu26,1 SBAT entry to indicate upcoming LTS
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Tue, 12 Aug 2025 15:29:16 +0100
+
 grub2 (2.14~git20250718.0e36779-1) experimental; urgency=medium
 
   [ Mate Kukri ]
@@ -130,6 +237,201 @@ grub2 (2.12-6) unstable; urgency=medium
 
  -- Mate Kukri <mate.kukri@canonical.com>  Sat, 15 Feb 2025 17:17:14 +0000
 
+grub2 (2.12-5ubuntu12) questing; urgency=medium
+
+  * Rebuild against latest fuse3
+
+ -- Jeremy Bícha <jbicha@ubuntu.com>  Fri, 02 May 2025 09:11:09 -0400
+
+grub2 (2.12-5ubuntu11) plucky; urgency=medium
+
+  * Replace 4GB memory allocation limit fix (LP: #2106728)
+
+ -- Tobias Heider <tobias.heider@canonical.com>  Thu, 10 Apr 2025 15:23:50 +0200
+
+grub2 (2.12-5ubuntu10) plucky; urgency=medium
+
+  * Limit 4GB memory allocation to arm64 (LP: #2103864)
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Sat, 22 Mar 2025 16:09:04 +0000
+
+grub2 (2.12-5ubuntu9) plucky; urgency=medium
+
+  * Drop NTFS patches that seem to be causing regressions
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Mon, 17 Mar 2025 11:37:37 +0000
+
+grub2 (2.12-5ubuntu8) plucky; urgency=medium
+
+  * Cherry-pick upstream vulnerability fixes
+  * Cherry-pick extfs regression patch
+  * Cherry-pick xfs regression patches
+  * Bump SBAT level to grub,5
+  * {arm64,loongarch64,riscv64}: Limit memory allocations to 4GB
+  * SECURITY UPDATE: video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG
+    - CVE-2024-45774
+  * SECURITY UPDATE: commands/extcmd: Missing check for failed allocation
+    - CVE-2024-45775
+  * SECURITY UPDATE: gettext: Integer overflow leads to heap OOB write or read
+    - CVE-2024-45776
+  * SECURITY UPDATE: gettext: Integer overflow leads to heap OOB write
+    - CVE-2024-45777
+  * SECURITY UPDATE: fs/bfs: Integer overflow
+    - CVE-2024-45778
+  * SECURITY UPDATE: fs/bfs: integer overflow leads to heap OOB read
+    - CVE-2024-45779
+  * SECURITY UPDATE: fs/tar: Integer overflow leads to heap OOB write
+    - CVE-2024-45780
+  * SECURITY UPDATE: fs/ufs: `strcpy` use leading to heap OOB write
+    - CVE-2024-45781
+  * SECURITY UPDATE: fs/hfs: `strcpy` use leading to potential heap OOB write
+    - CVE-2024-45782
+  * SECURITY UPDATE: fs/hfsplus: incorrect refcount handling leading to UAF
+    - CVE-2024-45783
+  * SECURITY UPDATE: command/gpg: Use-after-free due to hooks not being removed on module unload
+    - CVE-2025-0622
+  * SECURITY UPDATE: net: Out-of-bounds write in grub_net_search_config_file()
+    - CVE-2025-0624
+  * SECURITY UPDATE: UFS: Integer overflow may lead to heap based out-of-bounds write when handling symlinks
+    - CVE-2025-0677
+  * SECURITY UPDATE: squash4: Integer overflow may lead to heap based out-of-bounds write when reading data
+    - CVE-2025-0678
+  * SECURITY UPDATE: reiserfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data
+    - CVE-2025-0684
+  * SECURITY UODATE: jfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data
+    - CVE-2025-0685
+  * SECURITY UPDATE: romfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data
+    - CVE-2025-0686
+  * SECURITY UPDATE: udf: Heap based buffer overflow  in grub_udf_read_block() may lead to arbitrary code execution
+    - CVE-2025-0689
+  * SECURITY UPDATE: read: Integer overflow may lead to out-of-bounds write
+    - CVE-2025-0690
+  * SECURITY UPDATE: commands/dump: The dump command is not in lockdown when secure boot is enabled
+    - CVE-2025-1118
+  * SECURITY UPDATE: fs/hfs: Integer overflow may lead to heap based out-of-bounds write
+    - CVE-2025-1125
+  * SECURITY UPDATE: insmod: incorrect refcount handling leading to UAF [LP: #2055835]
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Mon, 13 Jan 2025 10:51:59 +0000
+
+grub2 (2.12-5ubuntu7) plucky; urgency=medium
+
+  * Provide pre-built BIOS and IEEE1275 El-Torito images (LP: #2086841)
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Thu, 07 Nov 2024 11:53:40 +0000
+
+grub2 (2.12-5ubuntu5.1) oracular; urgency=medium
+
+  * riscv: use time register in grub_efi_get_time_ms() (LP: #2076651)
+  * Defer NX policy enforcement to shim (LP: #2084104)
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Fri, 11 Oct 2024 10:03:49 +0100
+
+grub2 (2.12-5ubuntu5) oracular; urgency=medium
+
+  * peimage: Fixup grub_error -> grub_dprintf
+  * peimage: Fixup section consistency checks (LP: #2078307)
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Fri, 30 Aug 2024 16:11:07 +0100
+
+grub2 (2.12-5ubuntu4) oracular; urgency=medium
+
+  * Merge from Debian unstable; remaining changes:
+    - Add Ubuntu sbat data
+    - build-efi-images: do not produce -installer.efi.signed. LP #1863994
+    - grub-common: Install canonical-uefi-ca.crt
+    - Check signatures
+    - Support installing to multiple ESP (LP #1871821)
+    - Split out unsigned artefacts into grub2-unsigned
+    - Vcs-Git: Point to ubuntu packaging branch
+    - Relax dependencies on grub-common and grub2-common
+    - UBUNTU: Do not link grub-efi-*-unsigned docs to grub-common
+    - UBUNTU: Default timeout changes
+    - UBUNTU: Replace grub-install-extra-removable
+    - UBUNTU: Revert "Add jfs module to signed UEFI images. Closes: #950959"
+    - UBUNTU: Revert "Add f2fs module to signed UEFI images"
+    - UBUNTU: Drop luks2
+    - Install grub-initrd-fallback.service again
+    - Build using -O1 on s390x to avoid misoptimization
+    - grub-check-signatures: Support gzip compressed kernels
+    - forward port fix for LP #1926748
+    - Forward port the fix for LP #1930742 and make it conditional (xenial/bionic only)
+    - Build grub2-unsigned packages with xz compression
+    - Drop i386 from grub-efi-amd64*
+    - Turn depends on grub-efi-amd64/arm64 unversioned
+    - Revert "Have -bin packages Break pre-2.12 -signed packages"
+    - Install grub-sort-version
+    - rules: Add DPKG_BUILDPACKAGE_OPTIONS to generate-grub2-unsigned
+    - d/postinst.in: Make empty "grub-pc/install_devices" non-fatal in "noninteractive" mode
+    - Add debconf options "grub-{efi,pc}/cloud_style_installation"
+    - grub-common.service: Add After/Requires=boot-complete.target (LP #1992643)
+    - d/postinst.in: Remove upgrade check for GRUB version we can no longer upgrade from
+    - Removed patches:
+      + install-signed.patch with
+      + grub-install-extra-removable.patch
+      + grub-install-removable-shim.patch
+    - Added patches:
+      + ubuntu-install-signed.patch
+      + ubuntu-grub-install-extra-removable.patch
+      + ubuntu-zfs-enhance-support.patch
+      + ubuntu-zfs-mkconfig-ubuntu-recovery.patch
+      + ubuntu-zfs-mkconfig-ubuntu-distributor.patch
+      + ubuntu-zfs-mkconfig-signed-kernel.patch
+      + ubuntu-zfs-gfxpayload-keep-default.patch
+      + ubuntu-zfs-gfxpayload-dynamic.patch
+      + ubuntu-zfs-vt-handoff.patch
+      + ubuntu-zfs-mkconfig-recovery-title.patch
+      + ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch
+      + ubuntu-support-initrd-less-boot.patch
+      + ubuntu-shorter-version-info.patch
+      + ubuntu-add-initrd-less-boot-fallback.patch
+      + ubuntu-mkconfig-leave-breadcrumbs.patch
+      + ubuntu-fix-lzma-decompressor-objcopy.patch
+      + ubuntu-add-devicetree-command-support.patch
+      + ubuntu-boot-from-multipath-dependent-symlink.patch
+      + ubuntu-resilient-boot-ignore-alternative-esps.patch
+      + ubuntu-resilient-boot-boot-order.patch
+      + ubuntu-speed-zsys-history.patch
+      + ubuntu-dont-verify-loopback-images.patch
+      + ubuntu-recovery-dis_ucode_ldr.patch
+      + ubuntu-add-initrd-less-boot-messages.patch
+      + rhboot-f34-make-exit-take-a-return-code.patch
+      + rhboot-f34-dont-use-int-for-efi-status.patch
+      + suse-grub.texi-add-net_bootp6-document.patch
+      + ubuntu-verifiers-last.patch
+      + ubuntu-os-prober-auto.patch
+      + grub-sort-version.patch
+      + Revert-kern-ieee1275-init-ppc64-Display-upper_mem_limit-w.patch
+      + Revert-kern-ieee1275-init-ppc64-Fix-a-comment.patch
+      + Revert-kern-ieee1275-ieee1275-Display-successful-memory-c.patch
+      + Revert-loader-powerpc-ieee1275-Use-new-allocation-functio.patch
+      + Revert-kern-ieee1275-cmain-ppc64-Introduce-flags-to-ident.patch
+      + Revert-kern-ieee1275-init-ppc64-Rename-regions_claim-to-g.patch
+      + Revert-kern-ieee1275-init-ppc64-Add-support-for-alignment.patch
+      + Revert-kern-ieee1275-init-ppc64-Return-allocated-address-.patch
+      + Revert-kern-ieee1275-init-ppc64-Decide-by-request-whether.patch
+      + Revert-kern-ieee1275-init-ppc64-Introduce-a-request-for-r.patch
+      + grub-install-efi-title.patch
+      + kern-efi-mm-Change-grub_efi_mm_add_regions-to-keep-track-.patch
+      + kern-efi-mm-Change-grub_efi_allocate_pages_real-to-call-s.patch
+      + kern-efi-mm-Detect-calls-to-grub_efi_drop_alloc-with-wron.patch
+      + nx/modules-strip-.llvm_addrsig-sections-and-similar.patch
+      + nx/modules-Don-t-allocate-space-for-non-allocable-sections.patch
+      + nx/modules-load-module-sections-at-page-aligned-addresses.patch
+      + nx/nx-add-memory-attribute-get-set-API.patch
+      + nx/nx-set-page-permissions-for-loaded-modules.patch
+      + nx/nx-set-the-nx-compatible-flag-in-EFI-grub-images.patch
+      + nx/efi-Disallow-fallback-to-legacy-Linux-loader-when-shim-sa.patch
+      + nx/peimage-Add-memory-attribute-support.patch
+      + commands-efi-tpm-Re-enable-measurements-on-confidential-c.patch
+      + loader-efi-fdt-Add-fdtdump-command-to-access-device-tree.patch
+  * Rebase d/legacy/update-grub.ubuntu.patch
+  * Move -unsigned binaries to the -unsigned sources
+  * efi/chainloader: Do not print device path (LP: #2073634)
+  * Disable ELF metadata injection
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Mon, 22 Jul 2024 10:55:04 +0100
+
 grub2 (2.12-5) unstable; urgency=medium
 
   * Build-Depend on pkgconf instead of pkg-config.
@@ -205,6 +507,149 @@ grub2 (2.12-2) unstable; urgency=medium
 
  -- Julian Andres Klode <jak@debian.org>  Fri, 05 Apr 2024 20:45:55 +0200
 
+grub2 (2.12-1ubuntu9) oracular; urgency=medium
+
+  * Cherry-pick upstream efi mm patches to avoid crashing at exit on Mu
+  * peimage: Improve section consistency checks, use grub_dprintf for errors
+  * peimage: Make sure partially loaded images are unloaded on error
+  * Implement support for UEFI NX mitigation
+  * Cherry-pick missing TDX measurements fix (LP: #2069232)
+  * grub-common.service: Add After/Requires=boot-complete.target (LP: #1992643)
+  * d/postinst.in: Remove upgrade check for GRUB version we can no longer upgrade from
+  * Cherry-pick fdtdump patch
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Wed, 19 Jun 2024 11:47:16 +0100
+
+grub2 (2.12-1ubuntu7) noble; urgency=medium
+
+  * d/p/grub-sort-version.patch: Also patch grub-mkconfig to export GRUB_FLAVOUR_ORDER
+  * d/grub-sort-version: Update regex to correctly match kernel flavour
+  * d/grub-sort-version: Append `-0` to abi strings before passing to python-apt (Fixes LP: #2041827)
+  * debian/: Add tests for grub-sort-version
+  * Revert peimage to re-use GRUB's image handle (LP: #2057679) (LP: #2054127)
+  * Increase SBAT level to "grub.ubuntu,2" and "grub.peimage,2"
+  * d/build-efi-images: Make sure downstream didn't remove peimage SBAT entry
+  * SECURITY UPDATE: Use-after-free in peimage module [LP: #2054127]
+    - CVE-2024-2312
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Thu, 04 Apr 2024 11:12:35 +0100
+
+grub2 (2.12-1ubuntu6) noble; urgency=medium
+
+  * No-change rebuild for CVE-2024-3094
+
+ -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 08:54:41 +0000
+
+grub2 (2.12-1ubuntu5) noble; urgency=medium
+
+  * No-change rebuild for libefivar1t64 on riscv64.
+
+ -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 07 Mar 2024 09:18:17 +0000
+
+grub2 (2.12-1ubuntu4) noble; urgency=medium
+
+  * d/grub-multi-install: Treat missing `cloud_style_installation` debconf as
+    false (LP: #2055294)
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Wed, 28 Feb 2024 15:55:10 +0000
+
+grub2 (2.12-1ubuntu3) noble; urgency=medium
+
+  * Improve GRUB reinstallation in cloud images (LP: #2054103):
+    - Add debconf options "grub-{efi,pc}/cloud_style_installation"
+    - d/postinst.in: Make empty "grub-pc/install_devices" non-fatal in
+      noninteractive mode
+  * Determine GRUB_DISTRIBUTOR from os-release and fall back to build-time
+    dpkg vendor (LP: #2034253)
+  * d/p/grub-install-efi-title.patch: Use case-sensitive GRUB distributor as
+    EFI option title (LP: #2026310)
+  * Unreleased changes from Debian:
+    - d/p/revert-term-ns8250-spcr.patch: Revert ACPI SPCR table support
+      (#1062073)
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Tue, 27 Feb 2024 10:54:26 +0000
+
+grub2 (2.12-1ubuntu2) noble; urgency=medium
+
+  * Revert patchset "ppc64: Restrict memory allocations" (LP: #2053117)
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Wed, 14 Feb 2024 09:19:35 +0000
+
+grub2 (2.12-1ubuntu1) noble; urgency=medium
+
+  * Merge from Debian unstable; remaining changes:
+    - Add Ubuntu sbat data
+    - build-efi-images: do not produce -installer.efi.signed. LP: 1863994
+    - grub-common: Install canonical-uefi-ca.crt
+    - Check signatures
+    - Support installing to multiple ESP (LP: 1871821)
+    - Disable various bits on i386
+    - Split out unsigned artefacts into grub2-unsigned
+    - Vcs-Git: Point to ubuntu packaging branch
+    - Relax dependencies on grub-common and grub2-common
+    - grub-pc: Avoid the possibility of breaking grub on SRU update due
+      to ABI change
+    - UBUNTU: Default timeout changes
+    - Revert "Add jfs module to signed UEFI images. Closes: #950959"
+    - Revert "Add f2fs module to signed UEFI images"
+    - Install grub-initrd-fallback.service again
+    - Build using -O1 on s390x to avoid misoptimization
+    - grub-check-signatures: Support gzip compressed kernels (LP: #1954683)
+    - grub-multi-install: Reset partition type between partitions (LP: #1997795)
+    - Drop i386 from grub-efi-amd64* (LP: #2020907)
+    - Turn depends on grub-efi-amd64/arm64 unversioned
+    - forward port fix for LP: #1926748
+    - Make the grub2/no_efi_extra_removable setting work correctly
+    - Forward port the fix for LP: #1930742 and make it conditional (xenial/bionic only)
+    - Build grub2-unsigned packages with xz compression
+    - Revert: "Have -bin packages Break pre-2.12 -signed packages.", this is not
+      compatible with our versioning schemes.
+    - Install a /usr/lib/grub/grub-sort-version and use that to sort versions as
+      it respects GRUB_FLAVOUR_ORDER. Depend on python3 to do so.
+    - rules: Add DPKG_BUILDPACKAGE_OPTIONS to generate-grub2-unsigned
+    - Drop luks2
+    - d/control: Add python3-apt to Depends of grub-common (LP: #2048953)
+    - Replaced patches:
+      - install-signed.patche
+      - grub-install-extra-removable.patch
+      - grub-install-removable-shim.patch
+    - Added patches:
+      + rhboot-f34-dont-use-int-for-efi-status.patch
+      + rhboot-f34-make-exit-take-a-return-code.patch
+      + suse-grub.texi-add-net_bootp6-document.patch
+      + ubuntu-add-devicetree-command-support.patch
+      + ubuntu-add-initrd-less-boot-fallback.patch
+      + ubuntu-add-initrd-less-boot-messages.patch
+      + ubuntu-boot-from-multipath-dependent-symlink.patch
+      + ubuntu-dont-verify-loopback-images.patch
+      + ubuntu-fix-lzma-decompressor-objcopy.patch
+      + ubuntu-grub-install-extra-removable.patch
+      + ubuntu-install-signed.patch
+      + ubuntu-mkconfig-leave-breadcrumbs.patch
+      + ubuntu-os-prober-auto.patch
+      + ubuntu-recovery-dis_ucode_ldr.patch
+      + ubuntu-resilient-boot-boot-order.patch
+      + ubuntu-resilient-boot-ignore-alternative-esps.patch
+      + ubuntu-shorter-version-info.patch
+      + ubuntu-speed-zsys-history.patch
+      + ubuntu-support-initrd-less-boot.patch
+      + ubuntu-verifiers-last.patch
+      + ubuntu-zfs-enhance-support.patch
+      + ubuntu-zfs-gfxpayload-dynamic.patch
+      + ubuntu-zfs-gfxpayload-keep-default.patch
+      + ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch
+      + ubuntu-zfs-mkconfig-recovery-title.patch
+      + ubuntu-zfs-mkconfig-signed-kernel.patch
+      + ubuntu-zfs-mkconfig-ubuntu-distributor.patch
+      + ubuntu-zfs-mkconfig-ubuntu-recovery.patch
+      + ubuntu-zfs-vt-handoff.patch
+  * Unreleased changes from Debian:
+    - Update signing-template Uploaders to match main package.
+    - d/p/mkconfig-ubuntu-recovery.patch: Use "recovery" instead of "single recovery"
+      for recovery mode bootparams (LP: #2041245)
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Mon, 29 Jan 2024 11:06:12 +0000
+
 grub2 (2.12-1) unstable; urgency=medium
 
   [ Mate Kukri ]
@@ -235,6 +680,99 @@ grub2 (2.12~rc1-13) unstable; urgency=me
 
  -- Julian Andres Klode <jak@debian.org>  Fri, 12 Jan 2024 19:00:41 +0100
 
+grub2 (2.12~rc1-12ubuntu5) noble; urgency=medium
+
+  * d/control: Add python3-apt to Depends of grub-common (LP: #2048953)
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Fri, 09 Feb 2024 13:23:36 +0000
+
+grub2 (2.12~rc1-12ubuntu4) noble; urgency=medium
+
+  * d/p/delay-copying-to-grubdir.patch: Move platdir path canonicalisation
+    after files were copied to grubdir. (LP: #2045944)
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Fri, 08 Dec 2023 09:22:22 +0000
+
+grub2 (2.12~rc1-12ubuntu3) noble; urgency=medium
+
+  * d/p/delay-copying-to-grubdir.patch: Improve grub-install robustness by
+    delaying the update of /boot after install device validation
+  * Remove workaround for LP: 1889556 (LP: #2043995)
+    - Was not needed since /boot rollback was introduced upstream
+    - Patch above ensures that this will not reoccur even if rollback fails
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Tue, 21 Nov 2023 15:35:55 +0000
+
+grub2 (2.12~rc1-12ubuntu2) noble; urgency=medium
+
+  * Merge from Debian unstable; remaining changes:
+    - Add Ubuntu sbat data
+    - build-efi-images: do not produce -installer.efi.signed. LP: 1863994
+    - grub-common: Install canonical-uefi-ca.crt
+    - Check signatures
+    - Support installing to multiple ESP (LP: 1871821)
+    - Disable various bits on i386
+    - Split out unsigned artefacts into grub2-unsigned
+    - Vcs-Git: Point to ubuntu packaging branch
+    - Relax dependencies on grub-common and grub2-common
+    - grub-pc: Avoid the possibility of breaking grub on SRU update due
+      to ABI change
+    - UBUNTU: Default timeout changes
+    - Revert "Add jfs module to signed UEFI images. Closes: #950959"
+    - Revert "Add f2fs module to signed UEFI images"
+    - Install grub-initrd-fallback.service again
+    - Build using -O1 on s390x to avoid misoptimization
+    - grub-check-signatures: Support gzip compressed kernels (LP: #1954683)
+    - grub-multi-install: Reset partition type between partitions (LP: #1997795)
+    - Drop i386 from grub-efi-amd64* (LP: #2020907)
+    - Turn depends on grub-efi-amd64/arm64 unversioned
+    - forward port fix for LP: #1926748
+    - Make the grub2/no_efi_extra_removable setting work correctly
+    - Forward port the fix for LP: #1930742 and make it conditional (xenial/bionic only)
+    - Build grub2-unsigned packages with xz compression
+    - Revert: "Have -bin packages Break pre-2.12 -signed packages.", this is not
+      compatible with our versioning schemes.
+    - Install a /usr/lib/grub/grub-sort-version and use that to sort versions as
+      it respects GRUB_FLAVOUR_ORDER. Depend on python3 to do so.
+    - rules: Add DPKG_BUILDPACKAGE_OPTIONS to generate-grub2-unsigned
+    - Replaced patches:
+      - installe-signed.patched
+      - grub-install-extra-removable.patch
+      - grub-install-removable-shim.patch
+    - Added patches:
+      + rhboot-f34-dont-use-int-for-efi-status.patch
+      + rhboot-f34-make-exit-take-a-return-code.patch
+      + suse-grub.texi-add-net_bootp6-document.patch
+      + ubuntu-add-devicetree-command-support.patch
+      + ubuntu-add-initrd-less-boot-fallback.patch
+      + ubuntu-add-initrd-less-boot-messages.patch
+      + ubuntu-boot-from-multipath-dependent-symlink.patch
+      + ubuntu-dont-verify-loopback-images.patch
+      + ubuntu-fix-lzma-decompressor-objcopy.patch
+      + ubuntu-grub-install-extra-removable.patch
+      + ubuntu-install-signed.patch
+      + ubuntu-mkconfig-leave-breadcrumbs.patch
+      + ubuntu-os-prober-auto.patch
+      + ubuntu-recovery-dis_ucode_ldr.patch
+      + ubuntu-resilient-boot-boot-order.patch
+      + ubuntu-resilient-boot-ignore-alternative-esps.patch
+      + ubuntu-shorter-version-info.patch
+      + ubuntu-speed-zsys-history.patch
+      + ubuntu-support-initrd-less-boot.patch
+      + ubuntu-verifiers-last.patch
+      + ubuntu-zfs-enhance-support.patch
+      + ubuntu-zfs-gfxpayload-dynamic.patch
+      + ubuntu-zfs-gfxpayload-keep-default.patch
+      + ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch
+      + ubuntu-zfs-mkconfig-recovery-title.patch
+      + ubuntu-zfs-mkconfig-signed-kernel.patch
+      + ubuntu-zfs-mkconfig-ubuntu-distributor.patch
+      + ubuntu-zfs-mkconfig-ubuntu-recovery.patch
+      + ubuntu-zfs-vt-handoff.patch
+  * Removed luks2 from signed EFI binaries (LP: #2043101)
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Thu, 09 Nov 2023 16:16:56 +0200
+
 grub2 (2.12~rc1-12) unstable; urgency=medium
 
   [ Mate Kukri ]
@@ -288,6 +826,108 @@ grub2 (2.12~rc1-11) unstable; urgency=me
 
  -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 02 Oct 2023 15:55:25 +0200
 
+grub2 (2.12~rc1-10ubuntu4) mantic; urgency=high
+
+  * SECURITY UPDATE: Crafted file system images can cause out-of-bounds write
+    and may leak sensitive information into the GRUB pager.
+    - d/patches/ntfs-cve-fixes/fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-
+      label.patch:
+      fs/ntfs: Fix an OOB read when parsing a volume label
+    - d/patches/ntfs-cve-fixes/fs-ntfs-Fix-an-OOB-read-when-parsing-bs-for-
+      index-at.patch:
+      fs/ntfs: Fix an OOB read when parsing bitmaps for index attributes
+    - d/patches/ntfs-cve-fixes/fs-ntfs-Fix-an-OOB-read-when-parsing-dory-
+      entries-fr.patch:
+      fs/ntfs: Fix an OOB read when parsing directory entries from resident and
+      non-resident index attributes
+    - d/patches/ntfs-cve-fixes/fs-ntfs-Fix-an-OOB-read-when-reading-data-fhe-
+      reside.patch:
+      fs/ntfs: Fix an OOB read when reading data from the resident $DATA +
+      attribute
+    - CVE-2023-4693
+  * SECURITY UPDATE: Crafted file system images can cause heap-based buffer
+    overflow and may allow arbitrary code execution and secure boot bypass.
+    - d/patches/ntfs-cve-fixes/fs-ntfs-Fix-an-OOB-write-when-parsing-the-
+      ATTRIBUTE_LIST-.patch:
+      fs/ntfs: Fix an OOB write when parsing the $ATTRIBUTE_LIST attribute for
+      the $MFT file
+    - d/patches/ntfs-cve-fixes/fs-ntfs-Make-code-more-readable.patch
+      fs/ntfs: Make code more readable
+    - CVE-2023-4692
+
+ -- Mate Kukri <mate.kukri@canonical.com>  Mon, 02 Oct 2023 15:23:58 +0100
+
+grub2 (2.12~rc1-10ubuntu2) mantic; urgency=medium
+
+  * Merge from Debian unstable to pick up fixes (LP: #2028947); remaining changes:
+    - Add Ubuntu sbat data
+    - build-efi-images: do not produce -installer.efi.signed. LP: 1863994
+    - grub-common: Install canonical-uefi-ca.crt
+    - Check signatures
+    - Support installing to multiple ESP (LP: 1871821)
+    - Disable various bits on i386
+    - Split out unsigned artefacts into grub2-unsigned
+    - Vcs-Git: Point to ubuntu packaging branch
+    - Relax dependencies on grub-common and grub2-common
+    - grub-pc: Avoid the possibility of breaking grub on SRU update due
+      to ABI change
+    - UBUNTU: Default timeout changes
+    - Revert "Add jfs module to signed UEFI images. Closes: #950959"
+    - Revert "Add f2fs module to signed UEFI images"
+    - Install grub-initrd-fallback.service again
+    - Build using -O1 on s390x to avoid misoptimization
+    - grub-check-signatures: Support gzip compressed kernels (LP: #1954683)
+    - grub-multi-install: Reset partition type between partitions (LP: #1997795)
+    - Drop i386 from grub-efi-amd64* (LP: #2020907)
+    - Turn depends on grub-efi-amd64/arm64 unversioned
+    - forward port fix for LP: #1926748
+    - Make the grub2/no_efi_extra_removable setting work correctly
+    - Forward port the fix for LP: #1930742 and make it conditional (xenial/bionic only)
+    - Build grub2-unsigned packages with xz compression
+    - Replaced patches:
+      - installe-signed.patched
+      - grub-install-extra-removable.patch
+      - grub-install-removable-shim.patch
+    - Added patches:
+      + rhboot-f34-dont-use-int-for-efi-status.patch
+      + rhboot-f34-make-exit-take-a-return-code.patch
+      + suse-grub.texi-add-net_bootp6-document.patch
+      + ubuntu-add-devicetree-command-support.patch
+      + ubuntu-add-initrd-less-boot-fallback.patch
+      + ubuntu-add-initrd-less-boot-messages.patch
+      + ubuntu-boot-from-multipath-dependent-symlink.patch
+      + ubuntu-dont-verify-loopback-images.patch
+      + ubuntu-fix-lzma-decompressor-objcopy.patch
+      + ubuntu-grub-install-extra-removable.patch
+      + ubuntu-install-signed.patch
+      + ubuntu-mkconfig-leave-breadcrumbs.patch
+      + ubuntu-os-prober-auto.patch
+      + ubuntu-recovery-dis_ucode_ldr.patch
+      + ubuntu-resilient-boot-boot-order.patch
+      + ubuntu-resilient-boot-ignore-alternative-esps.patch
+      + ubuntu-shorter-version-info.patch
+      + ubuntu-speed-zsys-history.patch
+      + ubuntu-support-initrd-less-boot.patch
+      + ubuntu-verifiers-last.patch
+      + ubuntu-zfs-enhance-support.patch
+      + ubuntu-zfs-gfxpayload-dynamic.patch
+      + ubuntu-zfs-gfxpayload-keep-default.patch
+      + ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch
+      + ubuntu-zfs-mkconfig-recovery-title.patch
+      + ubuntu-zfs-mkconfig-signed-kernel.patch
+      + ubuntu-zfs-mkconfig-ubuntu-distributor.patch
+      + ubuntu-zfs-mkconfig-ubuntu-recovery.patch
+      + ubuntu-zfs-vt-handoff.patch
+  * Dropped Ubuntu changes:
+    - Temporarily rmmod peimage for os-prober chainloader entries (LP: #2030810)
+  * Revert: "Have -bin packages Break pre-2.12 -signed packages.", this is not
+    compatible with our versioning schemes.
+  * Install a /usr/lib/grub/grub-sort-version and use that to sort versions as
+    it respects GRUB_FLAVOUR_ORDER. Depend on python3 to do so.
+  * rules: Add DPKG_BUILDPACKAGE_OPTIONS to generate-grub2-unsigned
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 25 Sep 2023 17:31:09 +0200
+
 grub2 (2.12~rc1-10) unstable; urgency=medium
 
   [ Julian Andres Klode ]
@@ -348,6 +988,165 @@ grub2 (2.12~rc1-5) experimental; urgency
 
  -- Julian Andres Klode <jak@debian.org>  Mon, 04 Sep 2023 14:16:12 +0200
 
+grub2 (2.12~rc1-4ubuntu3) mantic; urgency=medium
+
+  * zfs: Drop `set -u`, incompatible with undefined variables in library
+    (LP: #2033256)
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Tue, 29 Aug 2023 16:03:49 +0200
+
+grub2 (2.12~rc1-4ubuntu2) mantic; urgency=medium
+
+  * ubuntu-zfs-enhance-support.patch: Adjustments for 2.12 library
+    (LP: #2029260)
+  * zfs: on_exit: Unmount ${MNTDIR}/boot before ${MNTDIR} (LP: #2031042)
+  * Temporarily rmmod peimage for os-prober chainloader entries (LP: #2030810)
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 21 Aug 2023 14:26:07 +0200
+
+grub2 (2.12~rc1-4ubuntu1) mantic; urgency=medium
+
+  * Merge from Debian unstable (LP: #2028947); remaining changes:
+    - Add Ubuntu sbat data
+    - build-efi-images: do not produce -installer.efi.signed. LP: 1863994
+    - grub-common: Install canonical-uefi-ca.crt
+    - Check signatures
+    - Support installing to multiple ESP (LP: 1871821)
+    - Disable various bits on i386
+    - Split out unsigned artefacts into grub2-unsigned
+    - Vcs-Git: Point to ubuntu packaging branch
+    - Relax dependencies on grub-common and grub2-common
+    - grub-pc: Avoid the possibility of breaking grub on SRU update due
+      to ABI change
+    - UBUNTU: Default timeout changes
+    - Revert "Add jfs module to signed UEFI images. Closes: #950959"
+    - Revert "Add f2fs module to signed UEFI images"
+    - Install grub-initrd-fallback.service again
+    - Build using -O1 on s390x to avoid misoptimization
+    - grub-check-signatures: Support gzip compressed kernels (LP: #1954683)
+    - grub-multi-install: Reset partition type between partitions (LP: #1997795)
+    - Drop i386 from grub-efi-amd64* (LP: #2020907)
+    - Turn depends on grub-efi-amd64/arm64 unversioned
+    - forward port fix for LP: #1926748
+    - Make the grub2/no_efi_extra_removable setting work correctly
+    - Forward port the fix for LP: #1930742 and make it conditional (xenial/bionic only)
+    - Build grub2-unsigned packages with xz compression
+    - Replaced patches:
+      - installe-signed.patched
+      - grub-install-extra-removable.patch
+      - grub-install-removable-shim.patch
+    - Added patches:
+      + rhboot-f34-dont-use-int-for-efi-status.patch
+      + rhboot-f34-make-exit-take-a-return-code.patch
+      + suse-grub.texi-add-net_bootp6-document.patch
+      + ubuntu-add-devicetree-command-support.patch
+      + ubuntu-add-initrd-less-boot-fallback.patch
+      + ubuntu-add-initrd-less-boot-messages.patch
+      + ubuntu-boot-from-multipath-dependent-symlink.patch
+      + ubuntu-dont-verify-loopback-images.patch
+      + ubuntu-fix-lzma-decompressor-objcopy.patch
+      + ubuntu-grub-install-extra-removable.patch
+      + ubuntu-install-signed.patch
+      + ubuntu-mkconfig-leave-breadcrumbs.patch
+      + ubuntu-os-prober-auto.patch
+      + ubuntu-recovery-dis_ucode_ldr.patch
+      + ubuntu-resilient-boot-boot-order.patch
+      + ubuntu-resilient-boot-ignore-alternative-esps.patch
+      + ubuntu-shorter-version-info.patch
+      + ubuntu-speed-zsys-history.patch
+      + ubuntu-support-initrd-less-boot.patch
+      + ubuntu-verifiers-last.patch
+      + ubuntu-zfs-enhance-support.patch
+      + ubuntu-zfs-gfxpayload-dynamic.patch
+      + ubuntu-zfs-gfxpayload-keep-default.patch
+      + ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch
+      + ubuntu-zfs-mkconfig-recovery-title.patch
+      + ubuntu-zfs-mkconfig-signed-kernel.patch
+      + ubuntu-zfs-mkconfig-ubuntu-distributor.patch
+      + ubuntu-zfs-mkconfig-ubuntu-recovery.patch
+      + ubuntu-zfs-vt-handoff.patch
+  * Dropped Ubuntu changes:
+    - All the rhboot loader patches
+    - Temporarily, support for GRUB_FLAVOUR_ORDER
+    - RISC-V patches, applied upstream:
+      + efi-add-definition-of-LoadFile2-protocol.patch
+      + efi-correct-struct-grub_efi_boot_services.patch
+      + efi-implemented-LoadFile2-initrd-loading-protocol-fo.patch
+      + efi-implement-grub_efi_run_image.patch
+      + RISC-V-Update-image-header.patch
+      + RISC-V-Use-common-linux-loader.patch
+      + riscv-adjust-march-flags-for-binutils-2.38.patch
+      + upstream/riscv-handle-r-riscv-call-plt-reloc.patch
+      + loader-drop-argv-argument-in-grub_initrd_load.patch
+      + loader-Move-arm64-linux-loader-to-common-code.patch
+    - Networking patches (rebasing still WIP):
+      + cherrypick-efi-grub_efi_close_protocol.patch
+      + cherrypick-efinet-correct-closing-snp-protocol.patch
+      + efinet-uefi-ipv6-pxe-support.patch
+      + suse-add-support-for-UEFI-network-protocols.patch
+      + suse-AUDIT-0-http-boot-tracker-bug.patch
+    - Red Hat boot loader, replaced by upstream:
+      + linuxefi-do-not-validate-kernels-twice.patch
+      + linuxefi-Invalidate-i-cache-before-starting-the-kern.patch
+      + rhboot-bounce-buffers.patch
+      + rhboot-efi-allocate-in-kernel-bounds.patch
+      + rhboot-efi-allocate-kernel-as-code-for-real.patch
+      + rhboot-efi-allocate-kernel-as-code.patch
+      + rhboot-efi-enumerated-array-for-allocation-choice.patch
+      + rhboot-efi-fix-incorrect-array-size.patch
+      + rhboot-efi-initrd-above-4gb.patch
+      + rhboot-efi-kernel-allocator.patch
+      + rhboot-efi-rearrange-grub-cmd-linux.patch
+      + rhboot-efi-split-allocation-policy.patch
+      + rhboot-f34-efinet-also-use-the-firmware-acceleration-for-http.patch
+      + rhboot-f34-make-pmtimer-tsc-calibration-fast.patch
+      + rhboot-try-to-pick-better-locations-for-kernel-and-initrd.patch
+      + ubuntu-linuxefi-arm64.patch
+      + ubuntu-linuxefi-arm64-set-base-addr.patch
+      + ubuntu-linuxefi.patch
+      + ubuntu-rhboot-cast-fixups.patch
+      + ubuntu-efi-allow-loopmount-chainload.patch
+      + ubuntu-efi-loader-code.patch
+    - Security patches, applied upstream:
+      + {0076...0161} security patches, applied upstream
+      + font-*.patchi - security patches applied upstream
+      + commands-efi-tpm-Use-grub_strcpy-instead-of-grub_memcpy.patch
+      + fbutil-Fix-integer-overflow.patch
+      + kern-efi-sb-Enforce-verification-of-font-files.patch
+      + normal-charset-Fix-an-integer-overflow-in-grub_unicode_ag.patch
+    - Misc patches, merged in Debian:
+      + efi-EFI-Device-Tree-Fixup-Protocol.patch
+      + efivar-check-that-efivarfs-is-writeable.patch
+      + fat-fix-listing-the-root-directory.patch
+      + fdt-add-debug-output-to-devicetree-command.patch
+      + zstd-require-8-byte-buffer.patch
+      + 0241-Call-hwmatch-only-on-the-grub-pc-platform.patch
+    - Misc patches applied upstream:
+      + 2.12-mm/* - applied upstream
+      + ubuntu-fuse3.patch
+      + xfs-fix-v4-superblock.patch
+      + tpm-unknown-error-non-fatal.patch
+      + commands-efi-tpm-Refine-the-status-of-log-event.patch
+      + efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch
+      + linux_xen-Properly-load-multiple-initrd-files.patch
+      + linux_xen-Properly-order-multiple-initrd-files.patch
+      + linux-ignore-FDT-unless-we-need-to-modify-it.patch
+      + mkrescue-efi-modules.patch
+      + tests-ahci-update-qemu-device-name.patch
+    - No longer relevant:
+      + ubuntu-disable-LOAD-FILE2-protocol-for-initrd-on-ARM.patch
+      + ubuntu-temp-keep-auto-nvram.patch: was temporary in 2019 lol
+      + ubuntu-skip-disk-by-id-lvm-pvm-uuid-entries.patch
+      + no-devicetree-if-secure-boot.patch
+      + no-insmod-on-sb.patch
+    - To be rewritten later in this cycle:
+      + ubuntu-flavour-order.patch
+    - Coalesced into some other patches:
+      + ubuntu-zfs-maybe-quiet.patch
+      + ubuntu-zfs-quick-boot.patch
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Fri, 28 Jul 2023 15:34:32 +0200
+
 grub2 (2.12~rc1-4) experimental; urgency=medium
 
   [ Julian Andres Klode ]
@@ -722,6 +1521,385 @@ grub2 (2.06-3) unstable; urgency=medium
 
  -- Julian Andres Klode <jak@debian.org>  Fri, 10 Jun 2022 11:15:11 +0200
 
+grub2 (2.06-2ubuntu18) mantic; urgency=medium
+
+  * Cherry-pick "RISC-V: Handle R_RISCV_CALL_PLT reloc" (LP: #2022379)
+  * Drop i386 from grub-efi-amd64* (LP: #2020907)
+  * Turn depends on grub-efi-amd64/arm64 unversioned
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 05 Jun 2023 18:55:05 +0200
+
+grub2 (2.06-2ubuntu17) lunar; urgency=medium
+
+  * Cherry-pick more upstream memory patches (LP: #2004643)
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 20 Feb 2023 17:24:10 +0100
+
+grub2 (2.06-2ubuntu16) lunar; urgency=medium
+
+  * Cherry-pick all memory patches from rhboot
+    - Allocate initrd > 4 GB (LP: #1842320)
+    - Allocate kernels as code, not data (needed for newer firmware)
+  * ubuntu: Fix casts on i386-efi target
+  * Cherry-pick all the 2.12 memory management changes (LP: #1842320)
+  * Allocate executables as CODE, not DATA in chainloader and arm64
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Fri, 09 Dec 2022 17:11:44 +0100
+
+grub2 (2.06-2ubuntu15) lunar; urgency=medium
+
+  * grub-multi-install: Reset partition type between partitions (LP: #1997795)
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 01 Dec 2022 16:30:53 +0100
+
+grub2 (2.06-2ubuntu14) kinetic; urgency=medium
+
+  * SECURITY UPDATE: Fix out of bounds writes due specially crafted fonts.
+    - add debian/patches/font-Fix-several-integer-overflows-in-grub_font_construct.patch
+    - add debian/patches/font-Fix-an-integer-underflow-in-blit_comb.patch
+    - CVE-2022-2601, CVE-2022-3775
+    - LP: #1996950
+  * Fix various issues as a result of fuzzing, static analysis and code
+    review:
+    - add debian/patches/font-Reject-glyphs-exceeds-font-max_glyph_width-or-font-m.patch
+    - add debian/patches/font-Fix-size-overflow-in-grub_font_get_glyph_internal.patch
+    - add debian/patchces/font-Remove-grub_font_dup_glyph.patch
+    - add debian/patches/font-Fix-integer-overflow-in-ensure_comb_space.patch
+    - add debian/patches/font-Fix-integer-overflow-in-BMP-index.patch
+    - add debian/patches/font-Fix-integer-underflow-in-binary-search-of-char-index.patch
+    - add debian/patches/fbutil-Fix-integer-overflow.patch
+    - add debian/patches/font-Harden-grub_font_blit_glyph-and-grub_font_blit_glyph.patch
+    - add debian/patches/font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
+    - add debian/patches/normal-charset-Fix-an-integer-overflow-in-grub_unicode_ag.patch
+  * Enforce verification of fonts when secure boot is enabled:
+    - add debian/patches/kern-efi-sb-Enforce-verification-of-font-files.patch
+  * Bundle unicode.pf2 in a squashfs memdisk attached to the signed EFI binary
+    - update debian/control
+    - update debian/build-efi-image
+    - add debian/patches/font-Try-opening-fonts-from-the-bundled-memdisk.patch
+  * Fix LP: #1997006 - add support for performing measurements to RTMRs
+    - add debian/patches/commands-efi-tpm-Refine-the-status-of-log-event.patch
+    - add debian/patches/commands-efi-tpm-Use-grub_strcpy-instead-of-grub_memcpy.patch
+    - add debian/patches/efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch
+  * Fix the squashfs tests during the build
+    - remove debian/patches/ubuntu-fix-reproducible-squashfs-test.patch
+    - add debian/patches/tests-Explicitly-unset-SOURCE_DATE_EPOCH-before-running-f.patch
+  * Bump SBAT generation:
+    - update debian/sbat.ubuntu.csv.in
+
+ -- Chris Coulson <chris.coulson@canonical.com>  Wed, 16 Nov 2022 14:40:42 +0000
+
+grub2 (2.06-2ubuntu13) kinetic; urgency=medium
+
+  * Try to pick better locations for kernel and initrd (LP: #1989446)
+  * x86-efi: Use bounce buffers for reading to addresses > 4GB (enhances
+    firmware compatibility of previous change)
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 20 Oct 2022 21:18:25 +0200
+
+grub2 (2.06-2ubuntu12) kinetic; urgency=medium
+
+  * ubuntu-zfs-enhance-support.patch: Fix missing lines (LP: #1990143)
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 19 Sep 2022 16:00:47 +0200
+
+grub2 (2.06-2ubuntu11) kinetic; urgency=medium
+
+  [ Mauricio Faria de Oliveira ]
+  * linux_xen: Properly handle multiple initrd files (LP: #1987567)
+    - d/p/linux_xen-Properly-load-multiple-initrd-files.patch
+    - d/p/linux_xen-Properly-order-multiple-initrd-files.patch
+  * Fix for ZFS snapshots without etc directory.
+    Thanks to Adam R Bell <a_0x07@protonmail.ch> (LP: #1965983)
+
+  [ Heinrich Schuchardt ]
+  * efi/peimage: fix typos in code comments
+
+  [ dann frazier ]
+  * linuxefi: Invalidate i-cache before starting the kernel (LP: #1987924)
+    - d/p/linuxefi-Invalidate-i-cache-before-starting-the-kern.patch
+
+ -- dann frazier <dannf@ubuntu.com>  Wed, 14 Sep 2022 12:35:29 -0600
+
+grub2 (2.06-2ubuntu10) kinetic; urgency=medium
+
+  [ Chris Coulson ]
+  * SECURITY UPDATE: Crafted PNG grayscale images may lead to out-of-bounds
+    write in heap.
+    - 0139-video-readers-png-Drop-greyscale-support-to-fix-heap.patch:
+      video/readers/png: Drop greyscale support to fix heap out-of-bounds write
+    - CVE-2021-3695
+  * SECURITY UPDATE: Crafted PNG image may lead to out-of-bound write during
+    huffman table handling.
+    - 0140-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch:
+      video/readers/png: Avoid heap OOB R/W inserting huff table items
+    - CVE-2021-3696
+  * SECURITY UPDATE: Crafted JPEG image can lead to buffer underflow write in
+    the heap.
+    - 0145-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch:
+      video/readers/jpeg: Block int underflow -> wild pointer write
+    - CVE-2021-3697
+  * SECURITY UPDATE: Integer underflow in grub_net_recv_ip4_packets
+    - 0148-net-ip-Do-IP-fragment-maths-safely.patch: net/ip: Do IP fragment
+      maths safely
+    - CVE-2022-28733
+  * SECURITY UPDATE: Out-of-bounds write when handling split HTTP headers
+    - 0154-net-http-Fix-OOB-write-for-split-http-headers.patch: net/http: Fix
+      OOB write for split http headers
+    - CVE-2022-28734
+  * SECURITY UPDATE: shim_lock verifier allows non-kernel files to be loaded
+    - 0135-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch:
+      kern/efi/sb: Reject non-kernel files in the shim_lock verifier
+    - CVE-2022-28735
+  * SECURITY UPDATE: use-after-free in grub_cmd_chainloader()
+    - 0130-loader-efi-chainloader-simplify-the-loader-state.patch:
+      loader/efi/chainloader: simplify the loader state
+    - 0131-commands-boot-Add-API-to-pass-context-to-loader.patch: commands/boot:
+      Add API to pass context to loader
+    - 0132-loader-efi-chainloader-Use-grub_loader_set_ex.patch:
+      loader/efi/chainloader: Use grub_loader_set_ex
+    - 0133-loader-i386-efi-linux-Use-grub_loader_set_ex.patch:
+      loader/i386/efi/linux: Use grub_loader_set_ex
+  * Various fixes as a result of fuzzing and static analysis:
+    - 0129-loader-efi-chainloader-grub_load_and_start_image-doe.patch:
+      loader/efi/chainloader: grub_load_and_start_image doesn't load and start
+    - 0134-loader-i386-efi-linux-Fix-a-memory-leak-in-the-initr.patch:
+      loader/i386/efi/linux: Fix a memory leak in the initrd command
+    - 0136-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch:
+      kern/file: Do not leak device_name on error in grub_file_open()
+    - 0137-video-readers-png-Abort-sooner-if-a-read-operation-f.patch:
+      video/readers/png: Abort sooner if a read operation fails
+    - 0138-video-readers-png-Refuse-to-handle-multiple-image-he.patch:
+      video/readers/png: Refuse to handle multiple image headers
+    - 0141-video-readers-png-Sanity-check-some-huffman-codes.patch:
+      video/readers/png: Sanity check some huffman codes
+    - 0142-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch:
+      video/readers/jpeg: Abort sooner if a read operation fails
+    - 0143-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch:
+      video/readers/jpeg: Do not reallocate a given huff table
+    - 0144-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch:
+      video/readers/jpeg: Refuse to handle multiple start of streams
+    - 0146-normal-charset-Fix-array-out-of-bounds-formatting-un.patch:
+      normal/charset: Fix array out-of-bounds formatting unicode for display
+    - 0147-net-netbuff-Block-overly-large-netbuff-allocs.patch:
+      net/netbuff: Block overly large netbuff allocs
+    - 0149-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch:
+      net/dns: Fix double-free addresses on corrupt DNS response
+    - 0150-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch:
+      net/dns: Don't read past the end of the string we're checking against
+    - 0151-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch:
+      net/tftp: Prevent a UAF and double-free from a failed seek
+    - 0152-net-tftp-Avoid-a-trivial-UAF.patch: net/tftp: Avoid a trivial UAF
+    - 0153-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch:
+      net/http: Do not tear down socket if it's already been torn down
+    - 0155-net-http-Error-out-on-headers-with-LF-without-CR.patch:
+      net/http: Error out on headers with LF without CR
+    - 0156-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch:
+      fs/f2fs: Do not read past the end of nat journal entries
+    - 0157-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch:
+      fs/f2fs: Do not read past the end of nat bitmap
+    - 0158-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch:
+      fs/f2fs: Do not copy file names that are too long
+    - 0159-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch:
+      fs/btrfs: Fix several fuzz issues with invalid dir item sizing
+    - 0160-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch:
+      fs/btrfs: Fix more ASAN and SEGV issues found with fuzzing
+    - 0161-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch:
+      fs/btrfs: Fix more fuzz issues related to chunks
+  * Bump SBAT generation:
+    - update debian/sbat.ubuntu.csv.in
+  * Make the grub2/no_efi_extra_removable setting work correctly
+    - update debian/postinst.in
+  * Build grub2-unsigned packages with xz compression for compatibility
+    with xenial dpkg
+    - update debian/rules
+
+  [ Steve Langasek ]
+  * Bump versioned dependency on grub2-common to 2.02~beta2-36ubuntu3.32 for
+    necessary arm relocation support.  LP: #1926748.
+  * debian/postinst.in: Unconditionally call grub-install with
+    --force-extra-removable on xenial and bionic, so that the \EFI\BOOT
+    removable path as used in cloud images receives the updates.  LP: #1930742.
+
+ -- Chris Coulson <chris.coulson@canonical.com>  Tue, 07 Jun 2022 17:36:27 +0100
+
+grub2 (2.06-2ubuntu7) jammy; urgency=medium
+
+  [ Heinrich Schuchardt ]
+  * Disable LOAD FILE2 protocol for initrd on ARM (LP: #1967562)
+
+ -- dann frazier <dannf@ubuntu.com>  Fri, 15 Apr 2022 15:50:11 -0600
+
+grub2 (2.06-2ubuntu6) jammy; urgency=medium
+
+  [ Heinrich Schuchardt ]
+  * efivar: check that efivarfs is writeable (LP: #1965288)
+
+  [ Dimitri John Ledkov ]
+  * Do not validate kernels twice. (LP: #1964943)
+
+  [ Heinrich Schuchardt ]
+  * efi: EFI Device Tree Fixup Protocol (LP: #1965796)
+  * fdt: add debug output to devicetree command
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Fri, 25 Mar 2022 16:03:11 +0100
+
+grub2 (2.06-2ubuntu5) jammy; urgency=medium
+
+  [ Julian Andres Klode ]
+  * Free correct size when freeing params, rather than 16 Ki (LP: #1958623)
+  * Build with FUSE3 (LP: #1935659)
+  * Only run os-prober on first run and if it previously found other OS
+    (LP: #1955109)
+
+  [ Heinrich Schuchardt ]
+  * Rename grub-core/loader/efi/linux.c
+  * Add patches for GRUB on RISC-V
+  * fat: fix listing the root directory
+  * Enable building for RISC-V (LP: #1876620)
+
+  [ Julian Andres Klode ]
+  * Re-enable peimage code on other archs outside secure boot; this
+    fixes LP: #1947046 when not booting in secure boot mode (secure
+    boot pending security review of the code)
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Fri, 18 Feb 2022 17:21:16 +0100
+
+grub2 (2.06-2ubuntu4) jammy; urgency=medium
+
+  * UBUNTU: Move verifiers after decompressors (LP: #1954683)
+  * grub-check-signatures: Support gzip compressed kernels (LP: #1954683)
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 10 Jan 2022 14:52:04 +0100
+
+grub2 (2.06-2ubuntu3) jammy; urgency=medium
+
+  * Cherry-pick the missing hunk back that changes parameter loading
+    in grub-core/loader/i386/linux.c, this should fix booting on
+    BIOS systems.
+  * Fix the fallback for kernel addresses on amd64 EFI, if the kernel
+    could not be allocated at the preferred address, reset errno such
+    that if the 2nd allocation succeeds, we do not fail erroneously.
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 13 Dec 2021 14:27:53 +0100
+
+grub2 (2.06-2ubuntu2) jammy; urgency=medium
+
+  * Restore still relevant patches lost in rebase.
+    They got lost in a first rebase, when we did not include
+    ubuntu-linuxefi.patch as they modify code in there.
+    - no-devicetree-if-secure-boot.patch
+    - 0077-ubuntu-Update-the-linux-boot-protocol-version-check.patch
+    - 0096-linuxefi-fail-kernel-validation-without-shim-protoco.patch
+    - 0099-chainloader-Avoid-a-double-free-when-validation-fail.patch
+    - 0105-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Wed, 08 Dec 2021 17:14:50 +0100
+
+grub2 (2.06-2ubuntu1) jammy; urgency=medium
+
+  * Merge from Debian unstable; remaining changes:
+    - Build without lto
+    - Add Ubuntu sbat data
+    - Make prebuilt netboot image look for MAAS grub.cfg
+    - build-efi-images: add smbios module to the prebuilt signed EFI images
+      (LP: 1856424)
+    - build-efi-images: do not produce -installer.efi.signed. LP: 1863994
+    - build-efi-images: Add http to netboot images
+    - grub-common: Install canonical-uefi-ca.crt
+    - Check signatures
+    - minilzo: built using the distribution's minilzo
+    - Support installing to multiple ESP (LP: 1871821)
+    - Disable various bits on i386
+    - Split out unsigned artefacts into grub2-unsigned
+    - Vcs-Git: Point to ubuntu packaging branch
+    - Relax dependencies on grub-common and grub2-common
+    - grub-pc: Avoid the possibility of breaking grub on SRU update due
+      to ABI change
+    - UBUNTU: Default timeout changes
+    - Disable os-prober for ppc64el on the PowerNV platform (for Petitboot)
+    - dirs.in: create var/lib/grub/ucf in grub-efi-amd64 (and similar)
+    - Link grub-efi-{amd64,arm64}-bin docs directory
+    - grub-common.service: port init.d script to systemd unit. Add warning
+      message, when initrdless boot fails triggering fallback. LP: 1901553
+    - Removed patches:
+      - grub-install-extra-removable.patch
+      - grub-install-removable-shim.patch
+    - Added patches:
+      + ubuntu-grub-install-extra-removable.patch
+      + ubuntu-zfs-enhance-support.patch
+      + ubuntu-zfs-gfxpayload-keep-default.patch
+      + ubuntu-zfs-mkconfig-ubuntu-distributor.patch
+      + ubuntu-zfs-mkconfig-signed-kernel.patch
+      + ubuntu-zfs-maybe-quiet.patch
+      + ubuntu-zfs-quick-boot.patch
+      + ubuntu-zfs-gfxpayload-dynamic.patch
+      + ubuntu-zfs-vt-handoff.patch
+      + ubuntu-zfs-mkconfig-recovery-title.patch
+      + ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch
+      + ubuntu-support-initrd-less-boot.patch
+      + ubuntu-shorter-version-info.patch
+      + ubuntu-add-initrd-less-boot-fallback.patch
+      + ubuntu-mkconfig-leave-breadcrumbs.patch
+      + ubuntu-fix-lzma-decompressor-objcopy.patch
+      + ubuntu-temp-keep-auto-nvram.patch
+      + ubuntu-add-devicetree-command-support.patch
+      + ubuntu-boot-from-multipath-dependent-symlink.patch
+      + ubuntu-skip-disk-by-id-lvm-pvm-uuid-entries.patch
+      + ubuntu-efi-allow-loopmount-chainload.patch
+      + 0076-ubuntu-Make-the-linux-command-in-EFI-grub-always-try.patch
+      + ubuntu-resilient-boot-ignore-alternative-esps.patch
+      + ubuntu-resilient-boot-boot-order.patch
+      + ubuntu-speed-zsys-history.patch
+      + ubuntu-flavour-order.patch
+      + ubuntu-dont-verify-loopback-images.patch
+      + ubuntu-recovery-dis_ucode_ldr.patch
+      + ubuntu-linuxefi-arm64.patch
+      + ubuntu-add-initrd-less-boot-messages.patch
+      + ubuntu-fix-reproducible-squashfs-test.patch
+      + rhboot-f34-make-exit-take-a-return-code.patch
+      + rhboot-f34-dont-use-int-for-efi-status.patch
+      + rhboot-f34-make-pmtimer-tsc-calibration-fast.patch
+      + suse-add-support-for-UEFI-network-protocols.patch
+      + suse-AUDIT-0-http-boot-tracker-bug.patch
+      + rhboot-f34-efinet-also-use-the-firmware-acceleration-for-http.patch
+      + 0241-Call-hwmatch-only-on-the-grub-pc-platform.patch
+  * Dropped changes:
+    - Remove obsolete dependencies on dh-autoreconf and automake
+    - Remove explicit --with systemd in debhelper invocation
+    - Remove debian/gettext-patches; they do not seem to be necessary anymore
+    - Remove inadvertent change to debian/signing-template.json.in, we do not
+      use that file anyway.
+    - Merged upstream:
+      + merged: 0074-uefi-firmware-rename-fwsetup-menuentry-to-UEFI-Firmw.patch
+      + merged: 0075-smbios-Add-a-linux-argument-to-apply-linux-modalias-.patch
+      + merged security patches 0081-0105, and 0128-0240
+      + various cherry picks: cherry-* and cherrypick-*.patch
+      + grub-install-backup-and-restore.patch
+      + uefi-firmware-setup.patch
+      + sleep-shift.patch
+      + vsnprintf-upper-case-hex.patch
+      + rhboot-f34-update-info-with-grub.cfg-netboot-selection-order.patch
+      + suse-search-for-specific-config-files-for-netboot.patch
+      + tftp-rollover-block-counter.patch
+      + ubuntu-efi-console-set-text-mode-as-needed.patch
+    - Merged in Debian:
+      + install-efi-ubuntu-flavours.patch
+      + ubuntu-dejavu-font-path.patch
+      + ubuntu-tpm-unknown-error-non-fatal.patch
+    - Not applicable:
+      + 0077-ubuntu-Update-the-linux-boot-protocol-version-check.patch: The
+        check has been removed.
+  * Fix zstd build on s390x
+  * Cherry-pick two upstream fixes to fix closing of SNP protocol in EFI
+    networking stack
+  * Build with -O1 on s390x to avoid build failure due to gcc optimization
+    failure causing it to wrongly assume variables as uninitialized.
+  * Revert integration of jfs and f2fs modules into signed images, we do not
+    support these file systems on /boot.
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Tue, 07 Dec 2021 13:40:32 +0100
+
 grub2 (2.06-2) unstable; urgency=medium
 
   * Update to minilzo-2.10, fixing build failures on armel, mips64el,
@@ -1144,6 +2322,705 @@ grub2 (2.04-2) unstable; urgency=medium
 
  -- Colin Watson <cjwatson@debian.org>  Sat, 03 Aug 2019 13:42:49 +0100
 
+grub2 (2.04-1ubuntu48) jammy; urgency=medium
+
+  * d/p/0241-Call-hwmatch-only-on-the-grub-pc-platform.patch:
+    Fix "error: can't find command `hwmatch'." on non-i386/pc
+    platforms such as x86_64/efi. (LP: #1840560)
+
+ -- Mauricio Faria de Oliveira <mfo@canonical.com>  Thu, 04 Nov 2021 10:48:06 -0300
+
+grub2 (2.04-1ubuntu47) impish; urgency=medium
+
+  * Drop grub.cfg-400.patch (LP: #1933826)
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 02 Sep 2021 14:37:43 +0200
+
+grub2 (2.04-1ubuntu46) impish; urgency=medium
+
+  * debian/grub-common.service: change type to oneshot, add wantedby
+    sleep.target, after sleep.target. The service will now start after
+    resume from hybernation. LP: #1929860
+  * grub-initrd-fallback.service: add wantedby sleep.target, after
+    sleep.target. The service will now start after resume from
+    hybernation. LP: #1929860
+  * cherrypick upstream fix to make armhf efi boot work. LP: #1788940
+  * debian/rules: disable LTO. LP: #1922005
+  * grub-initrd-fallback.service, debian/grub-common.service: only start
+    units when booted with grub. Use presence of /boot/grub/grub.cfg as
+    proxy. LP: #1925507
+  * tests: patch qemu command to use ide-hd instead of the removed
+    ide-drive.
+
+ -- Dimitri John Ledkov <dimitri.ledkov@canonical.com>  Fri, 16 Jul 2021 14:01:31 +0100
+
+grub2 (2.04-1ubuntu45) hirsute; urgency=medium
+
+  * Unapply all patches.
+  * Stop using git-dpm.
+  * Start using gbp pq import|export --no-patch-numbers, this brings grub2
+    packaging closer to other non-debian distributions.
+  * It would be nice to separate patches into topic subdirs -
+    i.e. reverts, upstream cherry picks, debian, ubuntu, rhel, security,
+    etc.
+  * Drop redundant dh-systemd build-dependency.
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 30 Mar 2021 11:55:05 +0100
+
+grub2 (2.04-1ubuntu44) hirsute; urgency=medium
+
+  * Compile grub-efi-amd64 installable i386 platform on hirsute, to make
+    it available in bionic and earlier as part of onegrub builds.
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Wed, 03 Mar 2021 11:42:28 +0000
+
+grub2 (2.04-1ubuntu42) hirsute; urgency=medium
+
+  * SECURITY UPDATE: acpi command allows privilleged user to load crafted
+    ACPI tables when secure boot is enabled.
+    - 0126-acpi-Don-t-register-the-acpi-command-when-locked-dow.patch: Don't
+      register the acpi command when secure boot is enabled.
+    - CVE-2020-14372
+  * SECURITY UPDATE: use-after-free in rmmod command
+    - 0128-dl-Only-allow-unloading-modules-that-are-not-depende.patch: Don't
+      allow rmmod to unload modules that are dependencies of other modules.
+    - CVE-2020-25632
+  * SECURITY UPDATE: out-of-bound write in grub_usb_device_initialize()
+    - 0129-usb-Avoid-possible-out-of-bound-accesses-caused-by-m.patch
+    - CVE-2020-25647
+  * SECURITY UPDATE: Stack buffer overflow in grub_parser_split_cmdline
+    - 0206-kern-parser-Introduce-process_char-helper.patch,
+      0207-kern-parser-Introduce-terminate_arg-helper.patch,
+      0208-kern-parser-Refactor-grub_parser_split_cmdline-clean.patch,
+      0209-kern-buffer-Add-variable-sized-heap-buffer.patch,
+      0210-kern-parser-Fix-a-stack-buffer-overflow.patch: Add a variable
+      sized heap buffer type and use this.
+    - CVE-2020-27749
+  * SECURITY UPDATE: cutmem command allows privileged user to remove memory
+    regions when Secure Boot is enabled.
+    - 0127-mmap-Don-t-register-cutmem-and-badram-commands-when-.patch:
+      Don't register cutmem and badram commands when secure boot is enabled.
+    - CVE-2020-27779
+  * SECURITY UPDATE: heap out-of-bounds write in short form option parser.
+    - 0173-lib-arg-Block-repeated-short-options-that-require-an.patch:
+      Block repeated short options that require an argument.
+    - CVE-2021-20225
+  * SECURITY UPDATE: heap out-of-bound write due to mis-calculation of space
+    required for quoting.
+    - 0175-commands-menuentry-Fix-quoting-in-setparams_prefix.patch: Fix
+      quoting in setparams_prefix()
+    - CVE-2021-20233
+  * Partially backport the lockdown framework to restrict certain features
+    when secure boot is enabled.
+  * Backport various fixes for Coverity defects.
+  * Add SBAT metadata to the grub EFI binary.
+    - Backport patches to support adding SBAT metadata with grub-mkimage:
+      + 0212-util-mkimage-Remove-unused-code-to-add-BSS-section.patch
+      + 0213-util-mkimage-Use-grub_host_to_target32-instead-of-gr.patch
+      + 0214-util-mkimage-Always-use-grub_host_to_target32-to-ini.patch
+      + 0215-util-mkimage-Unify-more-of-the-PE32-and-PE32-header-.patch
+      + 0216-util-mkimage-Reorder-PE-optional-header-fields-set-u.patch
+      + 0217-util-mkimage-Improve-data_size-value-calculation.patch
+      + 0218-util-mkimage-Refactor-section-setup-to-use-a-helper.patch
+      + 0219-util-mkimage-Add-an-option-to-import-SBAT-metadata-i.patch
+    - Add debian/sbat.csv.in
+    - Update debian/build-efi-image and debian/rules
+
+  [ Dimitri John Ledkov & Steve Langasek LP: #1915536 ]
+  * Allow grub-efi-amd64|arm64 & -bin & -dbg be built by
+    src:grub2-unsigned (potentially of a higher version number).
+  * Add debian/rules generate-grub2-unsigned target to quickly build
+    src:grub2-unsigned for binary-copy backports.
+  * postinst: allow postinst to with with or without grub-multi-install
+    binary.
+  * postinst: allow using various grub-install options to achieve
+    --no-extra-removable.
+  * postinst: only call grub-check-signatures if it exists.
+  * control: relax dependency on grub2-common, as maintainer script got
+    fixed up to work with grub2-common/grub-common as far back as trusty.
+  * control: allow higher version depdencies from grub-efi package.
+  * dirs.in: create var/lib/grub/ucf in grub-efi-amd64 (and similar) as
+    postinst script uses that directory, and yet relies on grub-common to
+    create/ship it, which is not true in older releases. Also make sure
+    dh_installdirs runs after the .dirs files are generated.
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 23 Feb 2021 16:23:39 +0000
+
+grub2 (2.04-1ubuntu41) hirsute; urgency=medium
+
+  * No-change rebuild to drop the udeb package.
+
+ -- Matthias Klose <doko@ubuntu.com>  Mon, 22 Feb 2021 10:33:38 +0100
+
+grub2 (2.04-1ubuntu40) hirsute; urgency=medium
+
+  * Revert: rhboot-f34-tcp-add-window-scaling-support.patch,
+    rhboot-f34-support-non-ethernet.patch,
+    ubuntu-fixup-rhboot-f34-support-non-ethernet.patch,
+    ubuntu-fixup-rhboot-f34-support-non-ethernet-2.patch: these break MAAS
+    LXD KVM pod deployments. LP: #1915288
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Fri, 12 Feb 2021 20:29:16 +0000
+
+grub2 (2.04-1ubuntu39) hirsute; urgency=medium
+
+  * Cherrypick a bunch of patches:
+    - fix crash in http LP: #1915288
+    - add bootp6 documentation
+    - add support for UEFI boot protocols
+    - use UEFI protocols for http & https networking
+    - make netboot search for by-mac/by-uuid/by-ip for grub.cfg
+    - update documentation for netboot search paths of grub.cfg
+  * Make prebuilt netboot image look for MAAS grub.cfg
+  * Fix grub-initrd-fallback.service thanks to JawnSmith LP: #1910815
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Fri, 12 Feb 2021 00:42:07 +0000
+
+grub2 (2.04-1ubuntu38) hirsute; urgency=medium
+
+  [ Jean-Baptiste Lallement ]
+  [ Didier Roche ]
+  * Fix warnings during grub menu generation.  Thanks wdoekes for the patch
+    (LP: #1898177)
+    - Fix warnings when bpool doesn't exist.
+    - Fix warnings when snapshot name contains dashes.
+  * Do not fail to generate grub menu when name of the snapshot contains
+    spaces. (LP: #1903524)
+
+ -- Jean-Baptiste Lallement <jean-baptiste.lallement@ubuntu.com>  Mon, 08 Feb 2021 10:50:21 +0100
+
+grub2 (2.04-1ubuntu37) hirsute; urgency=medium
+
+  * debian/patches/grub-install-backup-and-restore.patch: Fix-up the patch
+    to correctly initialyze the names of the modules to restore. LP:
+    #1907085
+  * 10_linux: emit messages when initrdless boot is configured, attempted
+    and fails triggering fallback. LP: #1901553
+  * grub-common.service: port init.d script to systemd unit. Add warning
+    message, when initrdless boot fails triggering fallback. LP: #1901553
+  * debian/rules: undo po/ directory patching in
+    override_dh_autoreconf_clean.
+  * minilzo: built using the distribution's minilzo
+  * ubuntu-fix-reproducible-squashfs-test.patch: fix squashfs-test with
+    new squashfs-tools in hirsute.
+  * rhboot-f34-make-exit-take-a-return-code.patch,
+    rhboot-f34-dont-use-int-for-efi-status.patch: allow grub to exit
+    non-zero under EFI, this should allow falling back to the next
+    BootOrder BootEntry.
+  * rhboot-f34-tcp-add-window-scaling-support.patch: speed up netboot
+    transfer speed.
+  * rhboot-f34-support-non-ethernet.patch,
+    ubuntu-fixup-rhboot-f34-support-non-ethernet.patch,
+    ubuntu-fixup-rhboot-f34-support-non-ethernet-2.patch:
+    add support for link layer addresses of up to 32-bytes.
+  * rhboot-f34-make-pmtimer-tsc-calibration-fast.patch:
+    speed up calibration time, especially when booting VMs.
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Sat, 12 Dec 2020 00:50:47 +0000
+
+grub2 (2.04-1ubuntu36) hirsute; urgency=medium
+
+  * Avoid "EFI stub: FIRMWARE BUG" message when booting >= 5.7 kernels
+    on arm64 by setting the image base address before jumping to the
+    PE/COFF entry point LP: #1900774
+  * Fix tftp timeouts when fetch large files. LP: #1900773
+
+ -- dann frazier <dannf@ubuntu.com>  Wed, 11 Nov 2020 07:17:49 -0700
+
+grub2 (2.04-1ubuntu35) groovy; urgency=medium
+
+  * postinst.in, grub-multi-install: fix logic of skipping installing onto
+    any device, if one chose to not install bootloader on any device. LP:
+    #1896608
+  * Do not finalize params twice on arm64. LP: #1897819
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 01 Oct 2020 22:59:51 +0800
+
+grub2 (2.04-1ubuntu34) groovy; urgency=medium
+
+  * configure.ac: one more dejavu font search path
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Mon, 14 Sep 2020 10:53:07 +0100
+
+grub2 (2.04-1ubuntu33) groovy; urgency=medium
+
+  * Build-depend on fonts-dejavu-core, not obsolete ttf-dejavu-core.
+
+ -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 13 Sep 2020 23:49:08 -0700
+
+grub2 (2.04-1ubuntu32) groovy; urgency=medium
+
+  * ubuntu-linuxefi-arm64.patch: Fix build on armhf
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Fri, 11 Sep 2020 20:33:34 +0200
+
+grub2 (2.04-1ubuntu31) groovy; urgency=medium
+
+  * ubuntu-linuxefi-arm64.patch: Restore arm64 parts of ubuntu-linuxefi.patch
+    that got lost in the 2.04 rebase (LP: #1862279)
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Fri, 11 Sep 2020 17:49:50 +0200
+
+grub2 (2.04-1ubuntu30) groovy; urgency=medium
+
+  * postinst.in: do not attempt to call grub-install upon fresh install of
+    grub-pc because it it a job of installers to do that after fresh
+    install.
+  * grub-multi-install: fix non-interactive failures for grub-efi like it
+    was fixed in postinst for grub-pc.
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 03 Sep 2020 14:54:23 +0100
+
+grub2 (2.04-1ubuntu29) groovy; urgency=medium
+
+  * grub-install: cherry-pick patch from grub-devel to make grub-install
+    fault tolerant. Create backup of files in /boot/grub, and restore them
+    on failure to complete grub-install. LP: #1891680
+  * postinst.in: do not exit successfully when failing to show critical
+    grub-pc/install_devices_failed and grub-pc/install_devices_empty
+    prompts in non-interactive mode. This enables surfacing upgrade errors
+    to the users and/or automation. LP: #1891680
+  * postinst.in: Fixup postinst.in, to attempt grub-install upon explicit
+    dpkg-reconfigure grub-pc. LP: #1892526
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 01 Sep 2020 20:04:44 +0100
+
+grub2 (2.04-1ubuntu28) groovy; urgency=medium
+
+  * Ensure that grub-multi-install can always find templates (LP: #1879948)
+  * Fix changelog entries for security update
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 10 Aug 2020 15:07:29 +0200
+
+grub2 (2.04-1ubuntu27) groovy; urgency=medium
+
+  * debian/patches/ubuntu-flavour-order.patch:
+    - Add a (hidden) GRUB_FLAVOUR_ORDER setting that can mark certain kernel
+      flavours as preferred, and specify an order between those preferred
+      flavours (LP: #1882663)
+  * debian/patches/ubuntu-zfs-enhance-support.patch:
+    - Use version_find_latest for ordering kernels, so it also supports
+      the GRUB_FLAVOUR_ORDER setting.
+  * debian/patches/ubuntu-dont-verify-loopback-images.patch:
+    - disk/loopback: Don't verify loopback images (LP: #1878541),
+      Thanks to Chris Coulson for the patch
+  * debian/patches/ubuntu-recovery-dis_ucode_ldr.patch
+    - Pass dis_ucode_ldr to kernel for recovery mode (LP: #1831789)
+  * debian/patches/ubuntu-add-initrd-less-boot-fallback.patch:
+    - Merge changes from xnox to fix multiple initrds support (LP: #1878705)
+  * debian/patches/ubuntu-clear-invalid-initrd-spacing.patch:
+    - Remove, no longer needed thanks to xnox's patch
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 06 Aug 2020 14:47:52 +0200
+
+grub2 (2.04-1ubuntu26.2) focal; urgency=medium
+
+  * debian/postinst.in: Avoid calling grub-install on upgrade of the grub-pc
+    package, since we cannot be certain that it will install to the correct
+    disk and a grub-install failure will render the system unbootable.
+    LP: #1889556.
+
+ -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 30 Jul 2020 17:34:25 -0700
+
+grub2 (2.04-1ubuntu26.1) focal; urgency=medium
+
+  [ Julian Andres Klode ]
+  * Move gettext patches out of git-dpm's way, so it does not delete them
+
+  [ Chris Coulson ]
+  * SECURITY UPDATE: Heap buffer overflow when encountering commands that
+    cannot be tokenized to less than 8192 characters.
+    - 0082-yylex-Make-lexer-fatal-errors-actually-be-fatal.patch: Make
+      fatal lexer errors actually be fatal
+    - CVE-2020-10713
+  * SECURITY UPDATE: Multiple integer overflow bugs that could result in
+    heap buffer allocations that were too small and subsequent heap buffer
+    overflows when handling certain filesystems, font files or PNG images.
+    - 0083-safemath-Add-some-arithmetic-primitives-that-check-f.patch: Add
+      arithmetic primitives that allow for overflows to be detected
+    - 0084-calloc-Make-sure-we-always-have-an-overflow-checking.patch:
+      Make sure that there is always an overflow checking implementation
+      of calloc() available
+    - 0085-calloc-Use-calloc-at-most-places.patch: Use calloc where
+      appropriate
+    - 0086-malloc-Use-overflow-checking-primitives-where-we-do-.patch: Use
+      overflow-safe arithmetic primitives when performing allocations
+      based on the results of operations that might overflow
+    - 0094-hfsplus-fix-two-more-overflows.patch: Fix integer overflows in
+      hfsplus
+    - 0095-lvm-fix-two-more-potential-data-dependent-alloc-over.patch: Fix
+      more potential integer overflows in lvm
+    - CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311
+  * SECURITY UPDATE: Use-after-free when executing a command that causes
+    a currently executing function to be redefined.
+    - 0092-script-Remove-unused-fields-from-grub_script_functio.patch:
+      Remove unused fields from grub_script_function
+    - 0093-script-Avoid-a-use-after-free-when-redefining-a-func.patch:
+      Avoid a use-after-free when redefining a function during execution
+    - CVE-2020-15706
+  * SECURITY UPDATE: Integer overflows that could result in heap buffer
+    allocations that were too small and subsequent heap buffer overflows
+    during initrd loading.
+    - 0105-linux-Fix-integer-overflows-in-initrd-size-handling.patch: Fix
+      integer overflows in initrd size handling
+    - 0106-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch: Fix
+      integer overflows in linuxefi grub_cmd_initrd
+    - CVE-2020-15707
+  * Various fixes as a result of code review and static analysis:
+    - 0087-iso9660-Don-t-leak-memory-on-realloc-failures.patch: Fix a
+     memory leak on realloc failures when processing symbolic links
+    - 0088-font-Do-not-load-more-than-one-NAME-section.patch: Fix a
+      memory leak when processing font files with more than one NAME
+      section
+    - 0089-gfxmenu-Fix-double-free-in-load_image.patch: Zero self->bitmap
+      after it is freed in order to avoid a potential double free later on
+    - 0090-lzma-Make-sure-we-don-t-dereference-past-array.patch: Fix an
+      out-of-bounds read in LzmaEncode
+    - 0091-tftp-Do-not-use-priority-queue.patch: Refactor tftp to not use
+      priority queues and fix a double free
+    - 0096-efi-fix-some-malformed-device-path-arithmetic-errors.patch: Fix
+      various arithmetic errors with malformed device paths
+    - 0098-Fix-a-regression-caused-by-efi-fix-some-malformed-de.patch: Fix
+      a NULL deref in the chainloader command introduced by a previous
+      patch
+    - 0099-efi-Fix-use-after-free-in-halt-reboot-path.patch: Fix a
+      use-after-free in the halt and reboot commands by not freeing
+      allocated memory in these paths
+    - 0100-chainloader-Avoid-a-double-free-when-validation-fail.patch:
+      Avoid a double free in the chainloader command when validation fails
+    - 0101-relocator-Protect-grub_relocator_alloc_chunk_addr-in.patch:
+      Protect grub_relocator_alloc_chunk_addr input arguments against
+      integer overflow / underflow
+    - 0102-relocator-Protect-grub_relocator_alloc_chunk_align-m.patch:
+      Protect grub_relocator_alloc_chunk_align max_addr argument against
+      integer underflow
+    - 0103-relocator-Fix-grub_relocator_alloc_chunk_align-top-m.patch: Fix
+      grub_relocator_alloc_chunk_align top memory allocation
+    - 0104-linux-loader-avoid-overflow-on-initrd-size-calculati.patch:
+      Avoid overflow on initrd size calculation
+
+  [ Dimitri John Ledkov ]
+  * SECURITY UPDATE: Grub does not enforce kernel signature validation
+    when the shim protocol isn't present.
+    - 0097-linuxefi-fail-kernel-validation-without-shim-protoco.patch:
+      Fail kernel validation if the shim protocol isn't available
+    - CVE-2020-15705
+
+ -- Chris Coulson <chris.coulson@canonical.com>  Mon, 20 Jul 2020 19:19:08 +0100
+
+grub2 (2.04-1ubuntu26) focal; urgency=medium
+
+  [ Julian Andres Klode ]
+  * Move /boot/efi -> debconf migration into wrapper, so it runs everywhere
+    (LP: #1872077)
+  * Display disk name and size in the ESP selection dialog, instead of ???
+
+  [ Sebastien Bacher ]
+  * debian/patches/gettext,
+    debian/patches/rules:
+    - backport upstream patches to fix the list of translated strings,
+      reported on the ubuntu-translators mailing list. The changes would
+      be overwritten by autoreconf so applying from a rules override.
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Wed, 15 Apr 2020 13:31:27 +0200
+
+grub2 (2.04-1ubuntu25) focal; urgency=medium
+
+  [ Jean-Baptiste Lallement ]
+  [ Didier Roche ]
+  * debian/patches/ubuntu-zfs-enhance-support.patch:
+    - fix trailing } when no advanced menu is printed
+    - ensure we unmount all temporary snapshots path before zfs collect them
+      out.
+  * debian/patches/ubuntu-speed-zsys-history.patch:
+    - Speed up navigating zsys history by reducing greatly grub.cfg file size.
+      It used to take eg 80 seconds when loading 100 system snapshots. This is
+      now instantaneous by using a function with parameters that the users can
+      still easily edit.
+
+ -- Didier Roche <didrocks@ubuntu.com>  Mon, 13 Apr 2020 15:17:42 +0200
+
+grub2 (2.04-1ubuntu24) focal; urgency=medium
+
+  * Support installing to multiple ESPs (LP: #1871821)
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 09 Apr 2020 12:51:07 +0200
+
+grub2 (2.04-1ubuntu23) focal; urgency=medium
+
+  [ Jean-Baptiste Lallement ]
+  [ Didier Roche ]
+  * Performance improvements for update-grub on ZFS systems (LP: #1869885)
+
+ -- Didier Roche <didrocks@ubuntu.com>  Tue, 31 Mar 2020 15:30:36 +0200
+
+grub2 (2.04-1ubuntu22) focal; urgency=medium
+
+  * smbios: Add a --linux argument to apply linux modalias-like filtering
+  * Make the linux command in EFI grub always try EFI handover; thanks
+    to Chris Coulson for the patches (LP: #1864533)
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Wed, 11 Mar 2020 17:46:35 +0100
+
+grub2 (2.04-1ubuntu21) focal; urgency=medium
+
+  * Make ZFS menu generation depending on new zsysd binary instead of eoan
+    zsys compatibility symlink.
+
+ -- Didier Roche <didrocks@ubuntu.com>  Wed, 26 Feb 2020 09:59:49 +0100
+
+grub2 (2.04-1ubuntu20) focal; urgency=medium
+
+  * build-efi-images: do not produce -installer.efi.signed. LP: #1863994
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 25 Feb 2020 01:11:31 +0000
+
+grub2 (2.04-1ubuntu19) focal; urgency=medium
+
+  * uefi-firmware: rename fwsetup menuentry to UEFI Firmware Settings
+    (LP: #1864547)
+  * build-efi-images: add smbios module to the prebuilt signed EFI images
+    (LP: #1856424)
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Mon, 24 Feb 2020 20:34:13 +0000
+
+grub2 (2.04-1ubuntu18) focal; urgency=medium
+
+  * Cherry-pick fix from Colin W. in debian to build with python3.
+
+ -- Didier Roche <didrocks@ubuntu.com>  Thu, 06 Feb 2020 18:37:44 +0100
+
+grub2 (2.04-1ubuntu17) focal; urgency=medium
+
+  * Fix ZFS menu generation with ZFS 0.8.x where mounted datasets can’t list
+    snapshots due to an upstream change.
+    https://github.com/zfsonlinux/zfs/issues/9958
+
+ -- Didier Roche <didrocks@ubuntu.com>  Thu, 06 Feb 2020 18:20:16 +0100
+
+grub2 (2.04-1ubuntu16) focal; urgency=medium
+
+  * Revert "Add smbios module to build-efi-images script" from previous
+    upload, pending review see https://bugs.launchpad.net/bugs/1856424
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Sun, 15 Dec 2019 01:28:49 +0000
+
+grub2 (2.04-1ubuntu15) focal; urgency=medium
+
+  * ubuntu-efi-allow-loopmount-chainload.patch:
+    - Enable chainloading EFI apps from loopmounts
+  * cherrypick-lsefisystab-define-smbios3.patch:
+  * cherrypick-smbios-modules.patch:
+    - Cherrypick from 2.05 module for retrieving SMBIOS information
+  * cherrypick-lsefisystab-show-dtb.patch:
+    - If dtb is provided by the firmware / DtbLoader driver, display it in
+    human form, rather than just UUID
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Fri, 13 Dec 2019 11:24:21 +0000
+
+grub2 (2.04-1ubuntu14) focal; urgency=medium
+
+  * debian/patches/ubuntu-zfs-enhance-support.patch:
+    - Handle the case where grub-probe returns several devices for a single
+      pool (LP: #1848856). Thanks jpb for the report and the proposed patch.
+    - Add savedefault to non-recovery entries (LP: #1850202). Thanks Deltik
+      for the patch.
+    - Do not crash on invalid fstab and report the invalid entry.
+      (LP: #1849347) Thanks Deltik for the patch.
+    - When a pool fails to import, catch and display the error message and
+      continue with other pools. Import all the pools in readonly mode so we
+      can import other pools with unsupported features (LP: #1848399) Thanks
+      satmandu for the investigation and the proposed patch
+
+ -- Jean-Baptiste Lallement <jean-baptiste.lallement@ubuntu.com>  Mon, 18 Nov 2019 11:22:43 +0100
+
+grub2 (2.04-1ubuntu13) focal; urgency=medium
+
+  * debian/patches/ubuntu-tpm-unknown-error-non-fatal.patch: treat "unknown"
+    TPM errors as non-fatal, but still write up the details as debug messages
+    so we can further track what happens with the systems throwing those up.
+    (LP: #1848892)
+  * debian/patches/ubuntu-linuxefi.patch: Drop extra check for Secure Boot
+    status in linuxefi_secure_validate(); it's unnecessary and blocking boot
+    in chainload (like chainloading Windows) when SB is disabled.
+    (LP: #1845289)
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Thu, 31 Oct 2019 17:58:47 -0400
+
+grub2 (2.04-1ubuntu12) eoan; urgency=medium
+
+  * Move our identifier to com.ubuntu
+    As we are not going to own org.zsys, move our identifier under
+    com.ubuntu.zsys (LP: #1847711)
+
+ -- Didier Roche <didrocks@ubuntu.com>  Fri, 11 Oct 2019 15:57:47 +0200
+
+grub2 (2.04-1ubuntu11) eoan; urgency=medium
+
+  * Load all kernels (even those without .efi.signed) for secure boot mode
+    as those are signed kernels on ubuntu, loaded by the shim. (LP: #1847581)
+
+ -- Didier Roche <didrocks@ubuntu.com>  Thu, 10 Oct 2019 11:40:44 +0200
+
+grub2 (2.04-1ubuntu10) eoan; urgency=medium
+
+  * debian/patches/ubuntu-skip-disk-by-id-lvm-pvm-uuid-entries.patch:
+    skip /dev/disk/by-id/lvm-pvm-uuid entries from device iteration.
+    (LP: #1838525)
+
+ -- Rafael David Tinoco <rafaeldtinoco@ubuntu.com>  Mon, 07 Oct 2019 23:23:54 -0300
+
+grub2 (2.04-1ubuntu9) eoan; urgency=medium
+
+  * debian/patches/ubuntu-zfs-enhance-support.patch:
+    - Handle case of pure zfs only snapshots giving additional "}", and as
+      such, creating invalid grub menu.
+      Spotted by grubzfs-testsuite autopkgtests.
+
+ -- Didier Roche <didrocks@ubuntu.com>  Wed, 02 Oct 2019 09:59:19 +0200
+
+grub2 (2.04-1ubuntu8) eoan; urgency=medium
+
+  * debian/patches/install-signed.patch -> ubuntu-install-signed.patch:
+    Really fix the installation of UEFI artefacts to the distributor path (we
+    only want shim, grub, and MokManager, and shim's boot.csv there), and to
+    the removable /EFI/BOOT path (where we want shim and fallback only).
+    Rename the patch to ubuntu- like others that are Ubuntu-specific or
+    otherwise modified to avoid such confusion at merge time in the future.
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Tue, 01 Oct 2019 11:29:24 -0400
+
+grub2 (2.04-1ubuntu7) eoan; urgency=medium
+
+  * debian/patches/ubuntu-zfs-enhance-support.patch:
+    Disable history entry under some conditions:
+    - Don't show up if the system is a zsys one and zsys isn't installed
+      (LP: #1845333)
+    - Don't show for pure zfs systems: we identified multiple issues due
+      to the mount generator in upstream zfs which makes it incompatible.
+      Disable for now (LP: #1845913)
+
+ -- Didier Roche <didrocks@ubuntu.com>  Mon, 30 Sep 2019 09:35:03 +0200
+
+grub2 (2.04-1ubuntu6) eoan; urgency=medium
+
+  * debian/patches/install-signed.patch: fix paths for MokManager/fallback;
+    shim no longer ships these with a .signed suffix. (LP: #1845466)
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Thu, 26 Sep 2019 09:48:07 -0400
+
+grub2 (2.04-1ubuntu5) eoan; urgency=medium
+
+  * d/patches/ubuntu-boot-from-multipath-dependent-symlink.patch: fix
+    mis-spelling of helper function in final computation of GRUB_DEVICE in
+    multipath case.
+
+ -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Tue, 13 Aug 2019 08:56:16 +1200
+
+grub2 (2.04-1ubuntu4) eoan; urgency=medium
+
+  * d/patches/ubuntu-boot-from-multipath-dependent-symlink.patch: when / is
+    multipathed there will be multiple paths to the partition, so using
+    root=UUID= exposes the boot process to udev races.  In addition
+    grub-probe --target device / in this case reports /dev/dm-1 or similar --
+    better to use a symlink that depends on the multipath name. (LP: #1429327)
+
+ -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Tue, 06 Aug 2019 12:37:18 +1200
+
+grub2 (2.04-1ubuntu3) eoan; urgency=medium
+
+  [ Mathieu Trudel-Lapierre ]
+  * debian/patches/ubuntu-add-devicetree-command-support.patch: import patch
+    into git-dpm: drop [PATCH] tag and add Patch-Name.
+
+  [ Didier Roche ]
+  * debian/patches/ubuntu-zfs-enhance-support.patch
+    - Don't patch autoregenerated files.
+    - rewrite generate MenuMeta implementation in shell (LP: #1834095)
+      mawk doesn't support \s and other array features.
+      + Change \s by their space or tab equivalent.
+      + Rewrite the menumeta generation in pure shell, which is easier to
+        debug, keeping globally the same algorithm
+      + Support i18n in entry name generation.
+      Co-authored with Jean-Baptiste.
+    - Resplit all patches in debian/patches/*, so that we have upstreamable
+      and non upstreamable parts separate. Also, any change in 10_linux patch
+      will be reflected in 10_linux_zfs.
+    - Always import pools (using force), as we don't mount them. Ensure also
+      that we don't update the host cache, as we import all pools, and not
+      only those attached to that system.
+
+ -- Didier Roche <didrocks@ubuntu.com>  Mon, 29 Jul 2019 08:08:48 +0200
+
+grub2 (2.04-1ubuntu2) eoan; urgency=medium
+
+  * Add device-tree command support as installed by flash-kernel.
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Wed, 17 Jul 2019 23:47:27 +0100
+
+grub2 (2.04-1ubuntu1) eoan; urgency=medium
+
+  * Merge against Debian; remaining changes:
+    - debian/control: Update Vcs fields for code location on Ubuntu.
+    - debian/control: Breaks shim (<< 13).
+    - debian/patches/linuxefi.patch: Secure Boot support: use newer patchset
+      from rhboot repo, flattened to a single patch.
+    - debian/patches/install_signed.patch, grub-install-extra-removable.patch:
+      - Make sure if we install shim; it should also be exported as the default
+        bootloader to install later to a removable path, if we do.
+      - Rework grub-install-extra-removable.patch to reverse its logic: in the
+        default case, install the bootloader to /EFI/BOOT, unless we're trying
+        to install on a removable device, or explicitly telling grub *not* to
+        do it.
+      - Install a BOOT.CSV for fallback to use.
+      - Make sure postinst and templates know about the replacement of
+        --force-extra-removable with --no-extra-removable.
+    - debian/patches/ubuntu-support-initrd-less-boot.patch: allow non-initrd
+      boot config.
+    - debian/patches/ubuntu-add-initrd-less-boot-fallback.patch: If a kernel
+      fails to boot without initrd, we will fallback to trying to boot the
+      kernel with an initrd.
+    - debian/patches/ubuntu-mkconfig-leave-breadcrumbs.patch: make sure
+      grub-mkconfig leaves a trace of what files were sourced to help generate
+      the config we're building.
+    - debian/patches/ubuntu-efi-console-set-text-mode-as-needed.patch: in EFI
+      console, only set text-mode when we're actually going to need it.
+    - debian/patches/ubuntu-zfs-enhance-support.patch: Better ZFS grub support.
+    - Disable os-prober for ppc64el on the PowerNV platform, to reduce the
+      number of entries/clutter from other OSes in Petitboot
+    - debian/patches/ubuntu-shorter-version-info.patch: Only show the upstream
+      version in menu and console, and hide the package one in a
+      package_version variable.
+    - Verify that the current and newer kernels are signed when grub is
+      updated, to make sure people do not accidentally shutdown without a
+      signed kernel.
+    - debian/default/grub: replace GRUB_HIDDEN_* variables with the less
+      confusing GRUB_TIMEOUT_STYLE=hidden.
+    - debian/rules: shuffle files around for now to keep build artefacts
+      for signing at the same location as they were expected by Launchpad.
+    - debian/rules, debian/control: enable dh-systemd.
+    - debian/grub-common.install.in: install the systemd unit that's part of
+      initrd fallback handling, missed when the feature landed.
+    - debian/build-efi-images: add http module to NET_MODULES.
+  * debian/patches/linuxefi*.patch: Flatten linuxefi patches into one.
+  * debian/patches: rename patches to use "-" as a separator rather than "_".
+  * debian/patches: rename Ubuntu-specific patches and commits to add "ubuntu"
+    so it's clearer which are new or changed when doing a merge.
+  * debian/patches/ubuntu-fix-lzma-decompressor-objcopy.patch: fix FTBFS due
+    to objcopy building an invalid binary padded with zeroes (LP: #1833234)
+  * debian/patches/ubuntu-clear-invalid-initrd-spacing.patch: clear up invalid
+    spacing for the initrd command when not using early initrds.
+  * debian/patches/ubuntu-add-initrd-less-boot-fallback.patch: move the initrd
+    boot success/failure service to start later at boot time. (LP: #1823391)
+  * debian/patches/fix-lockdown.patch: Drop lockdown patch from Debian, which
+    breaks with new linuxefi patchset.
+  * debian/patches/ubuntu-temp-keep-auto-nvram.patch: Temporarily keep the
+    --auto-nvram option we previously had as a supported option in grub-install
+    (with no effect now), to avoid breaking upgrades. "auto-nvram" is default
+    behavior now that we use libefivar instead of calling efibootmgr.
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Tue, 16 Jul 2019 11:31:29 -0400
+
 grub2 (2.04-1) unstable; urgency=medium
 
   * New upstream release.
@@ -1277,6 +3154,112 @@ grub2 (2.02+dfsg1-13) unstable; urgency=
 
  -- Colin Watson <cjwatson@debian.org>  Thu, 14 Mar 2019 10:33:24 +0000
 
+grub2 (2.02+dfsg1-12ubuntu3) eoan; urgency=medium
+
+  * debian/patches/zfs_enhance_support.patch:
+    Enhance ZFS grub support:
+    - Support multiple zfs systems (grouped by machine-id)
+    - Group zfs snapshots and clones with latest dataset for a given
+      installation.
+    - Support "history" entry with one time boot, recovery mode and
+      consecutive reboots.
+    - Pin kernel to particular snapshot, trying to reboot with the exact
+      same kernel and initrd.
+    - Disable in 10_linux zfs support if 10_linux_zfs is installed so that
+      we don't end up with the same installation multiple times.
+  * debian/patches/*:
+    - Apply ubuntu/debian specific changes of 10_linux to 10_linux_zfs.
+
+  Work done with Jean-Baptiste.
+
+ -- Didier Roche <didrocks@ubuntu.com>  Mon, 17 Jun 2019 11:28:48 +0200
+
+grub2 (2.02+dfsg1-12ubuntu2) disco; urgency=medium
+
+  * debian/patches/efi-console-set-text-mode-as-needed.patch: in EFI console,
+    only set text-mode when we're actually going to need it.
+  * debian/build-efi-images: add http module to NET_MODULES. (LP: #1787630)
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Mon, 11 Mar 2019 17:48:49 -0400
+
+grub2 (2.02+dfsg1-12ubuntu1) disco; urgency=medium
+
+  * Merge against Debian unstable; remaining changes (LP: #564853):
+    - debian/control: Update Vcs fields for code location on Ubuntu.
+    - debian/control: Breaks shim (<< 13).
+    - Secure Boot support: use newer patchset from rhboot repo:
+      - many linuxefi_* patches added and modified
+      - dropped debian/patches/linuxefi_require_shim.patch
+      - renamed: debian/patches/no_insmod_on_sb.patch ->
+        debian/patches/linuxefi_no_insmod_on_sb.patch
+    - debian/patches/install_signed.patch, grub-install-extra-removable.patch:
+      - Make sure if we install shim; it should also be exported as the default
+        bootloader to install later to a removable path, if we do.
+      - Rework grub-install-extra-removable.patch to reverse its logic: in the
+        default case, install the bootloader to /EFI/BOOT, unless we're trying
+        to install on a removable device, or explicitly telling grub *not* to
+        do it.
+      - Install a BOOT.CSV for fallback to use.
+      - Make sure postinst and templates know about the replacement of
+        --force-extra-removable with --no-extra-removable.
+    - debian/patches/add-an-auto-nvram-option-to-grub-install.patch: Add the
+      --auto-nvram option to grub-install for auto-detecting NVRAM availability
+      before attempting NVRAM updates.
+    - debian/build-efi-images: provide a new grub EFI image which enforces that
+      loaded kernels are signed for Secure Boot: build gsb$arch.efi; which is
+      the same as grub$arch.efi minus the 'linux' module. Without fallback to
+      'linux' for unsigned loading, this makes it effectively enforce having a
+      signed kernel.
+    - Verify that the current and newer kernels are signed when grub is
+      updated, to make sure people do not accidentally shutdown without a
+      signed kernel.
+    - debian/default/grub: replace GRUB_HIDDEN_* variables with the less
+      confusing GRUB_TIMEOUT_STYLE=hidden.
+    - debian/patches/support_initrd-less_boot.patch: Added knobs to allow
+      non-initrd boot config.
+    - Disable os-prober for ppc64el on the PowerNV platform, to reduce the
+      number of entries/clutter from other OSes in Petitboot
+    - debian/patches/shorter_version_info.patch: Only show the upstream version
+      in menu and console, and hide the package one in a package_version
+      variable.
+    - debian/patches/skip_text_gfxpayload_where_not_supported.patch: Skip the
+      'text' payload if it's not supported but present in gfxpayload, such as
+      on EFI systems.
+    - debian/patches/bufio_sensible_block_sizes.patch: Don't use arbitrary file
+      fizes as block sizes in bufio: this avoids potentially seeking back in
+      the files unnecessarily, which may require re-open files that cannot be
+      seeked into, such as via TFTP.
+    - debian/patches/ofnet-init-structs-in-bootpath-parser.patch: initialize
+      structs in bootpath parser.
+    - debian/rules: shuffle files around for now to keep build artefacts
+      for signing at the same location as they were expected by Launchpad.
+    - debian/rules, debian/control: enable dh-systemd.
+    - debian/grub-common.install.in: install the systemd unit that's part of
+      initrd fallback handling, missed when the feature landed.
+    - debian/patches/quick-boot-lvm.patch: If we don't have writable
+      grubenv and we're on EFI, always show the menu.
+    - debian/patches/mkconfig_leave_breadcrumbs.patch: make sure grub-mkconfig
+      leaves a trace of what files were sourced to help generate the config
+      we're building.
+    - debian/patches/linuxefi_truncate_overlong_reloc_section.patch: Windows
+      7 bootloader has inconsistent headers; truncate to the smaller, correct
+      size to fix chainloading Windows 7.
+    - debian/patches/linuxefi_fix_relocate_coff.patch: fix typo in
+      relocate_coff() causing issues with relocation of code in chainload.
+    - debian/patches/add-initrd-less-boot-fallback.patch: add initrd-less
+      capabilities. If a kernel fails to boot without initrd, we will fallback
+      to trying to boot the kernel with an initrd. Patch by Chris Glass.
+    - debian/patches/grub-reboot-warn.patch: Warn when "for the next
+      boot only" promise cannot be kept.
+  * Refreshed patches and fixed up attribution to the right authors after
+    merge with Debian.
+  * debian/patches/linuxefi_missing_include.patch,
+    debian/patches/linuxefi_fixing_more_errors.patch: Apply some additional
+    small fixes to casts, format strings, includes and Makefile to make sure
+    the newer linuxefi patches apply and build properly.
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Tue, 05 Mar 2019 17:05:09 -0500
+
 grub2 (2.02+dfsg1-12) unstable; urgency=medium
 
   [ Colin Watson ]
@@ -1421,6 +3404,175 @@ grub2 (2.02+dfsg1-6) unstable; urgency=m
 
  -- Colin Watson <cjwatson@debian.org>  Tue, 28 Aug 2018 16:17:21 +0100
 
+grub2 (2.02+dfsg1-5ubuntu11) disco; urgency=medium
+
+  [ Mathieu Trudel-Lapierre ]
+  * debian/grub-check-signatures: properly account for DB showing as empty on
+    some broken firmwares: Guard against mokutil --export --db failing, and do
+    a better job at finding the DER certs for conversion to PEM format.
+    (LP: #1814575)
+
+  [ Steve Langasek ]
+  * debian/patches/quick-boot-lvm.patch: checking the return value of
+    'lsefi' when the command doesn't exist does not do what's expected, so
+    instead check the value of $grub_platform which is simpler anyway.
+    LP: #1814403.
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Mon, 04 Feb 2019 17:51:15 -0500
+
+grub2 (2.02+dfsg1-5ubuntu10) disco; urgency=medium
+
+  * debian/grub-check-signatures: check kernel signatures against keys known
+    in firmware, in case a kernel is signed but not using a key that will pass
+    validation, such as when using kernels coming from a PPA. (LP: #1789918)
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Mon, 21 Jan 2019 09:34:36 -0500
+
+grub2 (2.02+dfsg1-5ubuntu9) disco; urgency=medium
+
+  [ Steve Langasek ]
+  * debian/patches/quick-boot-lvm.patch: If we don't have writable
+    grubenv and we're on EFI, always show the menu.  Closes LP: #1800722.
+
+  [ Mathieu Trudel-Lapierre ]
+  * debian/patches/mkconfig_leave_breadcrumbs.patch: make sure grub-mkconfig
+    leaves a trace of what files were sourced to help generate the config
+    we're building.
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Mon, 07 Jan 2019 17:32:01 -0500
+
+grub2 (2.02+dfsg1-5ubuntu8) cosmic; urgency=medium
+
+  * debian/patches/grub-install-extra-removable.patch: install mmx64.efi to
+    the EFI removable path to avoid boot failures after install when certs
+    need to be enrolled and the system's firmware is confused. (LP: #1798171)
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Wed, 17 Oct 2018 14:44:49 -0400
+
+grub2 (2.02+dfsg1-5ubuntu7) cosmic; urgency=medium
+
+  [ Steve Langasek ]
+  * debian/grub-common.install.in: install the systemd unit that's part of
+    initrd fallback handling, missed when the feature landed.
+
+  [ Mathieu Trudel-Lapierre ]
+  * debian/rules: set DEFAULT_TIMEOUT to 0 if we've enabled FLICKER_FREE_BOOT,
+    to avoid unnecessary delay at boot time. (LP: #1784363)
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Fri, 12 Oct 2018 11:10:10 -0400
+
+grub2 (2.02+dfsg1-5ubuntu6) cosmic; urgency=medium
+
+  [ Steve Langasek ]
+  * debian/grub-check-signatures: Handle the case where we have unsigned
+    vmlinuz and signed vmlinuz.efi.signed. (LP: #1788727)
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Wed, 03 Oct 2018 14:59:05 -0400
+
+grub2 (2.02+dfsg1-5ubuntu5) cosmic; urgency=medium
+
+  [ Mathieu Trudel-Lapierre ]
+  * debian/patches/linuxefi_truncate_overlong_reloc_section.patch: The Windows
+    7 bootloader has inconsistent headers; truncate to the smaller, correct
+    size to fix chainloading Windows 7.
+
+  [ Steve Langasek ]
+  * debian/rules, debian/control: enable dh-systemd.
+  * debian/patches/add-initrd-less-boot-fallback.patch: add initrd-less
+    capabilities. If a kernel fails to boot without initrd, grub will fallback
+    to trying to boot the kernel with an initrd. Patch by Chris Glass.
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Tue, 25 Sep 2018 16:05:13 -0400
+
+grub2 (2.02+dfsg1-5ubuntu4) cosmic; urgency=medium
+
+  * debian/patches/linuxefi_fix_relocate_coff.patch: fix typo in
+    relocate_coff() causing issues with relocation of code in chainload.
+    (LP: #1792575)
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Mon, 17 Sep 2018 07:45:49 -0400
+
+grub2 (2.02+dfsg1-5ubuntu3) cosmic; urgency=medium
+
+  * debian/patches/grub-reboot-warn.patch: Warn when "for the next
+    boot only" promise cannot be kept. (LP: #788298)
+
+ -- dann frazier <dannf@ubuntu.com>  Thu, 13 Sep 2018 15:28:50 -0600
+
+grub2 (2.02+dfsg1-5ubuntu2) cosmic; urgency=medium
+
+  * debian/patches/add_ext_lfb_base_support.patch: i386/linux: Add support for
+    ext_lfb_base. (LP: #1785033)
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Wed, 05 Sep 2018 14:29:04 -0400
+
+grub2 (2.02+dfsg1-5ubuntu1) cosmic; urgency=medium
+
+  [ Mathieu Trudel-Lapierre]
+  * Merge against Debian unstable; remaining changes:
+    - debian/control: Update Vcs fields for code location on Ubuntu.
+    - debian/control: Breaks shim (<< 13).
+    - Secure Boot support: use newer patchset from rhboot repo:
+      - many linuxefi_* patches added and modified
+      - dropped debian/patches/linuxefi_require_shim.patch
+      - renamed: debian/patches/no_insmod_on_sb.patch ->
+        debian/patches/linuxefi_no_insmod_on_sb.patch
+    - debian/patches/install_signed.patch, grub-install-extra-removable.patch:
+      - Make sure if we install shim; it should also be exported as the default
+        bootloader to install later to a removable path, if we do.
+      - Rework grub-install-extra-removable.patch to reverse its logic: in the
+        default case, install the bootloader to /EFI/BOOT, unless we're trying
+        to install on a removable device, or explicitly telling grub *not* to
+        do it.
+      - Move installing fb$arch.efi to --no-extra-removable; as we don't want
+        fallback to be installed unless we're also installing to /EFI/BOOT.
+        (LP: #1684341)
+      - Install a BOOT.CSV for fallback to use.
+      - Make sure postinst and templates know about the replacement of
+        --force-extra-removable with --no-extra-removable.
+    - debian/patches/add-an-auto-nvram-option-to-grub-install.patch: Add the
+      --auto-nvram option to grub-install for auto-detecting NVRAM availability
+      before attempting NVRAM updates.
+    - debian/build-efi-images: provide a new grub EFI image which enforces that
+      loaded kernels are signed for Secure Boot: build gsb$arch.efi; which is
+      the same as grub$arch.efi minus the 'linux' module. Without fallback to
+      'linux' for unsigned loading, this makes it effectively enforce having a
+      signed kernel. (LP: #1401532)
+    - Verify that the current and newer kernels are signed when grub is
+      updated, to make sure people do not accidentally shutdown without a
+      signed kernel.
+    - debian/default/grub: replace GRUB_HIDDEN_* variables with the less
+      confusing GRUB_TIMEOUT_STYLE=hidden. (LP: #1258597)
+    - debian/patches/support_initrd-less_boot.patch: Added knobs to allow
+      non-initrd boot config. (LP: #1640878)
+    - Disable os-prober for ppc64el on the PowerNV platform, to reduce the
+      number of entries/clutter from other OSes in Petitboot (LP: #1447500)
+    - debian/patches/shorter_version_info.patch: Only show the upstream version
+      in menu and console, and hide the package one in a package_version
+      variable. (LP: #1723434)
+    - debian/patches/skip_text_gfxpayload_where_not_supported.patch: Skip the
+      'text' payload if it's not supported but present in gfxpayload, such as
+      on EFI systems. (LP: #1711452)
+    - debian/patches/bufio_sensible_block_sizes.patch: Don't use arbitrary file
+      fizes as block sizes in bufio: this avoids potentially seeking back in
+      the files unnecessarily, which may require re-open files that cannot be
+      seeked into, such as via TFTP. (LP: #1743249)
+    * util/grub-install.c: Drop extra handling for x.efi.signed files for mok
+      and fallback binaries: shim now installs them without the .signed
+      extension. (LP: #1708245)
+    - debian/patches/dont-fail-efi-warnings.patch: handle linuxefi patches and
+      the casting they do on some architectures: we don't want to fail build
+      because of some of the warnings that can show up since we otherwise build
+      with -Werror.
+  * debian/rules: shuffle files around for now to keep putting build artefacts
+    for signing at the same location as they were expected by Launchpad.
+
+  [ Julian Andres Klode ]
+  * debian/patches/ofnet-init-structs-in-bootpath-parser.patch: initialize
+    structs in bootpath parser. Fixes netboot issues on ppc64el. (LP: #1785859)
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Thu, 23 Aug 2018 15:00:14 -0400
+
 grub2 (2.02+dfsg1-5) unstable; urgency=medium
 
   [ Colin Watson ]
@@ -1517,6 +3669,171 @@ grub2 (2.02-3) unstable; urgency=medium
 
  -- Colin Watson <cjwatson@debian.org>  Sat, 10 Feb 2018 03:00:30 +0000
 
+grub2 (2.02-2ubuntu13) cosmic; urgency=medium
+
+  * debian/patches/tests_update_for_new_qemu.patch: update qemu options to
+    remove deprecated options that fail tests.
+  * debian/patches: fix up busted patches due to git-dpm:
+    - debian/patches/add-an-auto-nvram-option-to-grub-install.patch
+    - debian/patches/grub-shell-test-helper-disable-seabios-sercon.patch
+  * debian/patches/r_x86_64_plt32-is-like-r_x86_64_pc32.patch: For the purpose
+    of grub-mkimage, the R_X86_64_PLT32 relocation is basically the same as
+    R_X86_64_PC32. Make R_X86_64_PLT32 supported.
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Thu, 19 Jul 2018 09:46:53 -0400
+
+grub2 (2.02-2ubuntu12) cosmic; urgency=medium
+
+  * debian/default/grub: replace GRUB_HIDDEN_* variables with the more concise
+    and less confusing GRUB_TIMEOUT_STYLE=hidden. (LP: #1258597)
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Mon, 16 Jul 2018 14:18:46 -0400
+
+grub2 (2.02-2ubuntu11) cosmic; urgency=medium
+
+  * Verify that the current and newer kernels are signed when grub is updated, to
+    make sure people do not accidentally shutdown without a signed kernel.
+
+ -- Julian Andres Klode <juliank@ubuntu.com>  Fri, 13 Jul 2018 15:21:48 +0200
+
+grub2 (2.02-2ubuntu10) cosmic; urgency=medium
+
+  * debian/patches/grub-shell-test-helper-disable-seabios-sercon.patch: In the
+    grub-shell test helper, disable seabios's serial console through fw_cfg
+    runtime configuration as its boot output interferes with testing.
+    (LP: #1775249)
+
+ -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Wed, 06 Jun 2018 01:03:26 +0200
+
+grub2 (2.02-2ubuntu9) cosmic; urgency=medium
+
+  * debian/patches/add-an-auto-nvram-option-to-grub-install.patch: Add the
+    --auto-nvram option to grub-install for auto-detecting NVRAM availability
+    before attempting NVRAM updates.
+
+ -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Tue, 05 Jun 2018 00:34:38 +0200
+
+grub2 (2.02-2ubuntu8) bionic; urgency=medium
+
+  * Drop debian/patches/mkconfig_keep_native_term_active.patch, which can
+    lead to flickering between graphical and text mode when traversing the
+    menu. (LP: #1752767)
+  * debian/patches/yylex-explicitly_cast_fprintf_to_void.patch: Fix FTBFS
+    with flex 2.6.4.
+
+ -- dann frazier <dannf@ubuntu.com>  Sun, 04 Mar 2018 06:11:35 -0700
+
+grub2 (2.02-2ubuntu7) bionic; urgency=medium
+
+  [ Julian Andres Klode ]
+  * debian/patches/shorter_version_info.patch: Only show the upstream version
+    in menu and console, and hide the package one in a package_version
+    variable. (LP: #1723434)
+
+  [ Mathieu Trudel-Lapierre ]
+  * debian/patches/skip_text_gfxpayload_where_not_supported.patch: Skip the
+    'text' payload if it's not supported but present in gfxpayload, such as
+    on EFI systems. (LP: #1711452)
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Fri, 09 Feb 2018 16:30:45 -0500
+
+grub2 (2.02-2ubuntu6) bionic; urgency=medium
+
+  [ Steve Langasek ]
+  * debian/patches/bufio_sensible_block_sizes.patch: Don't use arbitrary file
+    fizes as block sizes in bufio: this avoids potentially seeking back in
+    the files unnecessarily, which may require re-open files that cannot be
+    seeked into, such as via TFTP. (LP: #1743249)
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Mon, 05 Feb 2018 11:58:09 -0500
+
+grub2 (2.02-2ubuntu5) bionic; urgency=medium
+
+  * debian/patches/mkconfig_keep_native_term_active.patch: Keep the
+    default EFI console active while enabling gfxterm. (LP: #1743884)
+
+ -- dann frazier <dannf@ubuntu.com>  Wed, 31 Jan 2018 10:51:11 -0700
+
+grub2 (2.02-2ubuntu4) bionic; urgency=medium
+
+  * debian/patches/vt_handoff.patch: modify the existing patch to set
+    vt.handoff=1 instead of vt.handoff=7 as we now start display managers on
+    vt1 anyway. This also fixes issues with netboot installed server systems
+    not displaying the login prompt on boot. (LP: #1675453)
+
+ -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Thu, 18 Jan 2018 18:32:31 +0100
+
+grub2 (2.02-2ubuntu3) bionic; urgency=medium
+
+  * util/grub-install.c: Drop extra handling for x.efi.signed files for mok
+    and fallback binaries: shim now installs them without the .signed
+    extension. (LP: #1708245)
+  * debian/control: Breaks shim (<< 13).
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Wed, 17 Jan 2018 09:25:09 -0500
+
+grub2 (2.02-2ubuntu2) bionic; urgency=medium
+
+  * Cherry-pick upstream patch to change the default TSC calibration method
+    to pmtimer on EFI systems (LP: #1734278)
+  * debian/control: Update Vcs fields for code location on Ubuntu.
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Tue, 05 Dec 2017 11:47:31 -0500
+
+grub2 (2.02-2ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - debian/patches/support_initrd-less_boot.patch: Added knobs to allow
+      non-initrd boot config. (LP: #1640878)
+    - Disable os-prober for ppc64el on the PowerNV platform, to reduce the
+      number of entries/clutter from other OSes in Petitboot (LP: #1447500)
+    - debian/build-efi-images: provide a new grub EFI image which enforces that
+      loaded kernels are signed for Secure Boot: build gsb$arch.efi; which is
+      the same as grub$arch.efi minus the 'linux' module. Without fallback to
+      'linux' for unsigned loading, this makes it effectively enforce having a
+      signed kernel. (LP: #1401532)
+    - debian/patches/install_signed.patch, grub-install-extra-removable.patch:
+      - Make sure if we install shim; it should also be exported as the default
+        bootloader to install later to a removable path, if we do.
+      - Rework grub-install-extra-removable.patch to reverse its logic: in the
+        default case, install the bootloader to /EFI/BOOT, unless we're trying
+        to install on a removable device, or explicitly telling grub *not* to
+        do it.
+      - Move installing fb$arch.efi to --no-extra-removable; as we don't want
+        fallback to be installed unless we're also installing to /EFI/BOOT.
+        (LP: #1684341)
+      - Make sure postinst and templates know about the replacement of
+        --force-extra-removable with --no-extra-removable.
+  * Sync Secure Boot support patches with the upstream patch set from
+    rhboot/grub2:master-sb. Renamed some patches and updated descriptions for
+    the whole thing to make more sense, too:
+    - dropped debian/patches/linuxefi_require_shim.patch
+    - renamed: debian/patches/no_insmod_on_sb.patch ->
+      debian/patches/linuxefi_no_insmod_on_sb.patch
+    - debian/patches/linuxefi.patch
+    - debian/patches/linuxefi_debug.patch
+    - debian/patches/linuxefi_non_sb_fallback.patch
+    - debian/patches/linuxefi_add_sb_to_efi_chainload.patch
+    - debian/patches/linuxefi_cleanup_errors_in_loader.patch
+    - debian/patches/linuxefi_fix_efi_validation_race.patch
+    - debian/patches/linuxefi_handle_multiarch_boot.patch
+    - debian/patches/linuxefi_honor_sb_mode.patch
+    - debian/patches/linuxefi_move_fdt_helper.patch
+    - debian/patches/linuxefi_load_arm_with_sb.patch
+    - debian/patches/linuxefi_minor_cleanups.patch
+    - debian/patches/linuxefi_re-enable_linux_cmd.patch
+    - debian/patches/linuxefi_rework_linux16_cmd.patch
+    - debian/patches/linuxefi_rework_linux_cmd.patch
+    - debian/patches/linuxefi_rework_non-sb_efi_chainload.patch
+    - debian/patches/linuxefi_rework_pe_loading.patch
+    - debian/patches/linuxefi_use_dev_chainloader_target.patch
+  * debian/patches/dont-fail-efi-warnings.patch: handle linuxefi patches and
+    the casting they do on some architectures: we don't want to fail build
+    because of some of the warnings that can show up since we otherwise build
+    with -Werror.
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Mon, 06 Nov 2017 15:37:12 -0500
+
 grub2 (2.02-2) unstable; urgency=medium
 
   * Comment out debian/watch lines for betas and pre-releases for now.
@@ -1553,6 +3870,92 @@ grub2 (2.02~beta3-5) unstable; urgency=m
 
  -- Colin Watson <cjwatson@debian.org>  Sat, 11 Feb 2017 15:09:19 +0000
 
+grub2 (2.02~beta3-4ubuntu7) artful; urgency=medium
+
+  * debian/patches/headers_for_device_macros.patch,
+    debian/patches/fix_check_for_sys_macros.patch: make sure the right
+    device macro header is included and that the deprecation warning
+    is dealt with. LP: #1722955.
+
+ -- Tiago Stürmer Daitx <tiago.daitx@ubuntu.com>  Thu, 12 Oct 2017 09:41:17 -0400
+
+grub2 (2.02~beta3-4ubuntu6) artful; urgency=medium
+
+  * debian/patches/mount-ext4-fs-with-crypto-enabled.patch: Allow grub to
+    mount an EXT4 partition that has the 'encrypt' feature enabled
+    (closes: 840204)
+
+ -- Tyler Hicks <tyhicks@canonical.com>  Wed, 05 Jul 2017 22:23:03 +0000
+
+grub2 (2.02~beta3-4ubuntu5) artful; urgency=medium
+
+  * debian/patches/linuxefi.patch: fix double-free caused by an extra
+    grub_free() call in this patch (which the previous upload didn't change).
+  * debian/patches/linuxefi_rework_non-sb_cases.patch,
+    debian/patches/linuxefi_non_sb_fallback.patch: refreshed.
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Mon, 29 May 2017 16:28:41 -0400
+
+grub2 (2.02~beta3-4ubuntu4) artful; urgency=medium
+
+  * debian/patches: Rework linuxefi/SecureBoot support and sync with upstream
+    SB patch set:
+    - linuxefi_arm_sb_support.patch: add Secure Boot support for arm for its
+      chainloader.
+    - linuxefi_fix_validation_race.patch: Fix a race in validating images.
+    - linuxefi_chainloader_path.patch: honor the starting path for grub, so
+      images do not need to be started from $root.
+    - linuxefi_chainloader_sb.patch: Fix some more issues in chainloader use
+      when Secure Boot is enabled.
+    - linuxefi_loaders_enforce_sb.patch: Enforce Secure Boot policy for all
+      loaders: don't load the commands when Secure Boot is enabled.
+    - linuxefi_re-enable_linux_cmd.patch: Since we rely on the linux and
+      initrd commands to automatically hand-off to linuxefi/initrdefi; re-
+      enable the linux loader.
+    - linuxefi_chainloader_pe_fixes.patch: PE parsing fixes for chainloading
+      "special" PE images, such as Windows'.
+    - linuxefi_rework_non-sb_cases.patch: rework cases where Secure Boot is
+      disabled or shim validation is disabled so loading works as EFI binaries
+      when it is supposed to.
+    - Removed linuxefi_require_shim.patch; superseded by the above.
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Thu, 11 May 2017 17:05:04 -0400
+
+grub2 (2.02~beta3-4ubuntu3) artful; urgency=medium
+
+  * debian/patches/install_signed.patch, grub-install-extra-removable.patch:
+    - Make sure if we install shim; it should also be exported as the default
+      bootloader to install later to a removable path, if we do.
+    - Rework grub-install-extra-removable.patch to reverse its logic: in the
+      default case, install the bootloader to /EFI/BOOT, unless we're trying
+      to install on a removable device, or explicitly telling grub *not* to
+      do it.
+    - Move installing fb$arch.efi to --no-extra-removable; as we don't want
+      fallback to be installed unless we're also installing to /EFI/BOOT.
+      (LP: #1684341)
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Wed, 26 Apr 2017 21:08:22 -0400
+
+grub2 (2.02~beta3-4ubuntu2) zesty; urgency=medium
+
+  * debian/build-efi-images: provide a new grub EFI image which enforces that
+    loaded kernels are signed for Secure Boot: build gsb$arch.efi; which is
+    the same as grub$arch.efi minus the 'linux' module. Without fallback to
+    'linux' for unsigned loading, this makes it effectively enforce having a
+    signed kernel. (LP: #1401532)
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Thu, 30 Mar 2017 17:45:23 -0400
+
+grub2 (2.02~beta3-4ubuntu1) zesty; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - debian/patches/support_initrd-less_boot.patch: Added knobs to allow
+      non-initrd boot config. (LP: #1640878)
+    - Disable os-prober for ppc64el on the PowerNV platform, to reduce the
+      number of entries/clutter from other OSes in Petitboot (LP: #1447500)
+
+ -- dann frazier <dannf@ubuntu.com>  Thu, 09 Feb 2017 10:06:57 -0700
+
 grub2 (2.02~beta3-4) unstable; urgency=medium
 
   [ Colin Watson ]
diff -pruN 2.14~git20250718.0e36779-1/debian/control 2.14~git20250718.0e36779-1ubuntu4/debian/control
--- 2.14~git20250718.0e36779-1/debian/control	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/control	2025-09-09 15:55:15.000000000 +0000
@@ -1,11 +1,14 @@
 Source: grub2
 Section: admin
 Priority: optional
-Maintainer: GRUB Maintainers <pkg-grub-devel@alioth-lists.debian.net>
+Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
+XSBC-Original-Maintainer: GRUB Maintainers <pkg-grub-devel@alioth-lists.debian.net>
 Uploaders: Felix Zielcke <fzielcke@z-51.de>, Jordi Mallach <jordi@debian.org>, Steve McIntyre <93sam@debian.org>, Julian Andres Klode <jak@debian.org>, Mate Kukri <mate.kukri@canonical.com>
 Build-Depends: debhelper-compat (= 13),
  patchutils,
  python3,
+ python3-apt,
+ python3-pytest,
  flex,
  bison,
  gawk,
@@ -38,8 +41,8 @@ Build-Depends: debhelper-compat (= 13),
 Build-Conflicts: autoconf2.13, libzfs-dev, libnvpair-dev
 Standards-Version: 3.9.6
 Homepage: https://www.gnu.org/software/grub/
-Vcs-Git: https://salsa.debian.org/grub-team/grub.git
-Vcs-Browser: https://salsa.debian.org/grub-team/grub
+Vcs-Git: https://git.launchpad.net/~ubuntu-core-dev/grub/+git/ubuntu
+Vcs-Browser: https://git.launchpad.net/~ubuntu-core-dev/grub/+git/ubuntu
 Rules-Requires-Root: no
 
 Package: grub2
@@ -64,15 +67,24 @@ Description: GRand Unified Bootloader, v
 Package: grub-efi
 Architecture: any-i386 any-amd64 any-arm64 any-arm any-riscv64 any-loong64
 Pre-Depends: ${misc:Pre-Depends}
-Depends: ${misc:Depends}, grub-efi-ia32 (= ${binary:Version}) [any-i386], grub-efi-amd64 (= ${binary:Version}) [any-amd64], grub-efi-arm64 (= ${binary:Version}) [any-arm64], grub-efi-arm (= ${binary:Version}) [any-arm], grub-efi-riscv64 (= ${binary:Version}) [any-riscv64], grub-efi-loong64 (= ${binary:Version}) [any-loong64]
+Depends: ${misc:Depends}, grub-efi-ia32 (>= ${binary:Version}) [any-i386], grub-efi-amd64 [any-amd64], grub-efi-arm64 [any-arm64], grub-efi-arm (>= ${binary:Version}) [any-arm], grub-efi-riscv64 (>= ${binary:Version}) [any-riscv64], grub-efi-loong64 (>= ${binary:Version}) [any-loong64]
 Multi-Arch: foreign
 Description: GRand Unified Bootloader, version 2 (dummy package)
  This is a dummy package that depends on the grub-efi-$ARCH package most likely
  to be appropriate for each architecture.
 
+Package: grub-common
+Architecture: any
+Pre-Depends: ${misc:Pre-Depends}
+Depends: grub2-common (>= 2.14~), ${misc:Depends}
+Multi-Arch: foreign
+Description: GRand Unified Bootloader, version 2 (dummy package)
+ This is a dummy transitional package that depends on grub2-common.
+ It can be safely removed.
+
 Package: grub2-common
 Architecture: any
-Depends: ${shlibs:Depends}, ${misc:Depends}, gettext-base
+Depends: ${shlibs:Depends}, ${misc:Depends}, gettext-base, python3, python3-apt
 Recommends: os-prober
 Suggests: multiboot-doc, grub-emu [any-i386 any-amd64 any-powerpc], mtools [any-i386 any-amd64 any-arm any-arm64 riscv64 any-loong64], xorriso, desktop-base, console-setup
 Replaces: grub, grub-legacy, grub-common
@@ -315,8 +327,8 @@ Description: GRand Unified Bootloader, v
  This is only needed for Secure Boot signing.
 
 Package: grub-efi-amd64-bin
-Architecture: i386 any-amd64
-Depends: ${shlibs:Depends}, ${misc:Depends}, grub2-common (= ${binary:Version}), grub-efi-amd64-unsigned
+Architecture: any-amd64
+Depends: ${shlibs:Depends}, ${misc:Depends}, grub-common (>= 2.02~beta2-9), grub-efi-amd64-unsigned
 Recommends: grub-efi-amd64-signed [amd64], efibootmgr [linux-any]
 Replaces: grub2 (<< ${source:Version})
 Breaks: grub-efi-amd64-signed (<< 1+2.12~rc1)
@@ -340,8 +352,8 @@ Description: GRand Unified Bootloader, v
  installed.
 
 Package: grub-efi-amd64-unsigned
-Architecture: i386 any-amd64
-Depends: ${shlibs:Depends}, ${misc:Depends}, grub2-common (= ${binary:Version})
+Architecture: any-amd64
+Depends: ${shlibs:Depends}, ${misc:Depends}, grub-common (>= 2.02~beta2-9)
 Replaces: grub-efi-amd64-bin (<< 2.12-3~)
 Breaks: grub-efi-amd64-bin (<< 2.12-3~)
 Multi-Arch: foreign
@@ -365,17 +377,17 @@ Description: GRand Unified Bootloader, v
 
 Package: grub-efi-amd64-dbg
 Section: debug
-Architecture: i386 any-amd64
-Depends: ${misc:Depends}, grub-efi-amd64-bin (= ${binary:Version}), grub2-common (= ${binary:Version})
+Architecture: any-amd64
+Depends: ${misc:Depends}, grub-efi-amd64-bin (= ${binary:Version})
 Multi-Arch: foreign
 Description: GRand Unified Bootloader, version 2 (EFI-AMD64 debug files)
  This package contains debugging files for grub-efi-amd64-bin.  You only
  need these if you are trying to debug GRUB using its GDB stub.
 
 Package: grub-efi-amd64
-Architecture: i386 any-amd64
+Architecture: any-amd64
 Pre-Depends: ${misc:Pre-Depends}
-Depends: ${shlibs:Depends}, ${misc:Depends}, grub2-common (= ${binary:Version}), grub-efi-amd64-bin (= ${binary:Version}), ucf
+Depends: ${shlibs:Depends}, ${misc:Depends}, grub2-common (>= 2.02~beta2-9), grub-efi-amd64-bin (= ${binary:Version}), ucf
 Replaces: grub, grub-legacy, grub2 (<< ${source:Version}), grub-pc, grub-efi-ia32, grub-coreboot, grub-ieee1275
 Conflicts: grub, grub-legacy, grub-efi-ia32, grub-pc, grub-coreboot, grub-ieee1275, grub-xen, elilo
 Multi-Arch: foreign
@@ -476,7 +488,7 @@ Description: GRand Unified Bootloader, v
 
 Package: grub-efi-arm64-bin
 Architecture: any-arm64
-Depends: ${shlibs:Depends}, ${misc:Depends}, grub2-common (= ${binary:Version}), grub-efi-arm64-unsigned
+Depends: ${shlibs:Depends}, ${misc:Depends}, grub-common (>= 2.02~beta2-9), grub-efi-arm64-unsigned
 Breaks: grub-efi-arm64-signed (<< 1+2.12~rc1)
 Recommends: grub-efi-arm64-signed [arm64], efibootmgr [linux-any]
 Multi-Arch: foreign
@@ -499,7 +511,7 @@ Description: GRand Unified Bootloader, v
 
 Package: grub-efi-arm64-unsigned
 Architecture: any-arm64
-Depends: ${shlibs:Depends}, ${misc:Depends}, grub2-common (= ${binary:Version})
+Depends: ${shlibs:Depends}, ${misc:Depends}, grub-common (>= 2.02~beta2-9)
 Breaks: grub-efi-arm64-bin (<< 2.12-3~)
 Replaces: grub-efi-arm64-bin (<< 2.12-3~)
 Multi-Arch: foreign
@@ -523,7 +535,7 @@ Description: GRand Unified Bootloader, v
 Package: grub-efi-arm64-dbg
 Section: debug
 Architecture: any-arm64
-Depends: ${misc:Depends}, grub-efi-arm64-bin (= ${binary:Version}), grub2-common (= ${binary:Version})
+Depends: ${misc:Depends}, grub-efi-arm64-bin (= ${binary:Version})
 Multi-Arch: foreign
 Description: GRand Unified Bootloader, version 2 (ARM64 UEFI debug files)
  This package contains debugging files for grub-efi-arm64-bin.  You only
@@ -532,7 +544,7 @@ Description: GRand Unified Bootloader, v
 Package: grub-efi-arm64
 Architecture: any-arm64
 Pre-Depends: ${misc:Pre-Depends}
-Depends: ${shlibs:Depends}, ${misc:Depends}, grub2-common (= ${binary:Version}), grub-efi-arm64-bin (= ${binary:Version}), ucf
+Depends: ${shlibs:Depends}, ${misc:Depends}, grub2-common (>= 2.02~beta2-36ubuntu3.32), grub-efi-arm64-bin (= ${binary:Version}), ucf
 Multi-Arch: foreign
 Description: GRand Unified Bootloader, version 2 (ARM64 UEFI version)
  GRUB is a portable, powerful bootloader.  This version of GRUB is based on a
diff -pruN 2.14~git20250718.0e36779-1/debian/grub-check-signatures 2.14~git20250718.0e36779-1ubuntu4/debian/grub-check-signatures
--- 2.14~git20250718.0e36779-1/debian/grub-check-signatures	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub-check-signatures	2025-08-19 13:14:06.000000000 +0000
@@ -0,0 +1,136 @@
+#!/bin/sh
+
+set -e
+
+. /usr/share/debconf/confmodule
+
+# Check if we are on an EFI system
+efivars=/sys/firmware/efi/efivars
+secureboot_var=SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c
+moksbstatert_var=MokSBStateRT-605dab50-e046-4300-abb6-3dd810dd8b23
+tmpdir=$(mktemp -d)
+
+on_secure_boot() {
+	# Validate any queued actions before we go try to do them.
+	local moksbstatert=0
+
+	if ! [ -d $efivars ]; then
+		return 1
+	fi
+
+	if ! [ -f $efivars/$secureboot_var ] \
+		|| [ "$(od -An -t u1 $efivars/$secureboot_var | awk '{ print $NF }')" -ne 1 ]
+	then
+		return 1
+	fi
+
+	if [ -f /proc/sys/kernel/moksbstate_disabled ]; then
+		moksbstatert=$(cat /proc/sys/kernel/moksbstate_disabled 2>/dev/null || echo 0)
+	elif [ -f $efivars/$moksbstatert_var ]; then
+		# MokSBStateRT set to 1 means validation is disabled
+		moksbstatert=$(od -An -t u1 $efivars/$moksbstatert_var | \
+					   awk '{ print $NF; }')
+	fi
+
+	if [ $moksbstatert -eq 1 ]; then
+		return 1
+	fi
+
+	return 0
+}
+
+# Retrieve the keys we do trust from PK, DB, KEK, and MokList.
+extract_known_keys() {
+	# Make the Canonical CA cert available for validation too; in case
+	# MokListRT is empty due to a bug.
+	cp /usr/share/grub/canonical-uefi-ca.crt $tmpdir
+
+	# Extract known UEFI certs from firmware variables
+	( cd $tmpdir; \
+		mokutil --export --db >/dev/null 2>/dev/null; \
+		mokutil --export --mok >/dev/null 2>/dev/null; )
+	find $tmpdir -name "*.der" -exec openssl x509 -inform der -in {} -outform pem -out {}.crt  \;
+}
+
+# Check if a given kernel image is signed
+is_signed() {
+	kernel=$1
+	tmp=$(mktemp)
+	kernel_tmp=$(mktemp)
+	if zcat $kernel > $kernel_tmp 2>/dev/null; then
+		kernel=$kernel_tmp
+	fi
+	sbattach --detach $tmp $kernel >/dev/null 2>/dev/null 	# that's ugly...
+	test "$(wc -c < $tmp)" -ge 16	# Just _some_ minimum size
+	result=$?
+	if [ $result -eq 0 ]; then
+		sig_subject=$(openssl pkcs7 -inform der -in $tmp -print_certs | openssl x509 -noout -text | grep Subject: )
+	fi
+	rm $tmp
+	if [ $result -eq 0 ]; then
+		for crtfile in $tmpdir/*.crt; do
+			sbverify --cert $crtfile $kernel >/dev/null 2>/dev/null
+			result=$?
+			if [ $result -eq 0 ]; then
+				rm "$kernel_tmp"
+				return $result;
+			fi
+		done
+		echo "$1 is signed, but using an unknown key:" >&2
+		echo "$sig_subject" >&2
+	else
+		echo "$1 is unsigned." >&2
+	fi
+	rm "$kernel_tmp"
+	return $result
+}
+
+# Check that our current kernel and every newer one is signed
+find_unsigned() {
+	uname_r="$(uname -r)"
+	for kernel in $(ls -1 /boot/vmlinuz-* | sort -V -r); do
+		# no kernels :(
+		if [ "$kernel" = "/boot/vmlinuz-*" ]; then
+			break
+		fi
+		this_uname_r="$(echo "$kernel" | sed -r 's#^/boot/vmlinuz-(.*)#\1#; s#\.efi\.signed$##')"
+		if dpkg --compare-versions "$this_uname_r" lt "$uname_r"; then
+			continue
+		fi
+		if [ -e "$kernel.efi.signed" ]; then
+			continue
+		fi
+		if ! is_signed $kernel; then
+			echo "$this_uname_r"
+		fi
+	done
+}
+
+# Only reached from show_warning
+error() {
+	echo "E: Your kernels are not signed with a key known to your firmware. This system will fail to boot in a Secure Boot environment." >&2
+	exit 1
+}
+
+# Either shows a debconf note or prints an error with error() above if
+# that fails
+show_warning() {
+	# kernels should be an indented list of one version per line
+	escaped="$(printf "%s" "$unsigned" | sed "s#^#     #" | debconf-escape -e )"
+	db_capb escape
+	db_settitle grub2/unsigned_kernels_title || error
+	db_fset grub2/unsigned_kernels seen 0 || error
+	db_subst grub2/unsigned_kernels unsigned_versions "$escaped" || error
+	db_input critical grub2/unsigned_kernels || error
+	db_go || error
+	error
+}
+
+if on_secure_boot; then
+	extract_known_keys
+	unsigned="$(find_unsigned)"
+	if [ -n "$unsigned" ]; then
+		show_warning "$unsigned"
+	fi
+	rm -rf "$tmpdir"
+fi
diff -pruN 2.14~git20250718.0e36779-1/debian/grub-ieee1275-bin.install.powerpc.in 2.14~git20250718.0e36779-1ubuntu4/debian/grub-ieee1275-bin.install.powerpc.in
--- 2.14~git20250718.0e36779-1/debian/grub-ieee1275-bin.install.powerpc.in	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub-ieee1275-bin.install.powerpc.in	2025-08-19 13:14:06.000000000 +0000
@@ -1,3 +1,4 @@
 usr/lib/grub/@CPU_PLATFORM@/bootinfo.txt
 usr/lib/grub/@CPU_PLATFORM@/grub.chrp
 ../../debian/prep-bootdev usr/lib/grub/@CPU_PLATFORM@
+eltorito.elf usr/lib/grub/@CPU_PLATFORM@
diff -pruN 2.14~git20250718.0e36779-1/debian/grub-ieee1275-bin.install.ppc64.in 2.14~git20250718.0e36779-1ubuntu4/debian/grub-ieee1275-bin.install.ppc64.in
--- 2.14~git20250718.0e36779-1/debian/grub-ieee1275-bin.install.ppc64.in	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub-ieee1275-bin.install.ppc64.in	2025-08-19 13:14:06.000000000 +0000
@@ -1,3 +1,4 @@
 usr/lib/grub/@CPU_PLATFORM@/bootinfo.txt
 usr/lib/grub/@CPU_PLATFORM@/grub.chrp
 ../../debian/prep-bootdev usr/lib/grub/@CPU_PLATFORM@
+eltorito.elf usr/lib/grub/@CPU_PLATFORM@
diff -pruN 2.14~git20250718.0e36779-1/debian/grub-ieee1275-bin.install.ppc64el.in 2.14~git20250718.0e36779-1ubuntu4/debian/grub-ieee1275-bin.install.ppc64el.in
--- 2.14~git20250718.0e36779-1/debian/grub-ieee1275-bin.install.ppc64el.in	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub-ieee1275-bin.install.ppc64el.in	2025-08-19 13:14:06.000000000 +0000
@@ -1,3 +1,4 @@
 usr/lib/grub/@CPU_PLATFORM@/bootinfo.txt
 usr/lib/grub/@CPU_PLATFORM@/grub.chrp
 ../../debian/prep-bootdev usr/lib/grub/@CPU_PLATFORM@
+eltorito.elf usr/lib/grub/@CPU_PLATFORM@
diff -pruN 2.14~git20250718.0e36779-1/debian/grub-ieee1275.install.sparc.in 2.14~git20250718.0e36779-1ubuntu4/debian/grub-ieee1275.install.sparc.in
--- 2.14~git20250718.0e36779-1/debian/grub-ieee1275.install.sparc.in	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub-ieee1275.install.sparc.in	2025-09-08 10:56:27.000000000 +0000
@@ -1,2 +1,3 @@
 usr/sbin/grub-sparc64-setup
 usr/share/man/man8/grub-sparc64-setup.8
+usr/share/bash-completion/completions/grub-sparc64-setup
diff -pruN 2.14~git20250718.0e36779-1/debian/grub-ieee1275.install.sparc64.in 2.14~git20250718.0e36779-1ubuntu4/debian/grub-ieee1275.install.sparc64.in
--- 2.14~git20250718.0e36779-1/debian/grub-ieee1275.install.sparc64.in	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub-ieee1275.install.sparc64.in	2025-09-08 10:56:27.000000000 +0000
@@ -1,2 +1,3 @@
 usr/sbin/grub-sparc64-setup
 usr/share/man/man8/grub-sparc64-setup.8
+usr/share/bash-completion/completions/grub-sparc64-setup
diff -pruN 2.14~git20250718.0e36779-1/debian/grub-ieee1275.links.sparc.in 2.14~git20250718.0e36779-1ubuntu4/debian/grub-ieee1275.links.sparc.in
--- 2.14~git20250718.0e36779-1/debian/grub-ieee1275.links.sparc.in	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub-ieee1275.links.sparc.in	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-usr/share/bash-completion/completions/grub	usr/share/bash-completion/completions/grub-sparc64-setup
diff -pruN 2.14~git20250718.0e36779-1/debian/grub-ieee1275.links.sparc64.in 2.14~git20250718.0e36779-1ubuntu4/debian/grub-ieee1275.links.sparc64.in
--- 2.14~git20250718.0e36779-1/debian/grub-ieee1275.links.sparc64.in	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub-ieee1275.links.sparc64.in	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-usr/share/bash-completion/completions/grub	usr/share/bash-completion/completions/grub-sparc64-setup
diff -pruN 2.14~git20250718.0e36779-1/debian/grub-multi-install 2.14~git20250718.0e36779-1ubuntu4/debian/grub-multi-install
--- 2.14~git20250718.0e36779-1/debian/grub-multi-install	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub-multi-install	2025-09-08 10:56:27.000000000 +0000
@@ -0,0 +1,428 @@
+#!/bin/bash
+#
+# Install to multiple ESPs
+
+set -e
+
+# Most of this is copy-paste from grub postinst, sigh.
+
+. /usr/share/debconf/confmodule
+
+# shamelessly stolen from ucf:
+#
+# Load our templates, just in case our template has
+# not been loaded or the Debconf DB lost or corrupted
+# since then.
+db_x_loadtemplatefile "$(dpkg-query --control-path grub2-common templates)" grub2-common
+
+###############################################################################
+#                       COPY FROM POSTINST
+###############################################################################
+# This only works on a Linux system with udev running.  This is probably the
+# vast majority of systems where we need any of this, though, and we fall
+# back reasonably gracefully if we don't have it.
+cached_available_ids=
+available_ids()
+{
+  local id path
+
+  if [ "$cached_available_ids" ]; then
+    echo "$cached_available_ids"
+    return
+  fi
+
+  [ -d /dev/disk/by-id ] || return
+  cached_available_ids="$(
+    for path in /dev/disk/by-id/*; do
+      [ -e "$path" ] || continue
+      printf '%s %s\n' "$path" "$(readlink -f "$path")"
+    done | sort -k2 -s -u | cut -d' ' -f1
+  )"
+  echo "$cached_available_ids"
+}
+
+# Returns non-zero and no output if no mapping can be found.
+device_to_id()
+{
+  local id
+  for id in $(available_ids); do
+    if [ "$(readlink -f "$id")" = "$(readlink -f "$1")" ]; then
+      echo "$id"
+      return 0
+    fi
+  done
+  # Fall back to the plain device name if there's no by-id link for it.
+  if [ -e "$1" ]; then
+    echo "$1"
+    return 0
+  fi
+  return 1
+}
+
+# for Linux
+sysfs_size()
+{
+  local num_sectors sector_size size
+  # Try to find out the size without relying on a partitioning tool being
+  # installed. This isn't too hard on Linux 2.6 with sysfs, but we have to
+  # try a couple of variants on detection of the sector size.
+  if [ -e "$1/size" ]; then
+    num_sectors="$(cat "$1/size")"
+    sector_size=512
+    if [ -e "$1/queue/logical_block_size" ]; then
+      sector_size="$(cat "$1/queue/logical_block_size")"
+    elif [ -e "$1/queue/hw_sector_size" ]; then
+      sector_size="$(cat "$1/queue/hw_sector_size")"
+    fi
+    size="$(expr "$num_sectors" \* "$sector_size" / 1000 / 1000)"
+  fi
+  [ "$size" ] || size='???'
+  echo "$size"
+}
+
+# for kFreeBSD
+camcontrol_size()
+{
+  local num_sectors sector_size size=
+
+  if num_sectors="$(camcontrol readcap "$1" -q -s -N)"; then
+    sector_size="$(camcontrol readcap "$1" -q -b)"
+    size="$(expr "$num_sectors" \* "$sector_size" / 1000 / 1000)"
+  fi
+
+  [ "$size" ] || size='???'
+  echo "$size"
+}
+
+maybe_udevadm()
+{
+  if which udevadm >/dev/null 2>&1; then
+    udevadm "$@" || true
+  fi
+}
+
+# Parse /proc/mounts and find out the mount for the given device.
+# The device must be a real device in /dev, not a symlink to one.
+get_mounted_device()
+{
+  mountpoint="$1"
+  cat /proc/mounts | while read -r line; do
+    set -f
+    set -- $line
+    set +f
+    if [ "$2" = "$mountpoint" ]; then
+      echo "$1"
+      break
+    fi
+  done
+}
+
+###############################################################################
+#                            New or modified helpers
+###############################################################################
+
+# Fixed: Return nothing if the argument is empty
+get_mountpoint()
+{
+  local relpath boot_mountpoint
+
+  if [ -z "$1" ]; then
+    return
+  fi
+
+  relpath="$(grub-mkrelpath "$1")"
+  boot_mountpoint="${1#$relpath}"
+  echo "${boot_mountpoint:-/}"
+}
+
+
+# Returns value in $RET, like a debconf command.
+#
+# Merged version of describe_disk and describe_partition, as disks can't be
+# valid ESPs on their own, so we can't render them as an entry.
+describe_efi_system_partition()
+{
+  local disk part id path sysfs_path diskbase partbase size
+  local disk_basename disk_size model
+  disk="$1"
+  part="$2"
+  id="$3"
+  path="$4"
+
+  # BEGIN: Stolen from describe_disk
+  model=
+  case $(uname -s) in
+    Linux)
+      sysfs_path="$(maybe_udevadm info -n "$disk" -q path)"
+      if [ -z "$sysfs_path" ]; then
+        sysfs_path="/block/$(printf %s "${disk#/dev/}" | sed 's,/,!,g')"
+      fi
+      disk_size="$(sysfs_size "/sys$sysfs_path")"
+
+      model="$(maybe_udevadm info -n "$disk" -q property | sed -n 's/^ID_MODEL=//p')"
+      if [ -z "$model" ]; then
+        model="$(maybe_udevadm info -n "$disk" -q property | sed -n 's/^DM_NAME=//p')"
+        if [ -z "$model" ]; then
+          model="$(maybe_udevadm info -n "$disk" -q property | sed -n 's/^MD_NAME=//p')"
+          if [ -z "$model" ] && which dmsetup >/dev/null 2>&1; then
+            model="$(dmsetup info -c --noheadings -o name "$disk" 2>/dev/null || true)"
+          fi
+        fi
+      fi
+    ;;
+    GNU/kFreeBSD)
+      disk_basename=$(basename "$disk")
+      disk_size="$(camcontrol_size "$disk_basename")"
+      model="$(camcontrol inquiry "$disk_basename" | sed -ne "s/^pass0: <\([^>]*\)>.*/\1/p")"
+    ;;
+  esac
+
+  [ "$model" ] || model='???'
+
+  # END: Stolen from describe_disk
+
+  sysfs_path="$(maybe_udevadm info -n "$part" -q path)"
+  if [ -z "$sysfs_path" ]; then
+    diskbase="${disk#/dev/}"
+    diskbase="$(printf %s "$diskbase" | sed 's,/,!,g')"
+    partbase="${part#/dev/}"
+    partbase="$(printf %s "$partbase" | sed 's,/,!,g')"
+    sysfs_path="/block/$diskbase/$partbase"
+  fi
+  size="$(sysfs_size "/sys$sysfs_path")"
+
+  db_subst grub-efi/partition_description DEVICE "$part"
+  db_subst grub-efi/partition_description SIZE "$size"
+  db_subst grub-efi/partition_description PATH "$path"
+  db_subst grub-efi/partition_description DISK_MODEL "$model"
+  db_subst grub-efi/partition_description DISK_SIZE "$disk_size"
+  db_metaget grub-efi/partition_description description
+}
+
+
+# Parse /proc/mounts and find out the mount for the given device.
+# The device must be a real device in /dev, not a symlink to one.
+find_mount_point()
+{
+  real_device="$1"
+  cat /proc/mounts | while read -r line; do
+    set -f
+    set -- $line
+    set +f
+    if [ "$1" = "$real_device" -a "$3" = "vfat" ]; then
+      echo "$2"
+      break
+    fi
+  done
+}
+
+# Return all devices that are a valid ESP
+usable_efi_system_partitions()
+{
+  local last_partition path partition partition_id
+  local ID_PART_ENTRY_TYPE ID_PART_ENTRY_SCHEME
+
+  last_partition=
+  (
+  for partition in /dev/disk/by-id/*; do
+    ID_PART_ENTRY_TYPE=""
+    ID_PART_ENTRY_SCHEME=""
+    eval "$(udevadm info -q property -n "$partition" | grep -E '^ID_PART_ENTRY_(TYPE|SCHEME)=')"
+    if [ -z "$ID_PART_ENTRY_TYPE" -o -z "$ID_PART_ENTRY_SCHEME" -o \
+    \( "$ID_PART_ENTRY_SCHEME" != gpt -a "$ID_PART_ENTRY_SCHEME" != dos \) -o \
+    \( "$ID_PART_ENTRY_SCHEME" = gpt -a "$ID_PART_ENTRY_TYPE" != c12a7328-f81f-11d2-ba4b-00a0c93ec93b \) -o \
+    \( "$ID_PART_ENTRY_SCHEME" = dos -a "$ID_PART_ENTRY_TYPE" != 0xef \) ]; then
+      continue
+    fi
+    # unify the partition id
+    partition_id="$(device_to_id "$partition" || true)"
+    real_device="$(readlink -f "$partition")"
+    path="$(find_mount_point $real_device)"
+    echo "$path:$partition_id"
+  done
+  ) | sort -t: -k2 -u
+}
+
+###############################################################################
+#                            MAGIC SCRIPT
+###############################################################################
+
+# Just do regular installation to /boot/efi on cloud images
+db_get grub-efi/cloud_style_installation || true
+if [ "$RET" = true ]; then
+  grub-install "$@"
+  touch /boot/grub/grub.cfg
+  exit 0
+fi
+
+FALLBACK_MOUNTPOINT=/var/lib/grub/esp
+
+# Initial install/upgrade from /boot/efi?
+db_fget grub-efi/install_devices seen
+seen="$RET"
+
+# Get configured value
+question=grub-efi/install_devices
+priority=high
+db_get grub-efi/install_devices
+valid=1
+
+# We either migrate /boot/efi over, or we check if we have invalid devices
+if [ -z "$RET" ] && [ "$seen" != "true" ]; then
+  echo "Trying to migrate /boot/efi into esp config"
+  esp="$(get_mounted_device /boot/efi)"
+  if [ "$esp" ]; then
+    esp="$(device_to_id "$esp")"
+  fi
+  if [ "$esp" ]; then
+    db_set grub-efi/install_devices "$esp"
+    db_fset grub-efi/install_devices seen true
+    RET="$esp"
+  fi
+else
+  for device in $RET; do
+    if [ ! -e "${device%,}" ]; then
+      valid=0
+      break
+    fi
+  done
+fi
+
+# If /boot/efi points to a device that's not in the list, trigger the
+# install_devices_disks_changed prompt below, but add the device behind
+# /boot/efi to the defaults.
+boot_efi_device=$(get_mounted_device /boot/efi || true)
+if [ "$boot_efi_device" ]; then
+  for device in $RET; do
+    device="${device%,}"
+    real_device="$(readlink -f "$device" || true)"
+    if [ "$real_device" = "$boot_efi_device" ]; then
+      boot_efi_device=""
+      break
+    fi
+  done
+
+  if [ "$boot_efi_device" ]; then
+    boot_efi_device="$(device_to_id "$boot_efi_device" || true)"
+    if [ "$RET" ]; then
+      RET="$RET, $boot_efi_device"
+    else
+      RET="$boot_efi_device"
+    fi
+    valid=0
+  fi
+fi
+
+
+if [ "$valid" = 0 ]; then
+  question=grub-efi/install_devices_disks_changed
+  priority=critical
+  db_set "$question" "$RET"
+  db_fset "$question" seen false
+  db_fset grub-efi/install_devices_empty seen false
+fi
+
+while :; do
+  ids=
+  descriptions=
+  partitions="$(usable_efi_system_partitions)"
+
+  for partition_pair in $partitions; do
+    partition_id="${partition_pair#*:}"
+    device="${partition_id%%-part*}"
+    ids="${ids:+$ids, }$partition_id"
+    describe_efi_system_partition "$(readlink -f "$device")" "$(readlink -f "$partition_id")" "$partition_id" "$(get_mountpoint "${partition_pair%%:*}")"
+    RET="$(printf %s "$RET" | sed 's/,/\\,/g')"
+    descriptions="${descriptions:+$descriptions, }$RET"
+  done
+
+  db_subst "$question" RAW_CHOICES "$ids"
+  db_subst "$question" CHOICES "$descriptions"
+  db_input "$priority" "$question" || true
+  db_go
+  db_get "$question"
+
+
+  # Run the installer
+  failed_devices=
+  for i in `echo $RET | sed -e 's/, / /g'` ; do
+    real_device="$(readlink -f "$i")"
+    mntpoint=$(find_mount_point $real_device)
+    if [ -z "$mntpoint" ]; then
+      mntpoint=$FALLBACK_MOUNTPOINT
+      mount $real_device $mntpoint
+    fi
+    echo "Installing grub to $mntpoint." >&2
+    if _UBUNTU_ALTERNATIVE_ESPS="$RET" grub-install --efi-directory=$mntpoint "$@" ; then
+      # We just installed GRUB 2; then also generate grub.cfg.
+      touch /boot/grub/grub.cfg
+    else
+      failed_devices="$failed_devices $real_device"
+    fi
+
+    if [ "$mntpoint" = "$FALLBACK_MOUNTPOINT" ]; then
+      umount $mntpoint
+    fi
+  done
+
+  if [ "$question" != grub-efi/install_devices ] && [ "$RET" ]; then
+    # XXX cjwatson 2019-02-26: The description of
+    # grub-efi/install_devices_disks_changed ought to explain that
+    # selecting no devices will leave the configuration unchanged
+    # so that you'll be prompted again next time, but it's a bit
+    # close to the Debian 10 release to be introducing new
+    # translatable text.  For now, it should be sufficient to
+    # avoid losing configuration data.
+    db_set grub-efi/install_devices "$RET"
+    db_fset grub-efi/install_devices seen true
+  fi
+
+  if [ "$failed_devices" ]; then
+    db_subst grub-efi/install_devices_failed FAILED_DEVICES "$failed_devices"
+    db_fset grub-efi/install_devices_failed seen false
+    if db_input critical grub-efi/install_devices_failed; then
+      db_go
+      db_get grub-efi/install_devices_failed
+      if [ "$RET" = true ]; then
+        break
+      else
+        db_fset "$question" seen false
+        db_fset grub-efi/install_devices_failed seen false
+        continue
+      fi
+    else
+      exit 1 # noninteractive
+    fi
+  fi
+
+  db_get "$question"
+  if [ -z "$RET" ]; then
+    # Reset the seen flag if the current answer is false, since
+    # otherwise we'll loop with no indication of why.
+    db_get grub-efi/install_devices_empty
+    if [ "$RET" = false ]; then
+      db_fset grub-efi/install_devices_empty seen false
+    fi
+    if db_input critical grub-efi/install_devices_empty; then
+      db_go
+      db_get grub-efi/install_devices_empty
+      if [ "$RET" = true ]; then
+        break
+      else
+        db_fset "$question" seen false
+        db_fset grub-efi/install_devices_empty seen false
+      fi
+    else
+      # if question was seen we are done
+      # Otherwise, abort
+      db_fget grub-efi/install_devices_empty seen
+      if [ "$RET" = true ]; then
+        break
+      else
+        exit 1
+      fi
+    fi
+  else
+    break
+  fi
+done
diff -pruN 2.14~git20250718.0e36779-1/debian/grub-pc-bin.install.in 2.14~git20250718.0e36779-1ubuntu4/debian/grub-pc-bin.install.in
--- 2.14~git20250718.0e36779-1/debian/grub-pc-bin.install.in	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub-pc-bin.install.in	2025-08-19 13:14:06.000000000 +0000
@@ -2,3 +2,4 @@ usr/bin/grub-ntldr-img			usr/lib/grub/@C
 usr/lib/grub/@CPU_PLATFORM@/g2hdr.bin
 usr/lib/grub/@CPU_PLATFORM@/g2ldr.mbr
 usr/sbin/grub-bios-setup		usr/lib/grub/@CPU_PLATFORM@
+eltorito.img				usr/lib/grub/@CPU_PLATFORM@
diff -pruN 2.14~git20250718.0e36779-1/debian/grub-pc.install.in 2.14~git20250718.0e36779-1ubuntu4/debian/grub-pc.install.in
--- 2.14~git20250718.0e36779-1/debian/grub-pc.install.in	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub-pc.install.in	2025-09-08 10:56:27.000000000 +0000
@@ -0,0 +1 @@
+usr/share/bash-completion/completions/grub-bios-setup
diff -pruN 2.14~git20250718.0e36779-1/debian/grub-pc.links.in 2.14~git20250718.0e36779-1ubuntu4/debian/grub-pc.links.in
--- 2.14~git20250718.0e36779-1/debian/grub-pc.links.in	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub-pc.links.in	2025-09-08 10:56:27.000000000 +0000
@@ -1,4 +1,2 @@
 usr/lib/grub/@CPU_PLATFORM@/grub-ntldr-img	usr/bin/grub-ntldr-img
 usr/lib/grub/@CPU_PLATFORM@/grub-bios-setup	usr/sbin/grub-bios-setup
-
-usr/share/bash-completion/completions/grub	usr/share/bash-completion/completions/grub-bios-setup
diff -pruN 2.14~git20250718.0e36779-1/debian/grub-pc.templates.in 2.14~git20250718.0e36779-1ubuntu4/debian/grub-pc.templates.in
--- 2.14~git20250718.0e36779-1/debian/grub-pc.templates.in	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub-pc.templates.in	2025-08-19 13:14:06.000000000 +0000
@@ -155,3 +155,8 @@ Template: grub-pc/hidden_timeout
 Type: boolean
 Default: @DEFAULT_HIDDEN_TIMEOUT_BOOL@
 Description: Hide the GRUB timeout; for internal use
+
+Template: grub-pc/cloud_style_installation
+Type: boolean
+Default: false
+_Description: Choose installation target based on the device containing /boot?
diff -pruN 2.14~git20250718.0e36779-1/debian/grub-sort-version 2.14~git20250718.0e36779-1ubuntu4/debian/grub-sort-version
--- 2.14~git20250718.0e36779-1/debian/grub-sort-version	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub-sort-version	2025-08-19 13:14:06.000000000 +0000
@@ -0,0 +1,56 @@
+#!/usr/bin/python3
+#
+"""Script to sort kernel versions."""
+import apt_pkg
+import argparse
+import re
+import sys
+import os
+import typing
+
+
+def order_index(order: list[re.Pattern[str]], abi: str) -> int:
+    """Return the index of abi in order"""
+    for i, entry in zip(range(len(order)), order):
+        if entry.match(abi):
+            return i
+    return len(order)
+
+
+class KernelABI:
+    """Orderable kernel ABI string."""
+
+    def __init__(self, abi: str, order: list[re.Pattern[str]]):
+        self.abi = abi
+        self._index = order_index(order, self.abi)
+
+    def __lt__(self, other: "KernelABI") -> bool:
+        if self._index != other._index:
+            # Ordering is reversed, what should be considered highest comes first.
+            return self._index > other._index
+        return apt_pkg.version_compare(f"{self.abi}-0", f"{other.abi}-0") < 0
+
+
+def main() -> None:
+    """Entry point."""
+    apt_pkg.init()
+
+    parser = argparse.ArgumentParser(
+        prog="grub-sort-version", description="sort kernel ABIs"
+    )
+    parser.add_argument("-r", "--reverse", action="store_true")
+    args = parser.parse_args()
+
+    order = []
+    for flavour in os.environ.get("GRUB_FLAVOUR_ORDER", "").split():
+        order.append(re.compile(f"[\\s\\S]*-{flavour}(\\s*\\d*)$"))
+
+    versions = [KernelABI(line.rstrip(), order) for line in sys.stdin]
+    versions.sort(reverse=args.reverse)
+
+    for v in versions:
+        print(v.abi)
+
+
+if __name__ == "__main__":
+    main()
diff -pruN 2.14~git20250718.0e36779-1/debian/grub2-common.bash-completion.in 2.14~git20250718.0e36779-1ubuntu4/debian/grub2-common.bash-completion.in
--- 2.14~git20250718.0e36779-1/debian/grub2-common.bash-completion.in	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub2-common.bash-completion.in	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-debian/tmp-grub-@COMMON_PLATFORM@/etc/bash_completion.d/grub
diff -pruN 2.14~git20250718.0e36779-1/debian/grub2-common.dirs 2.14~git20250718.0e36779-1ubuntu4/debian/grub2-common.dirs
--- 2.14~git20250718.0e36779-1/debian/grub2-common.dirs	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub2-common.dirs	2025-09-08 10:56:27.000000000 +0000
@@ -1,3 +1,4 @@
 etc/default/grub.d
 usr/sbin
 var/lib/grub/ucf
+var/lib/grub/esp
diff -pruN 2.14~git20250718.0e36779-1/debian/grub2-common.install.in 2.14~git20250718.0e36779-1ubuntu4/debian/grub2-common.install.in
--- 2.14~git20250718.0e36779-1/debian/grub2-common.install.in	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub2-common.install.in	2025-09-08 10:56:27.000000000 +0000
@@ -4,6 +4,10 @@
 ../../debian/kernel/zz-update-grub	etc/kernel/postinst.d
 ../../debian/kernel/zz-update-grub	etc/kernel/postrm.d
 ../../debian/update-grub		usr/sbin
+../../debian/grub-check-signatures usr/share/grub/
+../../debian/grub-multi-install usr/lib/grub/
+../../debian/grub-sort-version	usr/lib/grub
+../../debian/canonical-uefi-ca.crt usr/share/grub/
 
 etc/grub.d
 usr/bin/grub-editenv
@@ -24,6 +28,7 @@ usr/bin/grub-render-label
 usr/bin/grub-script-check
 usr/bin/grub-syslinux2cfg
 usr/sbin/grub-install
+usr/lib/systemd/system/grub-initrd-fallback.service lib/systemd/system
 usr/sbin/grub-macbless
 usr/sbin/grub-mkconfig
 usr/sbin/grub-mkdevicemap
@@ -59,3 +64,15 @@ usr/share/man/man8/grub-mkdevicemap.8
 usr/share/man/man8/grub-probe.8
 usr/share/man/man8/grub-reboot.8
 usr/share/man/man8/grub-set-default.8
+usr/share/bash-completion/completions/grub
+usr/share/bash-completion/completions/grub-editenv
+usr/share/bash-completion/completions/grub-install
+usr/share/bash-completion/completions/grub-mkconfig
+usr/share/bash-completion/completions/grub-mkfont
+usr/share/bash-completion/completions/grub-mkimage
+usr/share/bash-completion/completions/grub-mkpasswd-pbkdf2
+usr/share/bash-completion/completions/grub-mkrescue
+usr/share/bash-completion/completions/grub-probe
+usr/share/bash-completion/completions/grub-reboot
+usr/share/bash-completion/completions/grub-script-check
+usr/share/bash-completion/completions/grub-set-default
diff -pruN 2.14~git20250718.0e36779-1/debian/grub2-common.links 2.14~git20250718.0e36779-1ubuntu4/debian/grub2-common.links
--- 2.14~git20250718.0e36779-1/debian/grub2-common.links	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub2-common.links	2025-09-08 10:56:27.000000000 +0000
@@ -1,15 +1,3 @@
 usr/sbin/update-grub			usr/sbin/update-grub2
 usr/share/grub/grub-mkconfig_lib	usr/lib/grub/grub-mkconfig_lib
 usr/share/man/man8/update-grub.8	usr/share/man/man8/update-grub2.8
-
-usr/share/bash-completion/completions/grub	usr/share/bash-completion/completions/grub-editenv
-usr/share/bash-completion/completions/grub	usr/share/bash-completion/completions/grub-install
-usr/share/bash-completion/completions/grub	usr/share/bash-completion/completions/grub-mkconfig
-usr/share/bash-completion/completions/grub	usr/share/bash-completion/completions/grub-mkfont
-usr/share/bash-completion/completions/grub	usr/share/bash-completion/completions/grub-mkimage
-usr/share/bash-completion/completions/grub	usr/share/bash-completion/completions/grub-mkpasswd-pbkdf2
-usr/share/bash-completion/completions/grub	usr/share/bash-completion/completions/grub-mkrescue
-usr/share/bash-completion/completions/grub	usr/share/bash-completion/completions/grub-probe
-usr/share/bash-completion/completions/grub	usr/share/bash-completion/completions/grub-reboot
-usr/share/bash-completion/completions/grub	usr/share/bash-completion/completions/grub-script-check
-usr/share/bash-completion/completions/grub	usr/share/bash-completion/completions/grub-set-default
diff -pruN 2.14~git20250718.0e36779-1/debian/grub2-common.maintscript.in 2.14~git20250718.0e36779-1ubuntu4/debian/grub2-common.maintscript.in
--- 2.14~git20250718.0e36779-1/debian/grub2-common.maintscript.in	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub2-common.maintscript.in	2025-09-09 15:55:15.000000000 +0000
@@ -0,0 +1,2 @@
+rm_conffile /etc/grub.d/25_bli 2.14~ grub-common
+rm_conffile /etc/grub.d/25_bli 2.14~git20250718.0e36779-1ubuntu3 grub2-common
diff -pruN 2.14~git20250718.0e36779-1/debian/grub2-common.service 2.14~git20250718.0e36779-1ubuntu4/debian/grub2-common.service
--- 2.14~git20250718.0e36779-1/debian/grub2-common.service	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub2-common.service	2025-09-08 10:56:27.000000000 +0000
@@ -1,6 +1,7 @@
 [Unit]
 Description=Record successful boot for GRUB
-After=suspend.target hibernate.target hybrid-sleep.target suspend-then-hibernate.target
+Requires=boot-complete.target
+After=boot-complete.target suspend.target hibernate.target hybrid-sleep.target suspend-then-hibernate.target
 ConditionPathExists=/boot/grub/grub.cfg
 
 [Service]
diff -pruN 2.14~git20250718.0e36779-1/debian/grub2-common.templates 2.14~git20250718.0e36779-1ubuntu4/debian/grub2-common.templates
--- 2.14~git20250718.0e36779-1/debian/grub2-common.templates	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/grub2-common.templates	2025-09-08 10:56:27.000000000 +0000
@@ -0,0 +1,53 @@
+Template: grub-efi/install_devices
+Type: multiselect
+Choices-C: ${RAW_CHOICES}
+Choices: ${CHOICES}
+_Description: GRUB EFI system partitions:
+ The grub-efi package is being upgraded. This menu allows you to select which
+ EFI system partions you'd like grub-install to be automatically run for, if any.
+ .
+ Running grub-install automatically is recommended in most situations, to
+ prevent the installed GRUB core image from getting out of sync with GRUB
+ modules or grub.cfg.
+
+Template: grub-efi/install_devices_disks_changed
+Type: multiselect
+Choices-C: ${RAW_CHOICES}
+Choices: ${CHOICES}
+_Description: GRUB install devices:
+ The GRUB boot loader was previously installed to a disk that is no longer
+ present, or whose unique identifier has changed for some reason. It is
+ important to make sure that the installed GRUB core image stays in sync
+ with GRUB modules and grub.cfg. Please check again to make sure that GRUB
+ is written to the appropriate boot devices.
+
+Template: grub-efi/partition_description
+Type: text
+_Description: ${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}
+
+Template: grub-efi/install_devices_failed
+Type: boolean
+Default: false
+#flag:translate!:3
+_Description: Writing GRUB to boot device failed - continue?
+ GRUB failed to install to the following devices:
+ .
+ ${FAILED_DEVICES}
+ .
+ Do you want to continue anyway? If you do, your computer may not start up
+ properly.
+
+Template: grub-efi/install_devices_empty
+Type: boolean
+Default: false
+_Description: Continue without installing GRUB?
+ You chose not to install GRUB to any devices. If you continue, the boot
+ loader may not be properly configured, and when this computer next starts
+ up it will use whatever was previously configured. If there is an
+ earlier version of GRUB 2 in the EFI system partition, it may be unable to load
+ modules or handle the current configuration file.
+ .
+ If you are already using a different boot loader and want to carry on
+ doing so, or if this is a special environment where you do not need a boot
+ loader, then you should continue anyway. Otherwise, you should install
+ GRUB somewhere.
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-cmain-ppc64-Introduce-flags-to-ident.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-cmain-ppc64-Introduce-flags-to-ident.patch
--- 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-cmain-ppc64-Introduce-flags-to-ident.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-cmain-ppc64-Introduce-flags-to-ident.patch	2025-09-09 15:43:51.000000000 +0000
@@ -0,0 +1,52 @@
+From: Mate Kukri <mate.kukri@canonical.com>
+Date: Tue, 13 Feb 2024 16:23:06 +0000
+Subject: Revert "kern/ieee1275/cmain/ppc64: Introduce flags to identify KVM
+ and PowerVM"
+
+This reverts commit 2a9a8518e9df5cb308b3d17bc52ef85ff7be0591.
+---
+ grub-core/kern/ieee1275/cmain.c  | 8 +-------
+ include/grub/ieee1275/ieee1275.h | 4 ----
+ 2 files changed, 1 insertion(+), 11 deletions(-)
+
+diff --git a/grub-core/kern/ieee1275/cmain.c b/grub-core/kern/ieee1275/cmain.c
+index e74de32..400d85d 100644
+--- a/grub-core/kern/ieee1275/cmain.c
++++ b/grub-core/kern/ieee1275/cmain.c
+@@ -126,10 +126,7 @@ grub_ieee1275_find_options (void)
+ 
+ #if defined(__powerpc__)
+       if (grub_strncmp (tmp, "IBM,", 4) == 0)
+-	{
+-	  grub_ieee1275_set_flag (GRUB_IEEE1275_FLAG_CAN_TRY_CAS_FOR_MORE_MEMORY);
+-	  grub_ieee1275_set_flag (GRUB_IEEE1275_FLAG_POWER_VM);
+-	}
++	grub_ieee1275_set_flag (GRUB_IEEE1275_FLAG_CAN_TRY_CAS_FOR_MORE_MEMORY);
+ #endif
+     }
+ 
+@@ -196,9 +193,6 @@ grub_ieee1275_find_options (void)
+       grub_ieee1275_set_flag (GRUB_IEEE1275_FLAG_NO_PRE1_5M_CLAIM);
+ 
+       grub_ieee1275_set_flag (GRUB_IEEE1275_FLAG_HAS_CURSORONOFF);
+-#if defined(__powerpc__)
+-      grub_ieee1275_set_flag (GRUB_IEEE1275_FLAG_POWER_KVM);
+-#endif
+     }
+ }
+ 
+diff --git a/include/grub/ieee1275/ieee1275.h b/include/grub/ieee1275/ieee1275.h
+index c445d04..4760ae6 100644
+--- a/include/grub/ieee1275/ieee1275.h
++++ b/include/grub/ieee1275/ieee1275.h
+@@ -142,10 +142,6 @@ enum grub_ieee1275_flag
+    */
+   GRUB_IEEE1275_FLAG_CAN_TRY_CAS_FOR_MORE_MEMORY,
+ #endif
+-
+-  GRUB_IEEE1275_FLAG_POWER_VM,
+-
+-  GRUB_IEEE1275_FLAG_POWER_KVM,
+ };
+ 
+ extern int EXPORT_FUNC(grub_ieee1275_test_flag) (enum grub_ieee1275_flag flag);
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-ieee1275-Display-successful-memory-c.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-ieee1275-Display-successful-memory-c.patch
--- 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-ieee1275-Display-successful-memory-c.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-ieee1275-Display-successful-memory-c.patch	2025-09-09 15:43:51.000000000 +0000
@@ -0,0 +1,52 @@
+From: Mate Kukri <mate.kukri@canonical.com>
+Date: Tue, 13 Feb 2024 16:23:05 +0000
+Subject: Revert "kern/ieee1275/ieee1275: Display successful memory claims
+ when debugging"
+
+This reverts commit dc569b0777d002d92be9a7421dca763e60c528e9.
+---
+ grub-core/kern/ieee1275/ieee1275.c       | 3 ---
+ include/grub/powerpc/ieee1275/ieee1275.h | 3 ---
+ include/grub/sparc64/ieee1275/ieee1275.h | 3 ---
+ 3 files changed, 9 deletions(-)
+
+diff --git a/grub-core/kern/ieee1275/ieee1275.c b/grub-core/kern/ieee1275/ieee1275.c
+index 36ca2db..db870db 100644
+--- a/grub-core/kern/ieee1275/ieee1275.c
++++ b/grub-core/kern/ieee1275/ieee1275.c
+@@ -590,9 +590,6 @@ grub_ieee1275_claim (grub_addr_t addr, grub_size_t size, unsigned int align,
+     *result = args.base;
+   if (args.base == IEEE1275_CELL_INVALID)
+     return -1;
+-  grub_dprintf ("mmap", "CLAIMED: 0x%" PRIxGRUB_IEEE1275_CELL_T " (%"
+-		PRIuGRUB_IEEE1275_CELL_T " MiB)  size: %" PRIuGRUB_SIZE " MiB\n",
+-		args.base, args.base >> 20, ALIGN_UP (size, 1 << 20) >> 20);
+   return 0;
+ }
+ 
+diff --git a/include/grub/powerpc/ieee1275/ieee1275.h b/include/grub/powerpc/ieee1275/ieee1275.h
+index 4eb2070..3c7683f 100644
+--- a/include/grub/powerpc/ieee1275/ieee1275.h
++++ b/include/grub/powerpc/ieee1275/ieee1275.h
+@@ -25,7 +25,4 @@
+ #define GRUB_IEEE1275_CELL_SIZEOF 4
+ typedef grub_uint32_t grub_ieee1275_cell_t;
+ 
+-#define PRIxGRUB_IEEE1275_CELL_T	PRIxGRUB_UINT32_T
+-#define PRIuGRUB_IEEE1275_CELL_T	PRIuGRUB_UINT32_T
+-
+ #endif /* ! GRUB_IEEE1275_MACHINE_HEADER */
+diff --git a/include/grub/sparc64/ieee1275/ieee1275.h b/include/grub/sparc64/ieee1275/ieee1275.h
+index ccc71aa..4b18468 100644
+--- a/include/grub/sparc64/ieee1275/ieee1275.h
++++ b/include/grub/sparc64/ieee1275/ieee1275.h
+@@ -25,9 +25,6 @@
+ #define GRUB_IEEE1275_CELL_SIZEOF 8
+ typedef grub_uint64_t grub_ieee1275_cell_t;
+ 
+-#define PRIxGRUB_IEEE1275_CELL_T	PRIxGRUB_UINT64_T
+-#define PRIuGRUB_IEEE1275_CELL_T	PRIuGRUB_UINT64_T
+-
+ /* Encoding of 'mode' argument to grub_ieee1275_map_physical() */
+ #define IEEE1275_MAP_WRITE	0x0001 /* Writable */
+ #define IEEE1275_MAP_READ	0x0002 /* Readable */
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-init-ppc64-Add-support-for-alignment.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-init-ppc64-Add-support-for-alignment.patch
--- 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-init-ppc64-Add-support-for-alignment.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-init-ppc64-Add-support-for-alignment.patch	2025-09-09 15:43:51.000000000 +0000
@@ -0,0 +1,48 @@
+From: Mate Kukri <mate.kukri@canonical.com>
+Date: Tue, 13 Feb 2024 16:23:08 +0000
+Subject: Revert "kern/ieee1275/init/ppc64: Add support for alignment
+ requirements"
+
+This reverts commit d49e86db2c15dd20f42262c0977f739ddf7bd6f6.
+---
+ grub-core/kern/ieee1275/init.c | 14 --------------
+ include/grub/ieee1275/alloc.h  |  1 -
+ 2 files changed, 15 deletions(-)
+
+diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c
+index 981ec87..f1ccc1f 100644
+--- a/grub-core/kern/ieee1275/init.c
++++ b/grub-core/kern/ieee1275/init.c
+@@ -514,20 +514,6 @@ regions_claim (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
+             }
+         }
+     }
+-
+-  /* Honor alignment restrictions on candidate addr */
+-  if (rcr->align)
+-    {
+-      grub_uint64_t align_addr = ALIGN_UP (addr, rcr->align);
+-      grub_uint64_t d = align_addr - addr;
+-
+-      if (d > len)
+-        return 0;
+-
+-      len -= d;
+-      addr = align_addr;
+-    }
+-
+   if (rcr->flags & GRUB_MM_ADD_REGION_CONSECUTIVE && len < rcr->total)
+     return 0;
+ 
+diff --git a/include/grub/ieee1275/alloc.h b/include/grub/ieee1275/alloc.h
+index e314c98..f3065ff 100644
+--- a/include/grub/ieee1275/alloc.h
++++ b/include/grub/ieee1275/alloc.h
+@@ -30,7 +30,6 @@ struct regions_claim_request {
+   grub_uint32_t total;    /* number of requested bytes */
+   bool init_region;       /* whether to add memory to the heap using grub_mm_init_region() */
+   grub_uint64_t addr;     /* result address */
+-  grub_size_t align;      /* alignment restrictions */
+ };
+ 
+ #endif /* GRUB_IEEE1275_ALLOC_HEADER */
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-init-ppc64-Decide-by-request-whether.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-init-ppc64-Decide-by-request-whether.patch
--- 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-init-ppc64-Decide-by-request-whether.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-init-ppc64-Decide-by-request-whether.patch	2025-09-09 15:43:51.000000000 +0000
@@ -0,0 +1,60 @@
+From: Mate Kukri <mate.kukri@canonical.com>
+Date: Tue, 13 Feb 2024 16:23:09 +0000
+Subject: Revert "kern/ieee1275/init/ppc64: Decide by request whether to
+ initialize region"
+
+This reverts commit ea2c93484943e4f6e217e1768df38ce74986fc59.
+---
+ grub-core/kern/ieee1275/init.c | 5 +----
+ include/grub/ieee1275/alloc.h  | 3 ---
+ 2 files changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c
+index 2f666dc..a92a5de 100644
+--- a/grub-core/kern/ieee1275/init.c
++++ b/grub-core/kern/ieee1275/init.c
+@@ -527,8 +527,7 @@ regions_claim (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
+       err = grub_claimmap (addr, len);
+       if (err)
+ 	return err;
+-      if (rcr->init_region)
+-          grub_mm_init_region ((void *) (grub_addr_t) addr, len);
++      grub_mm_init_region ((void *) (grub_addr_t) addr, len);
+       rcr->total -= len;
+     }
+ 
+@@ -547,7 +546,6 @@ heap_init (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
+   struct regions_claim_request rcr = {
+     .flags = GRUB_MM_ADD_REGION_NONE,
+     .total = *(grub_uint32_t *) data,
+-    .init_region = true,
+   };
+   int ret;
+ 
+@@ -565,7 +563,6 @@ region_claim (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
+   struct regions_claim_request rcr = {
+     .flags = GRUB_MM_ADD_REGION_CONSECUTIVE,
+     .total = *(grub_uint32_t *) data,
+-    .init_region = true,
+   };
+   int ret;
+ 
+diff --git a/include/grub/ieee1275/alloc.h b/include/grub/ieee1275/alloc.h
+index 523f51f..12fade5 100644
+--- a/include/grub/ieee1275/alloc.h
++++ b/include/grub/ieee1275/alloc.h
+@@ -21,14 +21,11 @@
+ #ifndef GRUB_IEEE1275_ALLOC_HEADER
+ #define GRUB_IEEE1275_ALLOC_HEADER	1
+ 
+-#include <stdbool.h>
+-
+ #include <grub/memory.h>
+ 
+ struct regions_claim_request {
+   unsigned int flags;     /* GRUB_MM_ADD_REGION_(NONE|CONSECUTIVE) */
+   grub_uint32_t total;    /* number of requested bytes */
+-  bool init_region;       /* whether to add memory to the heap using grub_mm_init_region() */
+ };
+ 
+ #endif /* GRUB_IEEE1275_ALLOC_HEADER */
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-init-ppc64-Display-upper_mem_limit-w.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-init-ppc64-Display-upper_mem_limit-w.patch
--- 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-init-ppc64-Display-upper_mem_limit-w.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-init-ppc64-Display-upper_mem_limit-w.patch	2025-09-09 15:43:51.000000000 +0000
@@ -0,0 +1,24 @@
+From: Mate Kukri <mate.kukri@canonical.com>
+Date: Tue, 13 Feb 2024 16:23:02 +0000
+Subject: Revert "kern/ieee1275/init/ppc64: Display upper_mem_limit when
+ debugging"
+
+This reverts commit 17c68472d1e7746a043b174afb8aab44bda109da.
+---
+ grub-core/kern/ieee1275/init.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c
+index 0fac391..899a969 100644
+--- a/grub-core/kern/ieee1275/init.c
++++ b/grub-core/kern/ieee1275/init.c
+@@ -466,9 +466,6 @@ grub_regions_claim (grub_uint64_t addr, grub_uint64_t len,
+ 
+           check_kernel_dump (&upper_mem_limit);
+ 
+-          grub_dprintf ("ieee1275", "upper_mem_limit is at %llx (%lld MiB)\n",
+-                        upper_mem_limit, upper_mem_limit >> 20);
+-
+           /*
+            * we order these cases to prefer higher addresses and avoid some
+            * splitting issues
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-init-ppc64-Fix-a-comment.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-init-ppc64-Fix-a-comment.patch
--- 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-init-ppc64-Fix-a-comment.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-init-ppc64-Fix-a-comment.patch	2025-09-09 15:43:51.000000000 +0000
@@ -0,0 +1,22 @@
+From: Mate Kukri <mate.kukri@canonical.com>
+Date: Tue, 13 Feb 2024 16:23:04 +0000
+Subject: Revert "kern/ieee1275/init/ppc64: Fix a comment"
+
+This reverts commit 5f8e091b6a668f89de4f40b15b0712bafa053cbe.
+---
+ grub-core/kern/ieee1275/init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c
+index 899a969..5c236f1 100644
+--- a/grub-core/kern/ieee1275/init.c
++++ b/grub-core/kern/ieee1275/init.c
+@@ -484,7 +484,7 @@ grub_regions_claim (grub_uint64_t addr, grub_uint64_t len,
+               /* We must not exceed the upper_mem_limit (assuming it's >= RMO_ADDR_MAX) */
+               if (addr + len > upper_mem_limit)
+                 {
+-                  /* Take the bigger chunk from either below linux_rmo_save or above RMO_ADDR_MAX. */
++                  /* take the bigger chunk from either below linux_rmo_save or above upper_mem_limit */
+                   len = upper_mem_limit - addr;
+                   if (orig_addr < linux_rmo_save && linux_rmo_save - orig_addr > len)
+                     {
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-init-ppc64-Introduce-a-request-for-r.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-init-ppc64-Introduce-a-request-for-r.patch
--- 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-init-ppc64-Introduce-a-request-for-r.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-init-ppc64-Introduce-a-request-for-r.patch	2025-09-09 15:43:51.000000000 +0000
@@ -0,0 +1,164 @@
+From: Mate Kukri <mate.kukri@canonical.com>
+Date: Tue, 13 Feb 2024 16:23:09 +0000
+Subject: Revert "kern/ieee1275/init/ppc64: Introduce a request for
+ regions_claim()"
+
+This reverts commit 0bb59fa9a3190e785be683bf1081287a78273544.
+---
+ grub-core/Makefile.am          |  2 --
+ grub-core/kern/ieee1275/init.c | 43 ++++++++++--------------------------------
+ include/grub/ieee1275/alloc.h  | 31 ------------------------------
+ 3 files changed, 10 insertions(+), 66 deletions(-)
+ delete mode 100644 include/grub/ieee1275/alloc.h
+
+diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am
+index 5b862de..4f3f463 100644
+--- a/grub-core/Makefile.am
++++ b/grub-core/Makefile.am
+@@ -156,7 +156,6 @@ endif
+ if COND_i386_ieee1275
+ KERNEL_HEADER_FILES += $(top_builddir)/include/grub/machine/kernel.h
+ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/ieee1275/ieee1275.h
+-KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/ieee1275/alloc.h
+ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/terminfo.h
+ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/extcmd.h
+ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/lib/arg.h
+@@ -244,7 +243,6 @@ endif
+ 
+ if COND_powerpc_ieee1275
+ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/ieee1275/ieee1275.h
+-KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/ieee1275/alloc.h
+ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/terminfo.h
+ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/extcmd.h
+ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/lib/arg.h
+diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c
+index a92a5de..0b0a045 100644
+--- a/grub-core/kern/ieee1275/init.c
++++ b/grub-core/kern/ieee1275/init.c
+@@ -46,9 +46,6 @@
+ #ifdef __sparc__
+ #include <grub/machine/kernel.h>
+ #endif
+-#if defined(__powerpc__) || defined(__i386__)
+-#include <grub/ieee1275/alloc.h>
+-#endif
+ 
+ /* The maximum heap size we're going to claim at boot. Not used by sparc. */
+ #ifdef __i386__
+@@ -332,9 +329,9 @@ count_free (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
+ 
+ static int
+ regions_claim (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
+-	       void *data)
++	      unsigned int flags, void *data)
+ {
+-  struct regions_claim_request *rcr = data;
++  grub_uint32_t total = *(grub_uint32_t *) data;
+   grub_uint64_t linux_rmo_save;
+ 
+   if (type != GRUB_MEMORY_AVAILABLE)
+@@ -514,11 +511,11 @@ regions_claim (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
+             }
+         }
+     }
+-  if (rcr->flags & GRUB_MM_ADD_REGION_CONSECUTIVE && len < rcr->total)
++  if (flags & GRUB_MM_ADD_REGION_CONSECUTIVE && len < total)
+     return 0;
+ 
+-  if (len > rcr->total)
+-    len = rcr->total;
++  if (len > total)
++    len = total;
+ 
+   if (len)
+     {
+@@ -528,12 +525,12 @@ regions_claim (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
+       if (err)
+ 	return err;
+       grub_mm_init_region ((void *) (grub_addr_t) addr, len);
+-      rcr->total -= len;
++      total -= len;
+     }
+ 
+-  *(grub_uint32_t *) data = rcr->total;
++  *(grub_uint32_t *) data = total;
+ 
+-  if (rcr->total == 0)
++  if (total == 0)
+     return 1;
+ 
+   return 0;
+@@ -543,34 +540,14 @@ static int
+ heap_init (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
+ 	   void *data)
+ {
+-  struct regions_claim_request rcr = {
+-    .flags = GRUB_MM_ADD_REGION_NONE,
+-    .total = *(grub_uint32_t *) data,
+-  };
+-  int ret;
+-
+-  ret = regions_claim (addr, len, type, &rcr);
+-
+-  *(grub_uint32_t *) data = rcr.total;
+-
+-  return ret;
++  return regions_claim (addr, len, type, GRUB_MM_ADD_REGION_NONE, data);
+ }
+ 
+ static int
+ region_claim (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
+ 	   void *data)
+ {
+-  struct regions_claim_request rcr = {
+-    .flags = GRUB_MM_ADD_REGION_CONSECUTIVE,
+-    .total = *(grub_uint32_t *) data,
+-  };
+-  int ret;
+-
+-  ret = regions_claim (addr, len, type, &rcr);
+-
+-  *(grub_uint32_t *) data = rcr.total;
+-
+-  return ret;
++  return regions_claim (addr, len, type, GRUB_MM_ADD_REGION_CONSECUTIVE, data);
+ }
+ 
+ static grub_err_t
+diff --git a/include/grub/ieee1275/alloc.h b/include/grub/ieee1275/alloc.h
+deleted file mode 100644
+index 12fade5..0000000
+--- a/include/grub/ieee1275/alloc.h
++++ /dev/null
+@@ -1,31 +0,0 @@
+-/* alloc.h - Memory allocation for PowerVM, KVM on Power, and i386 */
+-/*
+- *  GRUB  --  GRand Unified Bootloader
+- *  Copyright (C) 2023  Free Software Foundation, Inc.
+- *  Copyright (C) 2023  IBM Corporation
+- *
+- *  GRUB is free software: you can redistribute it and/or modify
+- *  it under the terms of the GNU General Public License as published by
+- *  the Free Software Foundation, either version 3 of the License, or
+- *  (at your option) any later version.
+- *
+- *  GRUB is distributed in the hope that it will be useful,
+- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+- *  GNU General Public License for more details.
+- *
+- *  You should have received a copy of the GNU General Public License
+- *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+- */
+-
+-#ifndef GRUB_IEEE1275_ALLOC_HEADER
+-#define GRUB_IEEE1275_ALLOC_HEADER	1
+-
+-#include <grub/memory.h>
+-
+-struct regions_claim_request {
+-  unsigned int flags;     /* GRUB_MM_ADD_REGION_(NONE|CONSECUTIVE) */
+-  grub_uint32_t total;    /* number of requested bytes */
+-};
+-
+-#endif /* GRUB_IEEE1275_ALLOC_HEADER */
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-init-ppc64-Rename-regions_claim-to-g.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-init-ppc64-Rename-regions_claim-to-g.patch
--- 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-init-ppc64-Rename-regions_claim-to-g.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-init-ppc64-Rename-regions_claim-to-g.patch	2025-09-09 15:43:51.000000000 +0000
@@ -0,0 +1,58 @@
+From: Mate Kukri <mate.kukri@canonical.com>
+Date: Tue, 13 Feb 2024 16:23:07 +0000
+Subject: Revert "kern/ieee1275/init/ppc64: Rename regions_claim() to
+ grub_regions_claim()"
+
+This reverts commit 679691a13ef583a0342888c1fcca99f663a71c68.
+---
+ grub-core/kern/ieee1275/init.c | 10 +++++-----
+ include/grub/ieee1275/alloc.h  |  3 ---
+ 2 files changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c
+index 5c236f1..981ec87 100644
+--- a/grub-core/kern/ieee1275/init.c
++++ b/grub-core/kern/ieee1275/init.c
+@@ -330,9 +330,9 @@ count_free (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
+   return 0;
+ }
+ 
+-int
+-grub_regions_claim (grub_uint64_t addr, grub_uint64_t len,
+-		    grub_memory_type_t type, void *data)
++static int
++regions_claim (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
++	       void *data)
+ {
+   struct regions_claim_request *rcr = data;
+   grub_uint64_t linux_rmo_save;
+@@ -567,7 +567,7 @@ heap_init (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
+   };
+   int ret;
+ 
+-  ret = grub_regions_claim (addr, len, type, &rcr);
++  ret = regions_claim (addr, len, type, &rcr);
+ 
+   *(grub_uint32_t *) data = rcr.total;
+ 
+@@ -585,7 +585,7 @@ region_claim (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
+   };
+   int ret;
+ 
+-  ret = grub_regions_claim (addr, len, type, &rcr);
++  ret = regions_claim (addr, len, type, &rcr);
+ 
+   *(grub_uint32_t *) data = rcr.total;
+ 
+diff --git a/include/grub/ieee1275/alloc.h b/include/grub/ieee1275/alloc.h
+index 67a7856..e314c98 100644
+--- a/include/grub/ieee1275/alloc.h
++++ b/include/grub/ieee1275/alloc.h
+@@ -33,7 +33,4 @@ struct regions_claim_request {
+   grub_size_t align;      /* alignment restrictions */
+ };
+ 
+-int EXPORT_FUNC(grub_regions_claim) (grub_uint64_t addr, grub_uint64_t len,
+-				     grub_memory_type_t type, void *data);
+-
+ #endif /* GRUB_IEEE1275_ALLOC_HEADER */
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-init-ppc64-Return-allocated-address-.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-init-ppc64-Return-allocated-address-.patch
--- 2.14~git20250718.0e36779-1/debian/patches/Revert-kern-ieee1275-init-ppc64-Return-allocated-address-.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-kern-ieee1275-init-ppc64-Return-allocated-address-.patch	2025-09-09 15:43:51.000000000 +0000
@@ -0,0 +1,36 @@
+From: Mate Kukri <mate.kukri@canonical.com>
+Date: Tue, 13 Feb 2024 16:23:08 +0000
+Subject: Revert "kern/ieee1275/init/ppc64: Return allocated address using
+ context"
+
+This reverts commit fe5d5e85711e765199853739e7e787621804778b.
+---
+ grub-core/kern/ieee1275/init.c | 2 --
+ include/grub/ieee1275/alloc.h  | 1 -
+ 2 files changed, 3 deletions(-)
+
+diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c
+index f1ccc1f..2f666dc 100644
+--- a/grub-core/kern/ieee1275/init.c
++++ b/grub-core/kern/ieee1275/init.c
+@@ -530,8 +530,6 @@ regions_claim (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
+       if (rcr->init_region)
+           grub_mm_init_region ((void *) (grub_addr_t) addr, len);
+       rcr->total -= len;
+-
+-      rcr->addr = addr;
+     }
+ 
+   *(grub_uint32_t *) data = rcr->total;
+diff --git a/include/grub/ieee1275/alloc.h b/include/grub/ieee1275/alloc.h
+index f3065ff..523f51f 100644
+--- a/include/grub/ieee1275/alloc.h
++++ b/include/grub/ieee1275/alloc.h
+@@ -29,7 +29,6 @@ struct regions_claim_request {
+   unsigned int flags;     /* GRUB_MM_ADD_REGION_(NONE|CONSECUTIVE) */
+   grub_uint32_t total;    /* number of requested bytes */
+   bool init_region;       /* whether to add memory to the heap using grub_mm_init_region() */
+-  grub_uint64_t addr;     /* result address */
+ };
+ 
+ #endif /* GRUB_IEEE1275_ALLOC_HEADER */
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/Revert-loader-powerpc-ieee1275-Use-new-allocation-functio.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-loader-powerpc-ieee1275-Use-new-allocation-functio.patch
--- 2.14~git20250718.0e36779-1/debian/patches/Revert-loader-powerpc-ieee1275-Use-new-allocation-functio.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/Revert-loader-powerpc-ieee1275-Use-new-allocation-functio.patch	2025-09-09 15:43:51.000000000 +0000
@@ -0,0 +1,99 @@
+From: Mate Kukri <mate.kukri@canonical.com>
+Date: Tue, 13 Feb 2024 16:23:06 +0000
+Subject: Revert "loader/powerpc/ieee1275: Use new allocation function for
+ kernel and initrd"
+
+This reverts commit 0ac3d938a318231b0302df3e955efe0bf5053717.
+---
+ grub-core/loader/powerpc/ieee1275/linux.c | 55 +++++--------------------------
+ 1 file changed, 9 insertions(+), 46 deletions(-)
+
+diff --git a/grub-core/loader/powerpc/ieee1275/linux.c b/grub-core/loader/powerpc/ieee1275/linux.c
+index 45461f2..a6044b9 100644
+--- a/grub-core/loader/powerpc/ieee1275/linux.c
++++ b/grub-core/loader/powerpc/ieee1275/linux.c
+@@ -30,7 +30,6 @@
+ #include <grub/lib/cmdline.h>
+ #include <grub/cache.h>
+ #include <grub/linux.h>
+-#include <grub/ieee1275/alloc.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -117,22 +116,6 @@ grub_linux_claimmap_iterate (grub_addr_t target, grub_size_t size,
+   return ctx.found_addr;
+ }
+ 
+-static grub_addr_t
+-grub_linux_claimmap_iterate_restricted (grub_size_t size, grub_size_t align)
+-{
+-  struct regions_claim_request rcr = {
+-    .flags = GRUB_MM_ADD_REGION_CONSECUTIVE,
+-    .total = size,
+-    .init_region = false,
+-    .addr = (grub_uint64_t) -1,
+-    .align = align,
+-  };
+-
+-  grub_machine_mmap_iterate (grub_regions_claim, &rcr);
+-
+-  return rcr.addr;
+-}
+-
+ static grub_err_t
+ grub_linux_boot (void)
+ {
+@@ -244,18 +227,10 @@ grub_linux_load64 (grub_elf_t elf, const char *filename)
+   offset = entry - base_addr;
+   /* Linux's incorrectly contains a virtual address.  */
+ 
+-  if (grub_ieee1275_test_flag (GRUB_IEEE1275_FLAG_POWER_VM) ||
+-      grub_ieee1275_test_flag (GRUB_IEEE1275_FLAG_POWER_KVM))
+-    {
+-      seg_addr = grub_linux_claimmap_iterate_restricted (linux_size, align);
+-    }
+-  else
+-    {
+-      /* On some systems, firmware occupies the memory we're trying to use.
+-       * Happily, Linux can be loaded anywhere (it relocates itself).  Iterate
+-       * until we find an open area.  */
+-      seg_addr = grub_linux_claimmap_iterate (base_addr & ~ELF64_LOADMASK, linux_size, align);
+-    }
++  /* On some systems, firmware occupies the memory we're trying to use.
++   * Happily, Linux can be loaded anywhere (it relocates itself).  Iterate
++   * until we find an open area.  */
++  seg_addr = grub_linux_claimmap_iterate (base_addr & ~ELF64_LOADMASK, linux_size, align);
+   if (seg_addr == (grub_addr_t) -1)
+     return grub_error (GRUB_ERR_OUT_OF_MEMORY, "couldn't claim memory");
+ 
+@@ -364,25 +339,13 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
+ 
+   size = grub_get_initrd_size (&initrd_ctx);
+ 
++  first_addr = linux_addr + linux_size;
+ 
+-  if (grub_ieee1275_test_flag (GRUB_IEEE1275_FLAG_POWER_VM) ||
+-      grub_ieee1275_test_flag (GRUB_IEEE1275_FLAG_POWER_KVM))
+-    {
+-      addr = grub_linux_claimmap_iterate_restricted (size, 0x100000);
+-    }
+-  else
+-    {
+-      /* Attempt to claim at a series of addresses until successful in
+-         the same way that grub_rescue_cmd_linux does.  */
+-      first_addr = linux_addr + linux_size;
+-      addr = grub_linux_claimmap_iterate (first_addr, size, 0x100000);
+-    }
+-
++  /* Attempt to claim at a series of addresses until successful in
++     the same way that grub_rescue_cmd_linux does.  */
++  addr = grub_linux_claimmap_iterate (first_addr, size, 0x100000);
+   if (addr == (grub_addr_t) -1)
+-    {
+-      grub_error (GRUB_ERR_OUT_OF_MEMORY, "out of memory");
+-      goto fail;
+-    }
++     goto fail;
+ 
+   grub_dprintf ("loader", "Loading initrd at 0x%x, size 0x%x\n", addr, size);
+ 
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/UBUNTU-Do-not-attempt-to-load-the-bli-module.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/UBUNTU-Do-not-attempt-to-load-the-bli-module.patch
--- 2.14~git20250718.0e36779-1/debian/patches/UBUNTU-Do-not-attempt-to-load-the-bli-module.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/UBUNTU-Do-not-attempt-to-load-the-bli-module.patch	2025-09-09 15:43:51.000000000 +0000
@@ -0,0 +1,28 @@
+From: Mate Kukri <mate.kukri@canonical.com>
+Date: Tue, 9 Sep 2025 13:45:26 +0100
+Subject: UBUNTU: Do not attempt to load the bli module
+
+Ubuntu does not support bli nor does it sign the module, the error
+message about failed verification ruins the flicker free boot experience
+on Secure Boot enabled systems.
+---
+ Makefile.util.def | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/Makefile.util.def b/Makefile.util.def
+index 8cf35ae..22a5c03 100644
+--- a/Makefile.util.def
++++ b/Makefile.util.def
+@@ -563,12 +563,6 @@ script = {
+   condition = COND_HOST_LINUX;
+ };
+ 
+-script = {
+-  name = '25_bli';
+-  common = util/grub.d/25_bli.in;
+-  installdir = grubconf;
+-};
+-
+ script = {
+   name = '30_os-prober';
+   common = util/grub.d/30_os-prober.in;
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/arm64-add-snapdragon-quirk.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/arm64-add-snapdragon-quirk.patch
--- 2.14~git20250718.0e36779-1/debian/patches/arm64-add-snapdragon-quirk.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/arm64-add-snapdragon-quirk.patch	2025-09-09 15:43:51.000000000 +0000
@@ -0,0 +1,228 @@
+From: Tobias Heider <tobias.heider@canonical.com>
+Date: Sun, 27 Jul 2025 17:30:13 +0200
+Subject: arm64: Add Snapdragon quirk to reduce max usable EFI address
+
+On Snapdragon X Elite latops the memory range 0x8800000000-0x8fffffffff
+cannot be used because of a firmware bug causing the device to crash.
+
+Detect affected machines by looking at the SMBIOS processor version entry
+and limit the maximum address before memory management is initialized.
+---
+ grub-core/kern/efi/mm.c        | 81 +++++++++++++++++++++++++++++++++++++-----
+ grub-core/kern/main.c          |  5 +++
+ grub-core/loader/efi/fdt.c     |  2 +-
+ grub-core/loader/efi/peimage.c |  2 +-
+ include/grub/efi/memory.h      |  3 ++
+ 5 files changed, 83 insertions(+), 10 deletions(-)
+
+diff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c
+index df238b1..0b281d3 100644
+--- a/grub-core/kern/efi/mm.c
++++ b/grub-core/kern/efi/mm.c
+@@ -21,7 +21,9 @@
+ #include <grub/mm.h>
+ #include <grub/efi/api.h>
+ #include <grub/efi/efi.h>
++#include <grub/efi/memory.h>
+ #include <grub/cpu/efi/memory.h>
++#include <grub/smbios.h>
+ 
+ #if defined (__i386__) || defined (__x86_64__)
+ #include <grub/pci.h>
+@@ -125,14 +127,14 @@ grub_efi_allocate_pages_real (grub_efi_physical_address_t address,
+   grub_efi_boot_services_t *b;
+ 
+   /* Limit the memory access to less than 4GB for 32-bit platforms.  */
+-  if (address > GRUB_EFI_MAX_USABLE_ADDRESS)
++  if (address > grub_efi_max_usable_address)
+     {
+       char inv_addr[17], max_addr[17]; /* log16(2^64) = 16, plus NUL. */
+ 
+       grub_snprintf (inv_addr, sizeof (inv_addr) - 1, "%" PRIxGRUB_UINT64_T,
+ 		     address);
+       grub_snprintf (max_addr, sizeof (max_addr) - 1, "%" PRIxGRUB_UINT64_T,
+-		     (grub_efi_uint64_t) GRUB_EFI_MAX_USABLE_ADDRESS);
++		     (grub_efi_uint64_t) grub_efi_max_usable_address);
+       grub_error (GRUB_ERR_BAD_ARGUMENT,
+ 		  N_("invalid memory address (0x%s > 0x%s)"), inv_addr, max_addr);
+       return NULL;
+@@ -150,7 +152,7 @@ grub_efi_allocate_pages_real (grub_efi_physical_address_t address,
+     {
+       /* Uggh, the address 0 was allocated... This is too annoying,
+ 	 so reallocate another one.  */
+-      address = GRUB_EFI_MAX_USABLE_ADDRESS;
++      address = grub_efi_max_usable_address;
+       status = b->allocate_pages (alloctype, memtype, pages, &address);
+       b->free_pages (0, pages);
+       if (status != GRUB_EFI_SUCCESS)
+@@ -168,7 +170,7 @@ grub_efi_allocate_pages_real (grub_efi_physical_address_t address,
+ void *
+ grub_efi_allocate_any_pages (grub_efi_uintn_t pages)
+ {
+-  return grub_efi_allocate_pages_real (GRUB_EFI_MAX_USABLE_ADDRESS,
++  return grub_efi_allocate_pages_real (grub_efi_max_usable_address,
+ 				       pages, GRUB_EFI_ALLOCATE_MAX_ADDRESS,
+ 				       GRUB_EFI_LOADER_DATA);
+ }
+@@ -453,7 +455,7 @@ filter_memory_map (grub_efi_memory_descriptor_t *memory_map,
+     {
+       if (desc->type == GRUB_EFI_CONVENTIONAL_MEMORY
+ #if 1
+-	  && desc->physical_start <= GRUB_EFI_MAX_USABLE_ADDRESS
++	  && desc->physical_start <= grub_efi_max_usable_address
+ #endif
+ 	  && desc->physical_start + PAGES_TO_BYTES (desc->num_pages) > 0x100000
+ 	  && desc->num_pages != 0)
+@@ -471,9 +473,9 @@ filter_memory_map (grub_efi_memory_descriptor_t *memory_map,
+ #if 1
+ 	  if (BYTES_TO_PAGES (filtered_desc->physical_start)
+ 	      + filtered_desc->num_pages
+-	      > BYTES_TO_PAGES_DOWN (GRUB_EFI_MAX_USABLE_ADDRESS))
++	      > BYTES_TO_PAGES_DOWN (grub_efi_max_usable_address))
+ 	    filtered_desc->num_pages
+-	      = (BYTES_TO_PAGES_DOWN (GRUB_EFI_MAX_USABLE_ADDRESS)
++	      = (BYTES_TO_PAGES_DOWN (grub_efi_max_usable_address)
+ 		 - BYTES_TO_PAGES (filtered_desc->physical_start));
+ #endif
+ 
+@@ -656,9 +658,72 @@ grub_efi_mm_add_regions (grub_size_t required_bytes, unsigned int flags)
+   return GRUB_ERR_NONE;
+ }
+ 
++#if defined (__aarch64__)
++static void
++grub_arm64_snapdragon_x_quirk(void)
++{
++  const grub_guid_t smbios3_guid = GRUB_EFI_SMBIOS3_TABLE_GUID;
++  const char *proc_version = NULL;
++  const grub_uint8_t *table_end, *ptr;
++  struct grub_smbios_eps3 *eps3;
++  grub_uint8_t i;
++
++  /* Find smbios table */
++  eps3 = grub_efi_find_configuration_table (&smbios3_guid);
++  if (!eps3)
++	return;
++
++  table_end = (grub_uint8_t *)eps3->table_address + eps3->maximum_table_length;
++  ptr = (grub_uint8_t *)eps3->table_address;
++
++  /* Find ProcessorInformation structure */
++  while (ptr < table_end && ptr[1] >= 4)
++    {
++      if (ptr[0] == 4)
++	break;
++      ptr += ptr[1];
++      while ((*ptr++ != 0 || *ptr++ != 0) && ptr < table_end);
++    }
++  /* Give up if we didn't find one*/
++  if (ptr[0] != 4)
++    return;
++
++  /* Find ProcessorType string */
++  const grub_uint8_t referenced_string_number = ptr[16];
++  ptr += ptr[1];
++  for (i = 1; *ptr != 0 && ptr < table_end; i++)
++    {
++      if (i == referenced_string_number)
++        {
++          proc_version = (const char *)ptr;
++          while (*ptr++ != 0)
++            if (ptr >= table_end)
++              return; /* The string isn't terminated. */
++          break;
++        }
++      while (*ptr++ != 0 && ptr < table_end);
++    }
++  if (proc_version == NULL)
++    return;
++
++  if (grub_strncmp(proc_version, "Snapdragon(R) X ", 16))
++    return;
++
++  grub_efi_max_usable_address = 0xfffffffffu;
++}
++#endif
++
+ void
+ grub_efi_mm_init (void)
+ {
++#if defined (__aarch64__)
++  /*
++   * Work around a firmware bug that Snapdragon X Elite firmware crash when
++   * upper 32 GB of memory are used.
++   */
++  grub_arm64_snapdragon_x_quirk();
++#endif
++
+   if (grub_efi_mm_add_regions (DEFAULT_HEAP_SIZE, GRUB_MM_ADD_REGION_NONE) != GRUB_ERR_NONE)
+     grub_fatal ("%s", grub_errmsg);
+   grub_mm_add_region_fn = grub_efi_mm_add_regions;
+@@ -684,7 +749,7 @@ grub_efi_get_ram_base(grub_addr_t *base_addr)
+   if (ret < 1)
+     return GRUB_ERR_BUG;
+ 
+-  for (desc = memory_map, *base_addr = GRUB_EFI_MAX_USABLE_ADDRESS;
++  for (desc = memory_map, *base_addr = grub_efi_max_usable_address;
+        (grub_addr_t) desc < ((grub_addr_t) memory_map + memory_map_size);
+        desc = NEXT_MEMORY_DESCRIPTOR (desc, desc_size))
+     if (desc->attribute & GRUB_EFI_MEMORY_WB)
+diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c
+index 3789282..723bdd6 100644
+--- a/grub-core/kern/main.c
++++ b/grub-core/kern/main.c
+@@ -42,6 +42,11 @@
+ static bool cli_disabled = false;
+ static bool cli_need_auth = false;
+ 
++#ifdef GRUB_MACHINE_EFI
++#include <grub/cpu/efi/memory.h>
++grub_efi_physical_address_t grub_efi_max_usable_address = GRUB_EFI_MAX_USABLE_ADDRESS;
++#endif
++
+ grub_addr_t
+ grub_modules_get_end (void)
+ {
+diff --git a/grub-core/loader/efi/fdt.c b/grub-core/loader/efi/fdt.c
+index 948ef7e..2c4c5d1 100644
+--- a/grub-core/loader/efi/fdt.c
++++ b/grub-core/loader/efi/fdt.c
+@@ -107,7 +107,7 @@ grub_fdt_load (grub_size_t additional_size)
+   size += additional_size;
+ 
+   grub_dprintf ("linux", "allocating %d bytes for fdt\n", size);
+-  fdt = grub_efi_allocate_pages_real (GRUB_EFI_MAX_USABLE_ADDRESS,
++  fdt = grub_efi_allocate_pages_real (grub_efi_max_usable_address,
+ 				      GRUB_EFI_BYTES_TO_PAGES (size),
+ 				      GRUB_EFI_ALLOCATE_MAX_ADDRESS,
+ 				      GRUB_EFI_ACPI_RECLAIM_MEMORY);
+diff --git a/grub-core/loader/efi/peimage.c b/grub-core/loader/efi/peimage.c
+index 0d73081..5bb4ed1 100644
+--- a/grub-core/loader/efi/peimage.c
++++ b/grub-core/loader/efi/peimage.c
+@@ -249,7 +249,7 @@ load_sections (struct image_info *info)
+   info->alloc_pages = GRUB_EFI_BYTES_TO_PAGES (info->image_size + (align_mask & ~0xfffUL));
+ 
+   info->alloc_addr = grub_efi_allocate_pages_real (
+-      GRUB_EFI_MAX_USABLE_ADDRESS, info->alloc_pages,
++      grub_efi_max_usable_address, info->alloc_pages,
+       GRUB_EFI_ALLOCATE_MAX_ADDRESS, GRUB_EFI_LOADER_CODE);
+   if (!info->alloc_addr)
+     return GRUB_EFI_OUT_OF_RESOURCES;
+diff --git a/include/grub/efi/memory.h b/include/grub/efi/memory.h
+index 08fe622..f03dba6 100644
+--- a/include/grub/efi/memory.h
++++ b/include/grub/efi/memory.h
+@@ -19,9 +19,12 @@
+ #ifndef GRUB_MEMORY_MACHINE_HEADER
+ #define GRUB_MEMORY_MACHINE_HEADER	1
+ 
++#include <grub/efi/api.h>
+ #include <grub/err.h>
+ #include <grub/types.h>
+ 
++extern grub_efi_physical_address_t EXPORT_VAR(grub_efi_max_usable_address);
++
+ /* The term "page" in UEFI refers only to a 4 KiB-aligned 4 KiB size region of
+    memory. It is not concerned with underlying translation management concepts,
+    but only used as the granule for memory allocations. */
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/grub-install-efi-title.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/grub-install-efi-title.patch
--- 2.14~git20250718.0e36779-1/debian/patches/grub-install-efi-title.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/grub-install-efi-title.patch	2025-09-09 15:43:51.000000000 +0000
@@ -0,0 +1,161 @@
+From: Mate Kukri <mate.kukri@canonical.com>
+Date: Wed, 21 Feb 2024 15:42:32 +0000
+Subject: grub-install: Use `GRUB_DISTRIBUTOR` value as EFI boot option title
+
+- Allow entries to be called things like "Ubuntu".
+- If there is no `GRUB_DISTRIBUTOR` assume it is "GRUB".
+- When searching for a variable to re-use, allow matching against both
+  the old "efi_distributor" value and the new "efi_title" one.
+- Dynamically generate `BOOT{ARCH}.CSV` with the option title
+---
+ grub-core/osdep/unix/efivar.c   |  6 +++---
+ grub-core/osdep/unix/platform.c |  6 ++++--
+ include/grub/util/install.h     |  6 ++++--
+ util/grub-install.c             | 27 +++++++++++++++++++--------
+ 4 files changed, 30 insertions(+), 15 deletions(-)
+
+diff --git a/grub-core/osdep/unix/efivar.c b/grub-core/osdep/unix/efivar.c
+index 19b6550..906f8ea 100644
+--- a/grub-core/osdep/unix/efivar.c
++++ b/grub-core/osdep/unix/efivar.c
+@@ -540,7 +540,7 @@ devices_equal (const_efidp a, const_efidp b)
+ int
+ grub_install_efivar_register_efi (grub_device_t efidir_grub_dev,
+ 				  const char *efidir, const char *efifile_path,
+-				  const char *efi_distributor)
++				  const char *efi_distributor, const char *efi_title)
+ {
+   const char *efidir_disk;
+   int efidir_part;
+@@ -619,7 +619,7 @@ grub_install_efivar_register_efi (grub_device_t efidir_grub_dev,
+       if (entry->num < 0)
+ 	continue;
+       label = (const char *) efi_loadopt_desc (load_option, entry->data_size);
+-      if (strcasecmp (label, efi_distributor) != 0)
++      if (strcasecmp (label, efi_title) != 0 && strcasecmp (label, efi_distributor) != 0)
+ 	continue;
+ 
+       path = efi_loadopt_path (load_option, entry->data_size);
+@@ -671,7 +671,7 @@ grub_install_efivar_register_efi (grub_device_t efidir_grub_dev,
+   if (entry_num == -1)
+     entry_num = find_free_boot_num (entries);
+   entry = make_boot_variable (entry_num, efidir_disk, efidir_part,
+-			      efifile_path, efi_distributor);
++			      efifile_path, efi_title);
+   if (!entry)
+     goto err;
+ 
+diff --git a/grub-core/osdep/unix/platform.c b/grub-core/osdep/unix/platform.c
+index 947cb7c..6ac822e 100644
+--- a/grub-core/osdep/unix/platform.c
++++ b/grub-core/osdep/unix/platform.c
+@@ -78,11 +78,13 @@ get_ofpathname (const char *dev)
+ int
+ grub_install_register_efi (grub_device_t efidir_grub_dev, const char *efidir,
+ 			   const char *efifile_path,
+-			   const char *efi_distributor)
++			   const char *efi_distributor,
++			   const char *efi_title)
+ {
+ #ifdef HAVE_EFIVAR
+   return grub_install_efivar_register_efi (efidir_grub_dev, efidir,
+-					   efifile_path, efi_distributor);
++					   efifile_path, efi_distributor,
++					   efi_title);
+ #else
+   grub_util_error ("%s",
+ 		   _("GRUB was not built with efivar support; "
+diff --git a/include/grub/util/install.h b/include/grub/util/install.h
+index 6e4ee4f..8bc65be 100644
+--- a/include/grub/util/install.h
++++ b/include/grub/util/install.h
+@@ -234,11 +234,13 @@ grub_install_get_default_powerpc_machtype (void);
+ int grub_install_efivar_register_efi (grub_device_t efidir_grub_dev,
+ 				      const char *efidir,
+ 				      const char *efifile_path,
+-				      const char *efi_distributor);
++				      const char *efi_distributor,
++				      const char *efi_title);
+ 
+ int grub_install_register_efi (grub_device_t efidir_grub_dev,
+ 			       const char *efidir, const char *efifile_path,
+-			       const char *efi_distributor);
++			       const char *efi_distributor,
++			       const char *efi_title);
+ 
+ void
+ grub_install_register_ieee1275 (int is_prep, const char *install_device,
+diff --git a/util/grub-install.c b/util/grub-install.c
+index 40663d6..b2a6898 100644
+--- a/util/grub-install.c
++++ b/util/grub-install.c
+@@ -985,7 +985,7 @@ int
+ main (int argc, char *argv[])
+ {
+   int is_efi = 0;
+-  const char *efi_distributor = NULL;
++  const char *efi_distributor = NULL, *efi_title = NULL;
+   const char *efi_suffix = NULL, *efi_suffix_upper = NULL;
+   char *efi_file = NULL;
+   char **grub_devices;
+@@ -1285,6 +1285,9 @@ main (int argc, char *argv[])
+       */
+       char *t;
+       efi_distributor = bootloader_id;
++      efi_title = config.grub_distributor;
++      if (!efi_title || efi_title[0] == '\0')
++	efi_title = "GRUB";
+       switch (platform)
+ 	{
+ 	case GRUB_INSTALL_PLATFORM_I386_EFI:
+@@ -2135,7 +2138,7 @@ main (int argc, char *argv[])
+ 	      int ret;
+ 	      ret = grub_install_register_efi (
+ 		  efidir_grub_dev, efidir, "\\System\\Library\\CoreServices",
+-		  efi_distributor);
++		  efi_distributor, efi_title);
+ 	      if (ret)
+ 	        grub_util_error (_("failed to register the EFI boot entry: %s"),
+ 				 strerror (ret));
+@@ -2170,7 +2173,10 @@ main (int argc, char *argv[])
+ 	    if (grub_util_is_regular (shim_signed))
+ 	      {
+ 		char *chained_base, *chained_dst;
+-		char *mok_src, *mok_dst, *bootcsv_src, *bootcsv_dst;
++		char *mok_src, *mok_dst, *bootcsv_dst, *bootcsv_utf8;
++		grub_ssize_t bootcsv_utf16_len;
++		grub_uint16_t *bootcsv_utf16;
++		FILE *bootcsv_dst_f;
+ 
+ 		/* Install grub as our chained bootloader */
+ 		chained_base = xasprintf ("grub%s.efi", efi_suffix);
+@@ -2204,11 +2210,15 @@ main (int argc, char *argv[])
+ 		free (mok_dst);
+ 
+ 		/* Also try to install boot.csv for fallback */
+-		bootcsv_src = grub_util_path_concat (2, "/usr/lib/shim/",
+-						     bootcsv);
+ 		bootcsv_dst = grub_util_path_concat (2, efidir, bootcsv);
+-		grub_install_copy_file (bootcsv_src, bootcsv_dst, 0);
+-		free (bootcsv_src);
++		bootcsv_utf8 = xasprintf("shim%s.efi,%s,,This is the boot entry for %s\n",
++					 efi_suffix, efi_title, efi_title);
++		bootcsv_utf16_len = grub_utf8_to_utf16_alloc (bootcsv_utf8, &bootcsv_utf16, NULL);
++		bootcsv_dst_f = grub_util_fopen (bootcsv_dst, "wb");
++		fwrite (bootcsv_utf16, bootcsv_utf16_len, sizeof *bootcsv_utf16, bootcsv_dst_f);
++		fclose (bootcsv_dst_f);
++		free (bootcsv_utf16);
++		free (bootcsv_utf8);
+ 		free (bootcsv_dst);
+ 	      }
+ 	    else
+@@ -2256,7 +2266,8 @@ main (int argc, char *argv[])
+ 			  (part ? ",": ""), (part ? : ""));
+ 	  grub_free (part);
+ 	  ret = grub_install_register_efi (efidir_grub_dev, efidir,
+-					   efifile_path, efi_distributor);
++					   efifile_path, efi_distributor,
++					   efi_title);
+ 	  if (ret)
+ 	    grub_util_error (_("failed to register the EFI boot entry: %s"),
+ 			     strerror (ret));
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/grub-install-extra-removable.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/grub-install-extra-removable.patch
--- 2.14~git20250718.0e36779-1/debian/patches/grub-install-extra-removable.patch	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/grub-install-extra-removable.patch	1970-01-01 00:00:00.000000000 +0000
@@ -1,201 +0,0 @@
-From: Steve McIntyre <93sam@debian.org>
-Date: Wed, 19 Jul 2023 12:23:19 +0200
-Subject: Add support for forcing EFI installation to the removable media path
-
-Add an extra option to grub-install "--force-extra-removable". On EFI
-platforms, this will cause an extra copy of the grub-efi image to be
-written to the appropriate removable media patch
-/boot/efi/EFI/BOOT/BOOT$ARCH.EFI as well. This will help with broken
-UEFI implementations where the firmware does not work when configured
-with new boot paths.
-
-Signed-off-by: Steve McIntyre <93sam@debian.org>
-
-Bug-Debian: https://bugs.debian.org/767037 https://bugs.debian.org/773092
-Forwarded: Not yet
-Last-Update: 2021-09-24
-
-Patch-Name: grub-install-extra-removable.patch
----
- util/grub-install.c | 110 +++++++++++++++++++++++++++++++++++++++++++++++++++-
- 1 file changed, 108 insertions(+), 2 deletions(-)
-
-diff --git a/util/grub-install.c b/util/grub-install.c
-index a2b46d6..2b85cd1 100644
---- a/util/grub-install.c
-+++ b/util/grub-install.c
-@@ -55,6 +55,7 @@
- 
- static char *target;
- static int removable = 0;
-+static int force_extra_removable = 0;
- static int recheck = 0;
- static int update_nvram = 1;
- static char *install_device = NULL;
-@@ -112,7 +113,8 @@ enum
-     OPTION_LABEL_BGCOLOR,
-     OPTION_PRODUCT_VERSION,
-     OPTION_UEFI_SECURE_BOOT,
--    OPTION_NO_UEFI_SECURE_BOOT
-+    OPTION_NO_UEFI_SECURE_BOOT,
-+    OPTION_FORCE_EXTRA_REMOVABLE
-   };
- 
- static int fs_probe = 1;
-@@ -215,6 +217,10 @@ argp_parser (int key, char *arg, struct argp_state *state)
-       removable = 1;
-       return 0;
- 
-+    case OPTION_FORCE_EXTRA_REMOVABLE:
-+      force_extra_removable = 1;
-+      return 0;
-+
-     case OPTION_ALLOW_FLOPPY:
-       allow_floppy = 1;
-       return 0;
-@@ -321,6 +327,9 @@ static struct argp_option options[] = {
-    N_("do not install an image usable with UEFI Secure Boot, even if the "
-       "system was currently started using it. "
-       "This option is only available on EFI."), 2},
-+  {"force-extra-removable", OPTION_FORCE_EXTRA_REMOVABLE, 0, 0,
-+   N_("force installation to the removable media path also. "
-+      "This option is only available on EFI."), 2},
-   {0, 0, 0, 0, 0, 0}
- };
- 
-@@ -862,6 +871,91 @@ try_open (const char *path)
- }
- #endif
- 
-+/* Helper routine for also_install_removable() below. Walk through the
-+   specified dir, looking to see if there is a file/dir that matches
-+   the search string exactly, but in a case-insensitive manner. If so,
-+   return a copy of the exact file/dir that *does* exist. If not,
-+   return NULL */
-+static char *
-+check_component_exists(const char *dir,
-+		       const char *search)
-+{
-+  grub_util_fd_dir_t d;
-+  grub_util_fd_dirent_t de;
-+  char *found = NULL;
-+
-+  d = grub_util_fd_opendir (dir);
-+  if (!d)
-+    grub_util_error (_("cannot open directory `%s': %s"),
-+		     dir, grub_util_fd_strerror ());
-+
-+  while ((de = grub_util_fd_readdir (d)))
-+    {
-+      if (strcasecmp (de->d_name, search) == 0)
-+	{
-+	  found = xstrdup (de->d_name);
-+	  break;
-+	}
-+    }
-+  grub_util_fd_closedir (d);
-+  return found;
-+}
-+
-+/* Some complex directory-handling stuff in here, to cope with
-+ * case-insensitive FAT/VFAT filesystem semantics. Ugh. */
-+static void
-+also_install_removable(const char *src,
-+		       const char *base_efidir,
-+		       const char *efi_suffix_upper)
-+{
-+  char *efi_file = NULL;
-+  char *dst = NULL;
-+  char *cur = NULL;
-+  char *found = NULL;
-+
-+  if (!efi_suffix_upper)
-+    grub_util_error ("%s", _("efi_suffix_upper not set"));
-+  efi_file = xasprintf ("BOOT%s.EFI", efi_suffix_upper);
-+
-+  /* We need to install in $base_efidir/EFI/BOOT/$efi_file, but we
-+   * need to cope with case-insensitive stuff here. Build the path one
-+   * component at a time, checking for existing matches each time. */
-+
-+  /* Look for "EFI" in base_efidir. Make it if it does not exist in
-+   * some form. */
-+  found = check_component_exists(base_efidir, "EFI");
-+  if (found == NULL)
-+    found = xstrdup("EFI");
-+  dst = grub_util_path_concat (2, base_efidir, found);
-+  cur = xstrdup (dst);
-+  free (dst);
-+  free (found);
-+  grub_install_mkdir_p (cur);
-+
-+  /* Now BOOT */
-+  found = check_component_exists(cur, "BOOT");
-+  if (found == NULL)
-+    found = xstrdup("BOOT");
-+  dst = grub_util_path_concat (2, cur, found);
-+  cur = xstrdup (dst);
-+  free (dst);
-+  free (found);
-+  grub_install_mkdir_p (cur);
-+
-+  /* Now $efi_file */
-+  found = check_component_exists(cur, efi_file);
-+  if (found == NULL)
-+    found = xstrdup(efi_file);
-+  dst = grub_util_path_concat (2, cur, found);
-+  cur = xstrdup (dst);
-+  free (dst);
-+  free (found);
-+  grub_install_copy_file (src, cur, 1);
-+
-+  free (cur);
-+  free (efi_file);
-+}
-+
- int
- main (int argc, char *argv[])
- {
-@@ -879,6 +973,7 @@ main (int argc, char *argv[])
-   char *relative_grubdir;
-   char **efidir_device_names = NULL;
-   grub_device_t efidir_grub_dev = NULL;
-+  char *base_efidir = NULL;
-   char *efidir_grub_devname;
-   int efidir_is_mac = 0;
-   int is_prep = 0;
-@@ -911,6 +1006,9 @@ main (int argc, char *argv[])
-       bootloader_id = xstrdup ("grub");
-     }
- 
-+  if (removable && force_extra_removable)
-+    grub_util_error (_("Invalid to use both --removable and --force_extra_removable"));
-+
-   if (!grub_install_source_directory)
-     {
-       if (!target)
-@@ -1152,6 +1250,8 @@ main (int argc, char *argv[])
- 	    grub_util_error (_("%s doesn't look like an EFI partition"), efidir);
- 	}
- 
-+      base_efidir = xstrdup(efidir);
-+
-       /* The EFI specification requires that an EFI System Partition must
- 	 contain an "EFI" subdirectory, and that OS loaders are stored in
- 	 subdirectories below EFI.  Vendors are expected to pick names that do
-@@ -2094,9 +2194,15 @@ main (int argc, char *argv[])
- 	    fprintf (config_dst_f, "configfile $prefix/grub.cfg\n");
- 	    fclose (config_dst_f);
- 	    free (config_dst);
-+	    if (force_extra_removable)
-+	      also_install_removable(efi_signed, base_efidir, efi_suffix_upper);
- 	  }
- 	else
--	  grub_install_copy_file (imgfile, dst, 1);
-+	  {
-+	    grub_install_copy_file (imgfile, dst, 1);
-+	    if (force_extra_removable)
-+	      also_install_removable(imgfile, base_efidir, efi_suffix_upper);
-+	  }
- 
- 	grub_set_install_backup_ponr ();
- 
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/grub-install-removable-shim.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/grub-install-removable-shim.patch
--- 2.14~git20250718.0e36779-1/debian/patches/grub-install-removable-shim.patch	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/grub-install-removable-shim.patch	1970-01-01 00:00:00.000000000 +0000
@@ -1,195 +0,0 @@
-From: Steve McIntyre <93sam@debian.org>
-Date: Fri, 14 Jun 2019 16:37:11 +0100
-Subject: Deal with --force-extra-removable with signed shim too
-
-In this case, we need both the signed shim as /EFI/BOOT/BOOTXXX.EFI
-and signed Grub as /EFI/BOOT/grubXXX.efi.
-
-Also install the BOOTXXX.CSV into /EFI/debian, and FBXXX.EFI into
-/EFI/BOOT/ so that it can work when needed (*iff* we're updating the
-NVRAM).
-
-[cjwatson: Refactored also_install_removable somewhat for brevity and so
-that we're using consistent case-insensitive logic.]
-
-Bug-Debian: https://bugs.debian.org/930531
-Last-Update: 2021-09-24
-
-Patch-Name: grub-install-removable-shim.patch
----
- util/grub-install.c | 84 ++++++++++++++++++++++++++++++++++++++++++-----------
- 1 file changed, 67 insertions(+), 17 deletions(-)
-
-diff --git a/util/grub-install.c b/util/grub-install.c
-index 2b85cd1..9468381 100644
---- a/util/grub-install.c
-+++ b/util/grub-install.c
-@@ -906,17 +906,13 @@ check_component_exists(const char *dir,
- static void
- also_install_removable(const char *src,
- 		       const char *base_efidir,
--		       const char *efi_suffix_upper)
-+		       const char *efi_file,
-+		       int is_needed)
- {
--  char *efi_file = NULL;
-   char *dst = NULL;
-   char *cur = NULL;
-   char *found = NULL;
- 
--  if (!efi_suffix_upper)
--    grub_util_error ("%s", _("efi_suffix_upper not set"));
--  efi_file = xasprintf ("BOOT%s.EFI", efi_suffix_upper);
--
-   /* We need to install in $base_efidir/EFI/BOOT/$efi_file, but we
-    * need to cope with case-insensitive stuff here. Build the path one
-    * component at a time, checking for existing matches each time. */
-@@ -950,10 +946,9 @@ also_install_removable(const char *src,
-   cur = xstrdup (dst);
-   free (dst);
-   free (found);
--  grub_install_copy_file (src, cur, 1);
-+  grub_install_copy_file (src, cur, is_needed);
- 
-   free (cur);
--  free (efi_file);
- }
- 
- int
-@@ -2131,11 +2126,14 @@ main (int argc, char *argv[])
-     case GRUB_INSTALL_PLATFORM_IA64_EFI:
-       {
- 	char *dst = grub_util_path_concat (2, efidir, efi_file);
-+	char *removable_file = xasprintf ("BOOT%s.EFI", efi_suffix_upper);
-+
- 	if (uefi_secure_boot)
- 	  {
- 	    char *shim_signed = NULL;
- 	    char *mok_signed = NULL, *mok_file = NULL;
- 	    char *fb_signed = NULL, *fb_file = NULL;
-+	    char *csv_file = NULL;
- 	    char *config_dst;
- 	    FILE *config_dst_f;
- 
-@@ -2144,11 +2142,15 @@ main (int argc, char *argv[])
- 	    mok_file = xasprintf ("mm%s.efi", efi_suffix);
- 	    fb_signed = xasprintf ("fb%s.efi.signed", efi_suffix);
- 	    fb_file = xasprintf ("fb%s.efi", efi_suffix);
-+	    csv_file = xasprintf ("BOOT%s.CSV", efi_suffix_upper);
-+
-+	    /* If we have a signed shim binary, install that and all
-+	       its helpers in the normal vendor path */
- 
- 	    if (grub_util_is_regular (shim_signed))
- 	      {
- 		char *chained_base, *chained_dst;
--		char *mok_src, *mok_dst, *fb_src, *fb_dst;
-+		char *mok_src, *mok_dst, *fb_src, *fb_dst, *csv_src, *csv_dst;
- 		if (!removable)
- 		  {
- 		    free (efi_file);
-@@ -2160,8 +2162,6 @@ main (int argc, char *argv[])
- 		chained_base = xasprintf ("grub%s.efi", efi_suffix);
- 		chained_dst = grub_util_path_concat (2, efidir, chained_base);
- 		grub_install_copy_file (efi_signed, chained_dst, 1);
--		free (chained_dst);
--		free (chained_base);
- 
- 		/* Not critical, so not an error if they are not present (as it
- 		   won't be for older releases); but if we have them, make
-@@ -2172,8 +2172,6 @@ main (int argc, char *argv[])
- 						    mok_file);
- 		grub_install_copy_file (mok_src,
- 					mok_dst, 0);
--		free (mok_src);
--		free (mok_dst);
- 
- 		fb_src = grub_util_path_concat (2, "/usr/lib/shim/",
- 						    fb_signed);
-@@ -2182,30 +2180,82 @@ main (int argc, char *argv[])
- 		if (!removable)
- 		  grub_install_copy_file (fb_src,
- 					  fb_dst, 0);
-+
-+		csv_src = grub_util_path_concat (2, "/usr/lib/shim/",
-+						    csv_file);
-+		csv_dst = grub_util_path_concat (2, efidir,
-+						    csv_file);
-+		grub_install_copy_file (csv_src,
-+					csv_dst, 0);
-+
-+		/* Install binaries into .../EFI/BOOT too:
-+		   the shim binary
-+		   the grub binary
-+		   the shim fallback binary (not fatal on failure) */
-+		if (force_extra_removable)
-+		  {
-+		    grub_util_info ("Secure boot: installing shim and image into rm path");
-+		    also_install_removable (shim_signed, base_efidir, removable_file, 1);
-+
-+		    also_install_removable (efi_signed, base_efidir, chained_base, 1);
-+		    also_install_removable (mok_src, base_efidir, mok_file, 0);
-+
-+		    /* If we're updating the NVRAM, add fallback too - it
-+			will re-update the NVRAM later if things break */
-+		    if (update_nvram)
-+		      also_install_removable (fb_src, base_efidir, fb_file, 0);
-+		  }
-+
-+		free (chained_dst);
-+		free (chained_base);
-+		free (mok_src);
-+		free (mok_dst);
- 		free (fb_src);
- 		free (fb_dst);
-+		free (csv_src);
-+		free (csv_dst);
- 	      }
- 	    else
--	      grub_install_copy_file (efi_signed, dst, 1);
-+	      {
-+		/* Tried to install for secure boot, but no signed
-+		   shim found. Fall back to just installing the signed
-+		   grub binary */
-+		grub_util_info ("Secure boot (no shim): installing signed grub binary");
-+		grub_install_copy_file (efi_signed, dst, 1);
-+		if (force_extra_removable)
-+		  {
-+		    grub_util_info ("Secure boot (no shim): installing signed grub binary into rm path");
-+		    also_install_removable (efi_signed, base_efidir, removable_file, 1);
-+		  }
-+	      }
- 
-+	    /* In either case, install our grub.cfg */
- 	    config_dst = grub_util_path_concat (2, efidir, "grub.cfg");
- 	    grub_install_copy_file (load_cfg, config_dst, 1);
- 	    config_dst_f = grub_util_fopen (config_dst, "ab");
- 	    fprintf (config_dst_f, "configfile $prefix/grub.cfg\n");
- 	    fclose (config_dst_f);
- 	    free (config_dst);
--	    if (force_extra_removable)
--	      also_install_removable(efi_signed, base_efidir, efi_suffix_upper);
-+
-+	    free (csv_file);
-+	    free (fb_file);
-+	    free (fb_signed);
-+	    free (mok_file);
-+	    free (mok_signed);
-+	    free (shim_signed);
- 	  }
- 	else
- 	  {
-+	    /* No secure boot - just install our newly-generated image */
-+	    grub_util_info ("No Secure Boot: installing core image");
- 	    grub_install_copy_file (imgfile, dst, 1);
- 	    if (force_extra_removable)
--	      also_install_removable(imgfile, base_efidir, efi_suffix_upper);
-+	      also_install_removable (imgfile, base_efidir, removable_file, 1);
- 	  }
- 
- 	grub_set_install_backup_ponr ();
- 
-+	free (removable_file);
- 	free (dst);
-       }
-       if (!removable && update_nvram)
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/grub-sort-version.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/grub-sort-version.patch
--- 2.14~git20250718.0e36779-1/debian/patches/grub-sort-version.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/grub-sort-version.patch	2025-09-09 15:43:51.000000000 +0000
@@ -0,0 +1,52 @@
+From: Julian Andres Klode <julian.klode@canonical.com>
+Date: Mon, 25 Sep 2023 10:24:11 +0200
+Subject: grub-mkconfig: Use grub-sort-version
+
+We need to have support for GRUB_FLAVOUR_ORDER and it's arguably
+the easiest way to hook this in, although you might be able to
+write this as an awk script or something.
+---
+ util/grub-mkconfig.in     |  3 ++-
+ util/grub-mkconfig_lib.in | 15 +--------------
+ 2 files changed, 3 insertions(+), 15 deletions(-)
+
+diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in
+index 46b036b..0b1adf5 100644
+--- a/util/grub-mkconfig.in
++++ b/util/grub-mkconfig.in
+@@ -270,7 +270,8 @@ export GRUB_DEFAULT \
+   GRUB_RECORDFAIL_TIMEOUT \
+   GRUB_RECOVERY_TITLE \
+   GRUB_FORCE_PARTUUID \
+-  GRUB_DISABLE_INITRD
++  GRUB_DISABLE_INITRD \
++  GRUB_FLAVOUR_ORDER
+ 
+ if test "x${grub_cfg}" != "x"; then
+   rm -f "${grub_cfg}.new"
+diff --git a/util/grub-mkconfig_lib.in b/util/grub-mkconfig_lib.in
+index 0895328..5a0c665 100644
+--- a/util/grub-mkconfig_lib.in
++++ b/util/grub-mkconfig_lib.in
+@@ -202,20 +202,7 @@ grub_file_is_not_garbage ()
+ 
+ version_sort ()
+ {
+-  case $version_sort_sort_has_v in
+-    yes)
+-      LC_ALL=C sort -V "$@";;
+-    no)
+-      LC_ALL=C sort -n "$@";;
+-    *)
+-      if sort -V </dev/null > /dev/null 2>&1; then
+-        version_sort_sort_has_v=yes
+-	LC_ALL=C sort -V "$@"
+-      else
+-        version_sort_sort_has_v=no
+-        LC_ALL=C sort -n "$@"
+-      fi;;
+-   esac
++  LC_ALL=C /usr/lib/grub/grub-sort-version "$@"
+ }
+ 
+ # Given an item as the first argument and a list as the subsequent arguments,
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/install-signed.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/install-signed.patch
--- 2.14~git20250718.0e36779-1/debian/patches/install-signed.patch	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/install-signed.patch	1970-01-01 00:00:00.000000000 +0000
@@ -1,318 +0,0 @@
-From: Julian Andres Klode <julian.klode@canonical.com>
-Date: Wed, 19 Jul 2023 12:15:02 +0200
-Subject: Install signed images if UEFI Secure Boot is enabled
-MIME-Version: 1.0
-Content-Type: text/plain; charset="utf-8"
-Content-Transfer-Encoding: 8bit
-
-Author: Stéphane Graber <stgraber@ubuntu.com>
-Author: Steve Langasek <steve.langasek@ubuntu.com>
-Author: Linn Crosetto <linn@hpe.com>
-Author: Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>
-Forwarded: no
-Last-Update: 2023-01-15
-
-Patch-Name: install-signed.patch
----
- util/grub-install.c | 220 ++++++++++++++++++++++++++++++++++++----------------
- 1 file changed, 155 insertions(+), 65 deletions(-)
-
-diff --git a/util/grub-install.c b/util/grub-install.c
-index 2f5031c..a2b46d6 100644
---- a/util/grub-install.c
-+++ b/util/grub-install.c
-@@ -79,6 +79,7 @@ static char *label_color;
- static char *label_bgcolor;
- static char *product_version;
- static int add_rs_codes = 1;
-+static int uefi_secure_boot = 1;
- 
- enum
-   {
-@@ -109,7 +110,9 @@ enum
-     OPTION_LABEL_FONT,
-     OPTION_LABEL_COLOR,
-     OPTION_LABEL_BGCOLOR,
--    OPTION_PRODUCT_VERSION
-+    OPTION_PRODUCT_VERSION,
-+    OPTION_UEFI_SECURE_BOOT,
-+    OPTION_NO_UEFI_SECURE_BOOT
-   };
- 
- static int fs_probe = 1;
-@@ -233,6 +236,14 @@ argp_parser (int key, char *arg, struct argp_state *state)
-       bootloader_id = xstrdup (arg);
-       return 0;
- 
-+    case OPTION_UEFI_SECURE_BOOT:
-+      uefi_secure_boot = 1;
-+      return 0;
-+
-+    case OPTION_NO_UEFI_SECURE_BOOT:
-+      uefi_secure_boot = 0;
-+      return 0;
-+
-     case ARGP_KEY_ARG:
-       if (install_device)
- 	grub_util_error ("%s", _("More than one install device?"));
-@@ -302,6 +313,14 @@ static struct argp_option options[] = {
-   {"label-color", OPTION_LABEL_COLOR, N_("COLOR"), 0, N_("use COLOR for label"), 2},
-   {"label-bgcolor", OPTION_LABEL_BGCOLOR, N_("COLOR"), 0, N_("use COLOR for label background"), 2},
-   {"product-version", OPTION_PRODUCT_VERSION, N_("STRING"), 0, N_("use STRING as product version"), 2},
-+  {"uefi-secure-boot", OPTION_UEFI_SECURE_BOOT, 0, 0,
-+   N_("install an image usable with UEFI Secure Boot. "
-+      "This option is only available on EFI and if the grub-efi-amd64-signed "
-+      "package is installed."), 2},
-+  {"no-uefi-secure-boot", OPTION_NO_UEFI_SECURE_BOOT, 0, 0,
-+   N_("do not install an image usable with UEFI Secure Boot, even if the "
-+      "system was currently started using it. "
-+      "This option is only available on EFI."), 2},
-   {0, 0, 0, 0, 0, 0}
- };
- 
-@@ -848,7 +867,8 @@ main (int argc, char *argv[])
- {
-   int is_efi = 0;
-   const char *efi_distributor = NULL;
--  const char *efi_file = NULL;
-+  const char *efi_suffix = NULL, *efi_suffix_upper = NULL;
-+  char *efi_file = NULL;
-   char **grub_devices;
-   grub_fs_t grub_fs;
-   grub_device_t grub_dev = NULL;
-@@ -1140,6 +1160,43 @@ main (int argc, char *argv[])
-       */
-       char *t;
-       efi_distributor = bootloader_id;
-+      switch (platform)
-+	{
-+	case GRUB_INSTALL_PLATFORM_I386_EFI:
-+	  efi_suffix = "ia32";
-+	  efi_suffix_upper = "IA32";
-+	  break;
-+	case GRUB_INSTALL_PLATFORM_X86_64_EFI:
-+	  efi_suffix = "x64";
-+	  efi_suffix_upper = "X64";
-+	  break;
-+	case GRUB_INSTALL_PLATFORM_IA64_EFI:
-+	  efi_suffix = "ia64";
-+	  efi_suffix_upper = "IA64";
-+	  break;
-+	case GRUB_INSTALL_PLATFORM_ARM_EFI:
-+	  efi_suffix = "arm";
-+	  efi_suffix_upper = "ARM";
-+	  break;
-+	case GRUB_INSTALL_PLATFORM_ARM64_EFI:
-+	  efi_suffix = "aa64";
-+	  efi_suffix_upper = "AA64";
-+	  break;
-+	case GRUB_INSTALL_PLATFORM_LOONGARCH64_EFI:
-+	  efi_suffix = "loongarch64";
-+	  efi_suffix_upper = "LOONGARCH64";
-+	  break;
-+	case GRUB_INSTALL_PLATFORM_RISCV32_EFI:
-+	  efi_suffix = "riscv32";
-+	  efi_suffix_upper = "RISCV32";
-+	  break;
-+	case GRUB_INSTALL_PLATFORM_RISCV64_EFI:
-+	  efi_suffix = "riscv64";
-+	  efi_suffix_upper = "RISCV64";
-+	  break;
-+	default:
-+	  break;
-+	}
-       if (removable)
- 	{
- 	  /* The specification makes stricter requirements of removable
-@@ -1148,72 +1205,16 @@ main (int argc, char *argv[])
- 	     must have a specific file name depending on the architecture.
- 	  */
- 	  efi_distributor = "BOOT";
--	  switch (platform)
--	    {
--	    case GRUB_INSTALL_PLATFORM_I386_EFI:
--	      efi_file = "BOOTIA32.EFI";
--	      break;
--	    case GRUB_INSTALL_PLATFORM_X86_64_EFI:
--	      efi_file = "BOOTX64.EFI";
--	      break;
--	    case GRUB_INSTALL_PLATFORM_IA64_EFI:
--	      efi_file = "BOOTIA64.EFI";
--	      break;
--	    case GRUB_INSTALL_PLATFORM_ARM_EFI:
--	      efi_file = "BOOTARM.EFI";
--	      break;
--	    case GRUB_INSTALL_PLATFORM_ARM64_EFI:
--	      efi_file = "BOOTAA64.EFI";
--	      break;
--	    case GRUB_INSTALL_PLATFORM_LOONGARCH64_EFI:
--	      efi_file = "BOOTLOONGARCH64.EFI";
--	      break;
--	    case GRUB_INSTALL_PLATFORM_RISCV32_EFI:
--	      efi_file = "BOOTRISCV32.EFI";
--	      break;
--	    case GRUB_INSTALL_PLATFORM_RISCV64_EFI:
--	      efi_file = "BOOTRISCV64.EFI";
--	      break;
--	    default:
--	      grub_util_error ("%s", _("You've found a bug"));
--	      break;
--	    }
-+	  if (!efi_suffix)
-+	    grub_util_error ("%s", _("You've found a bug"));
-+	  efi_file = xasprintf ("BOOT%s.EFI", efi_suffix_upper);
- 	}
-       else
- 	{
- 	  /* It is convenient for each architecture to have a different
- 	     efi_file, so that different versions can be installed in parallel.
- 	  */
--	  switch (platform)
--	    {
--	    case GRUB_INSTALL_PLATFORM_I386_EFI:
--	      efi_file = "grubia32.efi";
--	      break;
--	    case GRUB_INSTALL_PLATFORM_X86_64_EFI:
--	      efi_file = "grubx64.efi";
--	      break;
--	    case GRUB_INSTALL_PLATFORM_IA64_EFI:
--	      efi_file = "grubia64.efi";
--	      break;
--	    case GRUB_INSTALL_PLATFORM_ARM_EFI:
--	      efi_file = "grubarm.efi";
--	      break;
--	    case GRUB_INSTALL_PLATFORM_ARM64_EFI:
--	      efi_file = "grubaa64.efi";
--	      break;
--	    case GRUB_INSTALL_PLATFORM_LOONGARCH64_EFI:
--	      efi_file = "grubloongarch64.efi";
--	      break;
--	    case GRUB_INSTALL_PLATFORM_RISCV32_EFI:
--	      efi_file = "grubriscv32.efi";
--	      break;
--	    case GRUB_INSTALL_PLATFORM_RISCV64_EFI:
--	      efi_file = "grubriscv64.efi";
--	      break;
--	    default:
--	      efi_file = "grub.efi";
--	      break;
--	    }
-+	  efi_file = xasprintf ("grub%s.efi", efi_suffix);
- 	}
-       t = grub_util_path_concat (3, efidir, "EFI", efi_distributor);
-       free (efidir);
-@@ -1432,14 +1433,38 @@ main (int argc, char *argv[])
-               debug_image);
-     }
- 
--  if (!have_abstractions)
-+  char *efi_signed = NULL;
-+  switch (platform)
-+    {
-+    case GRUB_INSTALL_PLATFORM_I386_EFI:
-+    case GRUB_INSTALL_PLATFORM_X86_64_EFI:
-+    case GRUB_INSTALL_PLATFORM_ARM_EFI:
-+    case GRUB_INSTALL_PLATFORM_ARM64_EFI:
-+    case GRUB_INSTALL_PLATFORM_IA64_EFI:
-+      {
-+	char *dir = xasprintf ("%s-signed", grub_install_source_directory);
-+	char *signed_image;
-+	signed_image = xasprintf ("grub%s.efi.signed", efi_suffix);
-+	efi_signed = grub_util_path_concat (2, dir, signed_image);
-+	break;
-+      }
-+
-+    default:
-+      break;
-+    }
-+
-+  if (!efi_signed || !grub_util_is_regular (efi_signed))
-+    uefi_secure_boot = 0;
-+
-+  if (!have_abstractions || uefi_secure_boot)
-     {
-       if ((disk_module && grub_strcmp (disk_module, "biosdisk") != 0)
- 	  || grub_drives[1]
- 	  || (!install_drive
- 	      && platform != GRUB_INSTALL_PLATFORM_POWERPC_IEEE1275)
- 	  || (install_drive && !is_same_disk (grub_drives[0], install_drive))
--	  || !have_bootdev (platform))
-+	  || !have_bootdev (platform)
-+	  || uefi_secure_boot)
- 	{
- 	  char *uuid = NULL;
- 
-@@ -2006,7 +2031,72 @@ main (int argc, char *argv[])
-     case GRUB_INSTALL_PLATFORM_IA64_EFI:
-       {
- 	char *dst = grub_util_path_concat (2, efidir, efi_file);
--	grub_install_copy_file (imgfile, dst, 1);
-+	if (uefi_secure_boot)
-+	  {
-+	    char *shim_signed = NULL;
-+	    char *mok_signed = NULL, *mok_file = NULL;
-+	    char *fb_signed = NULL, *fb_file = NULL;
-+	    char *config_dst;
-+	    FILE *config_dst_f;
-+
-+	    shim_signed = xasprintf ("/usr/lib/shim/shim%s.efi.signed", efi_suffix);
-+	    mok_signed = xasprintf ("mm%s.efi.signed", efi_suffix);
-+	    mok_file = xasprintf ("mm%s.efi", efi_suffix);
-+	    fb_signed = xasprintf ("fb%s.efi.signed", efi_suffix);
-+	    fb_file = xasprintf ("fb%s.efi", efi_suffix);
-+
-+	    if (grub_util_is_regular (shim_signed))
-+	      {
-+		char *chained_base, *chained_dst;
-+		char *mok_src, *mok_dst, *fb_src, *fb_dst;
-+		if (!removable)
-+		  {
-+		    free (efi_file);
-+		    efi_file = xasprintf ("shim%s.efi", efi_suffix);
-+		    free (dst);
-+		    dst = grub_util_path_concat (2, efidir, efi_file);
-+		  }
-+		grub_install_copy_file (shim_signed, dst, 1);
-+		chained_base = xasprintf ("grub%s.efi", efi_suffix);
-+		chained_dst = grub_util_path_concat (2, efidir, chained_base);
-+		grub_install_copy_file (efi_signed, chained_dst, 1);
-+		free (chained_dst);
-+		free (chained_base);
-+
-+		/* Not critical, so not an error if they are not present (as it
-+		   won't be for older releases); but if we have them, make
-+		   sure they are installed.  */
-+		mok_src = grub_util_path_concat (2, "/usr/lib/shim/",
-+						    mok_signed);
-+		mok_dst = grub_util_path_concat (2, efidir,
-+						    mok_file);
-+		grub_install_copy_file (mok_src,
-+					mok_dst, 0);
-+		free (mok_src);
-+		free (mok_dst);
-+
-+		fb_src = grub_util_path_concat (2, "/usr/lib/shim/",
-+						    fb_signed);
-+		fb_dst = grub_util_path_concat (2, efidir,
-+						    fb_file);
-+		if (!removable)
-+		  grub_install_copy_file (fb_src,
-+					  fb_dst, 0);
-+		free (fb_src);
-+		free (fb_dst);
-+	      }
-+	    else
-+	      grub_install_copy_file (efi_signed, dst, 1);
-+
-+	    config_dst = grub_util_path_concat (2, efidir, "grub.cfg");
-+	    grub_install_copy_file (load_cfg, config_dst, 1);
-+	    config_dst_f = grub_util_fopen (config_dst, "ab");
-+	    fprintf (config_dst_f, "configfile $prefix/grub.cfg\n");
-+	    fclose (config_dst_f);
-+	    free (config_dst);
-+	  }
-+	else
-+	  grub_install_copy_file (imgfile, dst, 1);
- 
- 	grub_set_install_backup_ponr ();
- 
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/rhboot-f34-dont-use-int-for-efi-status.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/rhboot-f34-dont-use-int-for-efi-status.patch
--- 2.14~git20250718.0e36779-1/debian/patches/rhboot-f34-dont-use-int-for-efi-status.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/rhboot-f34-dont-use-int-for-efi-status.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,23 @@
+From: Peter Jones <pjones@redhat.com>
+Date: Mon, 26 Jun 2017 12:44:59 -0400
+Subject: don't use int for efi status
+
+(cherry picked from commit eee6d2db7e3a392b8fe134fa75a7e28c9ae8cda5)
+Patch-Name: rhboot-f34-dont-use-int-for-efi-status.patch
+---
+ grub-core/kern/efi/efi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c
+index ff5b032..368d1d9 100644
+--- a/grub-core/kern/efi/efi.c
++++ b/grub-core/kern/efi/efi.c
+@@ -177,7 +177,7 @@ grub_reboot (void)
+ void
+ grub_exit (int retval)
+ {
+-  int rc = GRUB_EFI_LOAD_ERROR;
++  grub_efi_status_t rc = GRUB_EFI_LOAD_ERROR;
+ 
+   if (retval == 0)
+     rc = GRUB_EFI_SUCCESS;
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/rhboot-f34-make-exit-take-a-return-code.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/rhboot-f34-make-exit-take-a-return-code.patch
--- 2.14~git20250718.0e36779-1/debian/patches/rhboot-f34-make-exit-take-a-return-code.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/rhboot-f34-make-exit-take-a-return-code.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,286 @@
+From: Peter Jones <pjones@redhat.com>
+Date: Wed, 26 Feb 2014 21:49:12 -0500
+Subject: Make "exit" take a return code.
+
+This adds "exit" with a return code.  With this patch, any "exit"
+command /may/ include a return code, and on platforms that support
+returning with an exit status, we will do so.  By default we return the
+same exit status we did before this patch.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+(cherry picked from commit ccce3d69ae3eacc7bdc70217304586bd7e74fe1e)
+Patch-Name: rhboot-f34-make-exit-take-a-return-code.patch
+---
+ grub-core/commands/minicmd.c         | 19 +++++++++++++++----
+ grub-core/kern/efi/efi.c             |  9 +++++++--
+ grub-core/kern/emu/main.c            |  2 +-
+ grub-core/kern/emu/misc.c            |  7 ++++---
+ grub-core/kern/i386/coreboot/init.c  |  2 +-
+ grub-core/kern/i386/qemu/init.c      |  2 +-
+ grub-core/kern/ieee1275/init.c       |  2 +-
+ grub-core/kern/mips/arc/init.c       |  2 +-
+ grub-core/kern/mips/loongson/init.c  |  2 +-
+ grub-core/kern/mips/qemu_mips/init.c |  2 +-
+ grub-core/kern/misc.c                | 11 ++++++++++-
+ grub-core/kern/uboot/init.c          |  6 +++---
+ grub-core/kern/xen/init.c            |  2 +-
+ include/grub/misc.h                  |  2 +-
+ 14 files changed, 48 insertions(+), 22 deletions(-)
+
+diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c
+index ff4ff02..e756071 100644
+--- a/grub-core/commands/minicmd.c
++++ b/grub-core/commands/minicmd.c
+@@ -186,11 +186,22 @@ grub_mini_cmd_lsmod (struct grub_command *cmd __attribute__ ((unused)),
+ }
+ 
+ /* exit */
+-static grub_err_t __attribute__ ((noreturn))
++static grub_err_t
+ grub_mini_cmd_exit (struct grub_command *cmd __attribute__ ((unused)),
+-		    int argc __attribute__ ((unused)),
+-		    char *argv[] __attribute__ ((unused)))
++		    int argc, char *argv[])
+ {
++  int retval = -1;
++  unsigned long n;
++
++  if (argc < 0 || argc > 1)
++    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("one argument expected"));
++
++  if (argc == 1)
++    {
++      n = grub_strtoul (argv[0], 0, 10);
++      if (n != ~0UL)
++	retval = n;
++    }
+ #ifdef GRUB_MACHINE_EFI
+   /*
+    * The "exit" command is often used to launch the next boot application.
+@@ -198,7 +209,7 @@ grub_mini_cmd_exit (struct grub_command *cmd __attribute__ ((unused)),
+    */
+   grub_cryptodisk_erasesecrets ();
+ #endif
+-  grub_exit ();
++  grub_exit (retval);
+   /* Not reached.  */
+ }
+ 
+diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c
+index 1e330a2..ff5b032 100644
+--- a/grub-core/kern/efi/efi.c
++++ b/grub-core/kern/efi/efi.c
+@@ -175,11 +175,16 @@ grub_reboot (void)
+ }
+ 
+ void
+-grub_exit (void)
++grub_exit (int retval)
+ {
++  int rc = GRUB_EFI_LOAD_ERROR;
++
++  if (retval == 0)
++    rc = GRUB_EFI_SUCCESS;
++
+   grub_machine_fini (GRUB_LOADER_FLAG_NORETURN);
+   grub_efi_system_table->boot_services->exit (grub_efi_image_handle,
+-					      GRUB_EFI_SUCCESS, 0, 0);
++					      rc, 0, 0);
+   for (;;) ;
+ }
+ 
+diff --git a/grub-core/kern/emu/main.c b/grub-core/kern/emu/main.c
+index 8a70bd7..4548015 100644
+--- a/grub-core/kern/emu/main.c
++++ b/grub-core/kern/emu/main.c
+@@ -67,7 +67,7 @@ grub_reboot (void)
+ }
+ 
+ void
+-grub_exit (void)
++grub_exit (int retval __attribute__((unused)))
+ {
+   grub_reboot ();
+ }
+diff --git a/grub-core/kern/emu/misc.c b/grub-core/kern/emu/misc.c
+index 1db24fd..cd76145 100644
+--- a/grub-core/kern/emu/misc.c
++++ b/grub-core/kern/emu/misc.c
+@@ -87,7 +87,7 @@ grub_util_error (const char *fmt, ...)
+   vfprintf (stderr, fmt, ap);
+   va_end (ap);
+   fprintf (stderr, ".\n");
+-  grub_exit ();
++  grub_exit (1);
+ }
+ 
+ void *
+@@ -156,12 +156,13 @@ xasprintf (const char *fmt, ...)
+ 
+ #if !defined (GRUB_MACHINE_EMU) || defined (GRUB_UTIL)
+ void
+-grub_exit (void)
++__attribute__ ((noreturn))
++grub_exit (int rc)
+ {
+ #if defined (GRUB_KERNEL)
+   grub_reboot ();
+ #endif
+-  exit (1);
++  exit (rc < 0 ? 1 : rc);
+ }
+ #endif
+ 
+diff --git a/grub-core/kern/i386/coreboot/init.c b/grub-core/kern/i386/coreboot/init.c
+index 4fae8b5..feaf929 100644
+--- a/grub-core/kern/i386/coreboot/init.c
++++ b/grub-core/kern/i386/coreboot/init.c
+@@ -41,7 +41,7 @@ extern grub_uint8_t _end[];
+ extern grub_uint8_t _edata[];
+ 
+ void  __attribute__ ((noreturn))
+-grub_exit (void)
++grub_exit (int rc __attribute__((unused)))
+ {
+   /* We can't use grub_fatal() in this function.  This would create an infinite
+      loop, since grub_fatal() calls grub_abort() which in turn calls grub_exit().  */
+diff --git a/grub-core/kern/i386/qemu/init.c b/grub-core/kern/i386/qemu/init.c
+index 08f81d2..604fc94 100644
+--- a/grub-core/kern/i386/qemu/init.c
++++ b/grub-core/kern/i386/qemu/init.c
+@@ -42,7 +42,7 @@ extern grub_uint8_t _end[];
+ extern grub_uint8_t _edata[];
+ 
+ void  __attribute__ ((noreturn))
+-grub_exit (void)
++grub_exit (int rc __attribute__((unused)))
+ {
+   /* We can't use grub_fatal() in this function.  This would create an infinite
+      loop, since grub_fatal() calls grub_abort() which in turn calls grub_exit().  */
+diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c
+index c977182..0fac391 100644
+--- a/grub-core/kern/ieee1275/init.c
++++ b/grub-core/kern/ieee1275/init.c
+@@ -124,7 +124,7 @@ grub_addr_t grub_ieee1275_original_stack;
+ #define RADIX_GTSE_ENABLED   0x40
+ 
+ void
+-grub_exit (void)
++grub_exit (int rc __attribute__((unused)))
+ {
+   grub_ieee1275_exit ();
+ }
+diff --git a/grub-core/kern/mips/arc/init.c b/grub-core/kern/mips/arc/init.c
+index 2ed3ff3..5c40c34 100644
+--- a/grub-core/kern/mips/arc/init.c
++++ b/grub-core/kern/mips/arc/init.c
+@@ -276,7 +276,7 @@ grub_halt (void)
+ }
+ 
+ void
+-grub_exit (void)
++grub_exit (int rc __attribute__((unused)))
+ {
+   GRUB_ARC_FIRMWARE_VECTOR->exit ();
+ 
+diff --git a/grub-core/kern/mips/loongson/init.c b/grub-core/kern/mips/loongson/init.c
+index 5bd7212..97b09b0 100644
+--- a/grub-core/kern/mips/loongson/init.c
++++ b/grub-core/kern/mips/loongson/init.c
+@@ -304,7 +304,7 @@ grub_halt (void)
+ }
+ 
+ void
+-grub_exit (void)
++grub_exit (int rc __attribute__((unused)))
+ {
+   grub_halt ();
+ }
+diff --git a/grub-core/kern/mips/qemu_mips/init.c b/grub-core/kern/mips/qemu_mips/init.c
+index b5477b8..69488a3 100644
+--- a/grub-core/kern/mips/qemu_mips/init.c
++++ b/grub-core/kern/mips/qemu_mips/init.c
+@@ -75,7 +75,7 @@ grub_machine_fini (int flags __attribute__ ((unused)))
+ }
+ 
+ void
+-grub_exit (void)
++grub_exit (int rc __attribute__((unused)))
+ {
+   grub_halt ();
+ }
+diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c
+index 2b79223..cb3883b 100644
+--- a/grub-core/kern/misc.c
++++ b/grub-core/kern/misc.c
+@@ -1316,9 +1316,18 @@ grub_abort (void)
+       grub_getkey ();
+     }
+ 
+-  grub_exit ();
++  grub_exit (1);
+ }
+ 
++#if defined (__clang__) && !defined (GRUB_UTIL)
++/* clang emits references to abort().  */
++void __attribute__ ((noreturn))
++abort (void)
++{
++  grub_abort ();
++}
++#endif
++
+ void
+ grub_fatal (const char *fmt, ...)
+ {
+diff --git a/grub-core/kern/uboot/init.c b/grub-core/kern/uboot/init.c
+index 3e33864..be2a5be 100644
+--- a/grub-core/kern/uboot/init.c
++++ b/grub-core/kern/uboot/init.c
+@@ -39,9 +39,9 @@ extern grub_size_t grub_total_module_size;
+ static unsigned long timer_start;
+ 
+ void
+-grub_exit (void)
++grub_exit (int rc)
+ {
+-  grub_uboot_return (0);
++  grub_uboot_return (rc < 0 ? 1 : rc);
+ }
+ 
+ static grub_uint64_t
+@@ -78,7 +78,7 @@ grub_machine_init (void)
+   if (!ver)
+     {
+       /* Don't even have a console to log errors to... */
+-      grub_exit ();
++      grub_exit (-1);
+     }
+   else if (ver > API_SIG_VERSION)
+     {
+diff --git a/grub-core/kern/xen/init.c b/grub-core/kern/xen/init.c
+index 782ca72..708b060 100644
+--- a/grub-core/kern/xen/init.c
++++ b/grub-core/kern/xen/init.c
+@@ -584,7 +584,7 @@ grub_machine_init (void)
+ }
+ 
+ void
+-grub_exit (void)
++grub_exit (int rc __attribute__((unused)))
+ {
+   struct sched_shutdown arg;
+ 
+diff --git a/include/grub/misc.h b/include/grub/misc.h
+index e087e7b..c7128f4 100644
+--- a/include/grub/misc.h
++++ b/include/grub/misc.h
+@@ -424,7 +424,7 @@ char *EXPORT_FUNC(grub_xasprintf) (const char *fmt, ...)
+      __attribute__ ((format (GNU_PRINTF, 1, 2))) WARN_UNUSED_RESULT;
+ char *EXPORT_FUNC(grub_xvasprintf) (const char *fmt, va_list args) WARN_UNUSED_RESULT;
+ 
+-void EXPORT_FUNC(grub_exit) (void) __attribute__ ((noreturn));
++void EXPORT_FUNC(grub_exit) (int rc) __attribute__ ((noreturn));
+ void EXPORT_FUNC(grub_abort) (void) __attribute__ ((noreturn));
+ grub_uint64_t EXPORT_FUNC(grub_divmod64) (grub_uint64_t n,
+ 					  grub_uint64_t d,
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/series 2.14~git20250718.0e36779-1ubuntu4/debian/patches/series
--- 2.14~git20250718.0e36779-1/debian/patches/series	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/series	2025-09-09 15:43:51.000000000 +0000
@@ -62,6 +62,47 @@ upstream/fs-xfs-Handle-root-inode-read-f
 upstream/zfs-fix-LINUX_ROOT_DEVICE-when-grub-probe-fails.patch
 upstream/Add-noescape-argument-to-cmdline-creation.patch
 upstream/Check-out-missing-distfiles-from-upstream-git-branch.patch
-install-signed.patch
-grub-install-extra-removable.patch
-grub-install-removable-shim.patch
+ubuntu-install-signed.patch
+ubuntu-grub-install-extra-removable.patch
+ubuntu-zfs-enhance-support.patch
+ubuntu-zfs-mkconfig-ubuntu-recovery.patch
+ubuntu-zfs-mkconfig-ubuntu-distributor.patch
+ubuntu-zfs-mkconfig-signed-kernel.patch
+ubuntu-zfs-gfxpayload-keep-default.patch
+ubuntu-zfs-gfxpayload-dynamic.patch
+ubuntu-zfs-vt-handoff.patch
+ubuntu-zfs-mkconfig-recovery-title.patch
+ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch
+ubuntu-support-initrd-less-boot.patch
+ubuntu-shorter-version-info.patch
+ubuntu-add-initrd-less-boot-fallback.patch
+ubuntu-mkconfig-leave-breadcrumbs.patch
+ubuntu-fix-lzma-decompressor-objcopy.patch
+ubuntu-add-devicetree-command-support.patch
+ubuntu-boot-from-multipath-dependent-symlink.patch
+ubuntu-resilient-boot-ignore-alternative-esps.patch
+ubuntu-resilient-boot-boot-order.patch
+ubuntu-speed-zsys-history.patch
+ubuntu-dont-verify-loopback-images.patch
+ubuntu-recovery-dis_ucode_ldr.patch
+ubuntu-add-initrd-less-boot-messages.patch
+rhboot-f34-make-exit-take-a-return-code.patch
+rhboot-f34-dont-use-int-for-efi-status.patch
+suse-grub.texi-add-net_bootp6-document.patch
+ubuntu-verifiers-last.patch
+ubuntu-os-prober-auto.patch
+grub-sort-version.patch
+Revert-kern-ieee1275-init-ppc64-Display-upper_mem_limit-w.patch
+Revert-kern-ieee1275-init-ppc64-Fix-a-comment.patch
+Revert-kern-ieee1275-ieee1275-Display-successful-memory-c.patch
+Revert-loader-powerpc-ieee1275-Use-new-allocation-functio.patch
+Revert-kern-ieee1275-cmain-ppc64-Introduce-flags-to-ident.patch
+Revert-kern-ieee1275-init-ppc64-Rename-regions_claim-to-g.patch
+Revert-kern-ieee1275-init-ppc64-Add-support-for-alignment.patch
+Revert-kern-ieee1275-init-ppc64-Return-allocated-address-.patch
+Revert-kern-ieee1275-init-ppc64-Decide-by-request-whether.patch
+Revert-kern-ieee1275-init-ppc64-Introduce-a-request-for-r.patch
+grub-install-efi-title.patch
+upstream/util-bash-completion.d-Makefile.am-s-mkrescure-mkrescue-g.patch
+arm64-add-snapdragon-quirk.patch
+UBUNTU-Do-not-attempt-to-load-the-bli-module.patch
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/suse-grub.texi-add-net_bootp6-document.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/suse-grub.texi-add-net_bootp6-document.patch
--- 2.14~git20250718.0e36779-1/debian/patches/suse-grub.texi-add-net_bootp6-document.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/suse-grub.texi-add-net_bootp6-document.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,49 @@
+From: Michael Chang <mchang@suse.com>
+Date: Tue, 5 May 2015 14:19:24 +0800
+Subject: grub.texi: Add net_bootp6 document
+
+Update grub documentation for net_bootp6 command.
+
+Signed-off-by: Michael Chang <mchang@suse.com>
+Signed-off-by: Ken Lin <ken.lin@hpe.com>
+
+Patch-Name: suse-grub.texi-add-net_bootp6-document.patch
+---
+ docs/grub.texi | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/docs/grub.texi b/docs/grub.texi
+index 4d86521..d285bff 100644
+--- a/docs/grub.texi
++++ b/docs/grub.texi
+@@ -8276,6 +8276,7 @@ Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}).
+ * net_add_dns::                 Add a DNS server
+ * net_add_route::               Add routing entry
+ * net_bootp::                   Perform a bootp/DHCP autoconfiguration
++* net_bootp6::                  Perform a DHCPv6 autoconfiguration
+ * net_del_addr::                Remove IP address from interface
+ * net_del_dns::                 Remove a DNS server
+ * net_del_route::               Remove a route entry
+@@ -8401,6 +8402,22 @@ Sets environment variable @samp{net_}@var{<card>}@samp{_boot_file}
+ 
+ @end deffn
+ 
++@node net_bootp6
++@subsection net_bootp6
++
++@deffn Command net_bootp6 [@var{card}]
++Perform configuration of @var{card} using DHCPv6 protocol. If no card name is
++specified, try to configure all existing cards. If configuration was
++successful, interface with name @var{card}@samp{:dhcp6} and configured address
++is added to @var{card}.
++
++@table @samp
++@item 1 (Domain Name Server)
++Adds all servers from option value to the list of servers used during name
++resolution.
++@end table
++
++@end deffn
+ 
+ @node net_get_dhcp_option
+ @subsection net_get_dhcp_option
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-add-devicetree-command-support.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-add-devicetree-command-support.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-add-devicetree-command-support.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-add-devicetree-command-support.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,51 @@
+From: Dimitri John Ledkov <xnox@ubuntu.com>
+Date: Wed, 22 May 2019 19:57:29 +0100
+Subject: Add devicetree command, if a dtb is present.
+
+Specically support dtb paths as installed by flash-kernel.
+
+Signed-off-by: Dimitri John Ledkov <xnox@ubuntu.com>
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929427
+Bug-Upstream: https://lists.gnu.org/archive/html/grub-devel/2019-05/msg00121.html
+Patch-Name: ubuntu-add-devicetree-command-support.patch
+---
+ util/grub.d/10_linux.in | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
+index 21597d6..498943a 100644
+--- a/util/grub.d/10_linux.in
++++ b/util/grub.d/10_linux.in
+@@ -241,6 +241,17 @@ EOF
+ 	initrd	$(echo $initrd_path)
+ EOF
+       fi
++    if test -n "${dtb}" ; then
++      if [ x"$quiet_boot" = x0 ] || [ x"$type" != xsimple ]; then
++        message="$(gettext_printf "Loading device tree blob...")"
++        sed "s/^/$submenu_indentation/" << EOF
++	echo	'$(echo "$message" | grub_quote)'
++EOF
++      fi
++      sed "s/^/$submenu_indentation/" << EOF
++	devicetree	${rel_dirname}/${dtb}
++EOF
++    fi
+   fi
+   sed "s/^/$submenu_indentation/" << EOF
+ }
+@@ -387,6 +398,14 @@ for linux in ${reverse_sorted_list}; do
+     gettext_printf "Found initrd image: %s\n" "$(echo $initrd_display)" >&2
+   fi
+ 
++  dtb=
++  for i in "dtb-${version}" "dtb-${alt_version}" "dtb"; do
++    if test -e "${dirname}/${i}" ; then
++      dtb="$i"
++      break
++    fi
++  done
++
+   config=
+   for i in "${dirname}/config-${version}" "${dirname}/config-${alt_version}" "/etc/kernels/kernel-config-${version}" ; do
+     if test -e "${i}" ; then
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-add-initrd-less-boot-fallback.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-add-initrd-less-boot-fallback.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-add-initrd-less-boot-fallback.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-add-initrd-less-boot-fallback.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,212 @@
+From: Chris Glass <chris.glass@canonical.com>
+Date: Fri, 9 Mar 2018 13:47:07 +0100
+Subject: UBUNTU: Added initrd-less boot capabilities.
+
+In case the kernel fails to boot without an initrd, grub will fallback
+to trying to boot the kernel with an initrd.
+
+Signed-off-by: Steve Langasek <steve.langasek@canonical.com>
+
+Patch-Name: ubuntu-add-initrd-less-boot-fallback.patch
+---
+ Makefile.am                  |  3 ++
+ configure.ac                 | 10 +++++++
+ grub-initrd-fallback.service | 14 ++++++++++
+ util/grub.d/00_header.in     | 27 ++++++++++++++++++
+ util/grub.d/10_linux.in      | 66 ++++++++++++++++++++++++++++++++++----------
+ 5 files changed, 105 insertions(+), 15 deletions(-)
+ create mode 100644 grub-initrd-fallback.service
+
+diff --git a/Makefile.am b/Makefile.am
+index 43635d5..085f0f8 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -482,6 +482,9 @@ ChangeLog: FORCE
+ 		touch $@; \
+ 	fi
+ 
++systemdsystemunit_DATA = \
++	grub-initrd-fallback.service
++
+ syslinux_test: $(top_builddir)/config.status tests/syslinux/ubuntu10.04_grub.cfg
+ 
+ # Mimic simplify_filename from grub-core/lib/syslinux_parse.c, so that we
+diff --git a/configure.ac b/configure.ac
+index 0166545..146fbb5 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -320,6 +320,16 @@ AC_SUBST(grubdirname)
+ AC_DEFINE_UNQUOTED(GRUB_DIR_NAME, "$grubdirname",
+     [Default grub directory name])
+ 
++##### systemd unit files
++AC_ARG_WITH([systemdsystemunitdir],
++            AS_HELP_STRING([--with-systemdsystemunitdir=DIR], [Directory for systemd service files]),
++            [],
++            [with_systemdsystemunitdir=/usr/lib/systemd/system],
++            [with_systemdsystemunitdir=no])
++if test "x$with_systemdsystemunitdir" != xno; then
++   AC_SUBST([systemdsystemunitdir], [$with_systemdsystemunitdir])
++fi
++
+ #
+ # Checks for build programs.
+ #
+diff --git a/grub-initrd-fallback.service b/grub-initrd-fallback.service
+new file mode 100644
+index 0000000..1a0a4e5
+--- /dev/null
++++ b/grub-initrd-fallback.service
+@@ -0,0 +1,14 @@
++[Unit]
++Description=GRUB failed boot detection
++After=local-fs.target
++After=grub-common.service
++After=sleep.target
++
++[Service]
++Type=oneshot
++ExecStart=/usr/bin/grub-editenv /boot/grub/grubenv unset initrdfail
++ExecStart=/usr/bin/grub-editenv /boot/grub/grubenv unset prev_entry
++TimeoutSec=0
++
++[Install]
++WantedBy=multi-user.target rescue.target emergency.target sleep.target
+diff --git a/util/grub.d/00_header.in b/util/grub.d/00_header.in
+index 61fcadf..36f3f5f 100644
+--- a/util/grub.d/00_header.in
++++ b/util/grub.d/00_header.in
+@@ -50,6 +50,18 @@ if [ -s \$prefix/grubenv ]; then
+   load_env
+ fi
+ EOF
++cat <<EOF
++if [ "\${initrdfail}" = 2 ]; then
++   set initrdfail=
++elif [ "\${initrdfail}" = 1 ]; then
++   set next_entry="\${prev_entry}"
++   set prev_entry=
++   save_env prev_entry
++   if [ "\${next_entry}" ]; then
++      set initrdfail=2
++   fi
++fi
++EOF
+ if [ "x$GRUB_BUTTON_CMOS_ADDRESS" != "x" ]; then
+     cat <<EOF
+ if cmostest $GRUB_BUTTON_CMOS_ADDRESS ; then
+@@ -101,6 +113,21 @@ function savedefault {
+ }
+ EOF
+ 
++cat <<"EOF"
++function initrdfail {
++    if [ -n "${have_grubenv}" ]; then if [ -n "${partuuid}" ]; then
++      if [ -z "${initrdfail}" ]; then
++        set initrdfail=1
++        if [ -n "${boot_once}" ]; then
++          set prev_entry="${default}"
++          save_env prev_entry
++        fi
++      fi
++      save_env initrdfail
++    fi; fi
++}
++EOF
++
+ if [ "$quick_boot" = 1 ]; then
+     cat <<EOF
+ function recordfail {
+diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
+index 695ad5e..21597d6 100644
+--- a/util/grub.d/10_linux.in
++++ b/util/grub.d/10_linux.in
+@@ -113,6 +113,10 @@ if [ "$vt_handoff" = 1 ]; then
+   done
+ fi
+ 
++if [ x"$GRUB_FORCE_PARTUUID" != x ]; then
++   echo "set partuuid=${GRUB_FORCE_PARTUUID}"
++fi
++
+ linux_entry ()
+ {
+   os="$1"
+@@ -181,30 +185,62 @@ linux_entry ()
+ 	echo	'$(echo "$message" | grub_quote)'
+ EOF
+   fi
+-  if [ x"$GRUB_FORCE_PARTUUID" = x ]; then
++  # We have initrd and PARTUUID is set - we try to boot without initrd, and fallback to using it
++  # if it fails.
++  # "panic=-1" means "on panic reboot immediately". "panic=0" disables the reboot behavior.
++  if [ x"$GRUB_FORCE_PARTUUID" != x ]; then
++      linux_root_device_thisversion="PARTUUID=${GRUB_FORCE_PARTUUID}"
++  fi
++  message="$(gettext_printf "Loading initial ramdisk ...")"
++  initrd_path=
++  for i in ${initrd}; do
++      initrd_path="${initrd_path} ${rel_dirname}/${i}"
++  done
++  initrd_path_only_early=
++  for i in ${initrd_early}; do
++      initrd_path_only_early="${initrd_path_only_early} ${rel_dirname}/${i}"
++  done
++  if test -n "${initrd}" && [ x"$GRUB_FORCE_PARTUUID" != x ]; then
+       sed "s/^/$submenu_indentation/" << EOF
+-        linux	${rel_dirname}/${basename} root=${linux_root_device_thisversion} ro ${args}
++	if [ "\${initrdfail}" = 1 ]; then
++		linux	${rel_dirname}/${basename} root=${linux_root_device_thisversion} ro ${args}
+ EOF
+-  else
++      if [ x"$quiet_boot" = x0 ] || [ x"$type" != xsimple ]; then
++        sed "s/^/$submenu_indentation/" << EOF
++		echo	'$(echo "$message" | grub_quote)'
++EOF
++      fi
+       sed "s/^/$submenu_indentation/" << EOF
+-        linux	${rel_dirname}/${basename} root=PARTUUID=${GRUB_FORCE_PARTUUID} ro ${args}
++		initrd	$(echo $initrd_path)
++	else
++		linux	${rel_dirname}/${basename} root=${linux_root_device_thisversion} ro ${args} panic=-1
+ EOF
+-  fi
+-  if test -n "${initrd}" && [ x"$GRUB_DISABLE_INITRD" != xtrue ]; then
+-    # TRANSLATORS: ramdisk isn't identifier. Should be translated.
+-    if [ x"$quiet_boot" = x0 ] || [ x"$type" != xsimple ]; then
+-      message="$(gettext_printf "Loading initial ramdisk ...")"
++      if [ -n "$initrd_path_only_early" ]; then
++        sed "s/^/$submenu_indentation/" << EOF
++	initrd	$(echo $initrd_path_only_early)
++EOF
++      fi
++      sed "s/^/$submenu_indentation/" << EOF
++	fi
++	initrdfail
++EOF
++  else
++  # We don't have initrd or we don't want to set PARTUUID. Don't try initrd-less boot with fallback.
+       sed "s/^/$submenu_indentation/" << EOF
++	linux	${rel_dirname}/${basename} root=${linux_root_device_thisversion} ro ${args}
++EOF
++      if test -n "${initrd}"; then
++          # We do have initrd - let's use it at boot.
++          # TRANSLATORS: ramdisk isn't identifier. Should be translated.
++          if [ x"$quiet_boot" = x0 ] || [ x"$type" != xsimple ]; then
++            sed "s/^/$submenu_indentation/" << EOF
+ 	echo	'$(echo "$message" | grub_quote)'
+ EOF
+-    fi
+-    initrd_path=
+-    for i in ${initrd}; do
+-      initrd_path="${initrd_path} ${rel_dirname}/${i}"
+-    done
+-    sed "s/^/$submenu_indentation/" << EOF
++          fi
++          sed "s/^/$submenu_indentation/" << EOF
+ 	initrd	$(echo $initrd_path)
+ EOF
++      fi
+   fi
+   sed "s/^/$submenu_indentation/" << EOF
+ }
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-add-initrd-less-boot-messages.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-add-initrd-less-boot-messages.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-add-initrd-less-boot-messages.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-add-initrd-less-boot-messages.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,68 @@
+From: Julian Andres Klode <julian.klode@canonical.com>
+Date: Thu, 27 Jul 2023 15:22:00 +0200
+Subject: Ubuntu: add initrd-less-boot informational messages
+
+Add additional messages when initrd-less boot is attempted or
+fails. As otherwise it is not obvious why boot seems to panic and
+reboot by default.
+
+Patch-Name: ubuntu-add-initrd-less-boot-messages.patch
+---
+ grub-initrd-fallback.service |  1 +
+ util/grub.d/10_linux.in      | 10 ++++++++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/grub-initrd-fallback.service b/grub-initrd-fallback.service
+index 1a0a4e5..59d1a62 100644
+--- a/grub-initrd-fallback.service
++++ b/grub-initrd-fallback.service
+@@ -3,6 +3,7 @@ Description=GRUB failed boot detection
+ After=local-fs.target
+ After=grub-common.service
+ After=sleep.target
++ConditionPathExists=/boot/grub/grub.cfg
+ 
+ [Service]
+ Type=oneshot
+diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
+index fac16b3..753d1aa 100644
+--- a/util/grub.d/10_linux.in
++++ b/util/grub.d/10_linux.in
+@@ -155,6 +155,12 @@ if [ "$vt_handoff" = 1 ]; then
+ fi
+ 
+ if [ x"$GRUB_FORCE_PARTUUID" != x ]; then
++    gettext_printf "GRUB_FORCE_PARTUUID is set, will attempt initrdless boot\n" >&2
++    cat << EOF
++#
++# GRUB_FORCE_PARTUUID is set, will attempt initrdless boot
++# Upon panic fallback to booting with initrd
++EOF
+    echo "set partuuid=${GRUB_FORCE_PARTUUID}"
+ fi
+ 
+@@ -233,6 +239,8 @@ EOF
+       linux_root_device_thisversion="PARTUUID=${GRUB_FORCE_PARTUUID}"
+   fi
+   message="$(gettext_printf "Loading initial ramdisk ...")"
++  initrdlessfail_msg="$(gettext_printf "GRUB_FORCE_PARTUUID set, initrdless boot failed. Attempting with initrd.")"
++  initrdlesstry_msg="$(gettext_printf "GRUB_FORCE_PARTUUID set, attempting initrdless boot.")"
+   initrd_path=
+   for i in ${initrd}; do
+       initrd_path="${initrd_path} ${rel_dirname}/${i}"
+@@ -244,6 +252,7 @@ EOF
+   if test -n "${initrd}" && [ x"$GRUB_FORCE_PARTUUID" != x ]; then
+       sed "s/^/$submenu_indentation/" << EOF
+ 	if [ "\${initrdfail}" = 1 ]; then
++		echo	'$(echo "$initrdlessfail_msg" | grub_quote)'
+ 		linux	${rel_dirname}/${basename} root=${linux_root_device_thisversion} ro ${args}
+ EOF
+       if [ x"$quiet_boot" = x0 ] || [ x"$type" != xsimple ]; then
+@@ -254,6 +263,7 @@ EOF
+       sed "s/^/$submenu_indentation/" << EOF
+ 		initrd	$(echo $initrd_path)
+ 	else
++		echo	'$(echo "$initrdlesstry_msg" | grub_quote)'
+ 		linux	${rel_dirname}/${basename} root=${linux_root_device_thisversion} ro ${args} panic=-1
+ EOF
+       if [ -n "$initrd_path_only_early" ]; then
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-boot-from-multipath-dependent-symlink.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-boot-from-multipath-dependent-symlink.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-boot-from-multipath-dependent-symlink.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-boot-from-multipath-dependent-symlink.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,68 @@
+From: Michael Hudson-Doyle <michael.hudson@canonical.com>
+Date: Tue, 6 Aug 2019 12:31:47 +1200
+Subject: UBUNTU: Boot from multipath-dependent symlink when / is multipathed.
+
+If / is multipathed, there will be multiple paths to the partition, so
+using root=UUID= exposes the boot process to udev races. In addition
+grub-probe --target device / in this case reports /dev/dm-1 or similar
+-- better to use a symlink that depends on the multipath name.
+
+Signed-off-by: Michael Hudson-Doyle <michael.hudson@ubuntu.com>
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1429327
+Patch-Name: ubuntu-boot-from-multipath-dependent-symlink.patch
+---
+ util/grub.d/10_linux.in | 41 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 41 insertions(+)
+
+diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
+index 498943a..fac16b3 100644
+--- a/util/grub.d/10_linux.in
++++ b/util/grub.d/10_linux.in
+@@ -65,6 +65,47 @@ fi
+ # older kernels.
+ : ${GRUB_DISABLE_LINUX_PARTUUID=true}
+ 
++# get_dm_field_for_dev /dev/dm-0 uuid -> get the device mapper UUID for /dev/dm-0
++# get_dm_field_for_dev /dev/dm-1 name -> get the device mapper name for /dev/dm-1
++# etc
++get_dm_field_for_dev () {
++    dmsetup info -c --noheadings -o $2 $1 2>/dev/null
++}
++
++# Is $1 a multipath device?
++is_multipath () {
++    local dmuuid dmtype
++    dmuuid="$(get_dm_field_for_dev $1 uuid)"
++    if [ $? -ne 0 ]; then
++        # Not a device mapper device -- or dmsetup not installed, and as
++        # multipath depends on kpartx which depends on dmsetup, if there is no
++        # dmsetup then there are not going to be any multipath devices.
++        return 1
++    fi
++    # A device mapper "uuid" is always <type>-<uuid>. If <type> is of the form
++    # part[0-9] then <uuid> is the device the partition is on and we want to
++    # look at that instead. A multipath node always has <type> of mpath.
++    dmtype="${dmuuid%%-*}"
++    if [ "${dmtype#part}" != "$dmtype" ]; then
++        dmuuid="${dmuuid#*-}"
++        dmtype="${dmuuid%%-*}"
++    fi
++    if [ "$dmtype" = "mpath" ]; then
++        return 0
++    else
++        return 1
++    fi
++}
++
++if test -e "${GRUB_DEVICE}" && is_multipath "${GRUB_DEVICE}"; then
++    # If / is multipathed, there will be multiple paths to the partition, so
++    # using root=UUID= exposes the boot process to udev races. In addition
++    # GRUB_DEVICE in this case will be /dev/dm-0 or similar -- better to use a
++    # symlink that depends on the multipath name.
++    GRUB_DEVICE=/dev/mapper/"$(get_dm_field_for_dev $GRUB_DEVICE name)"
++    GRUB_DISABLE_LINUX_UUID=true
++fi
++
+ # btrfs may reside on multiple devices. We cannot pass them as value of root= parameter
+ # and mounting btrfs requires user space scanning, so force UUID in this case.
+ if ( [ "x${GRUB_DEVICE_UUID}" = "x" ] && [ "x${GRUB_DEVICE_PARTUUID}" = "x" ] ) \
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-dont-verify-loopback-images.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-dont-verify-loopback-images.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-dont-verify-loopback-images.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-dont-verify-loopback-images.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,35 @@
+From: Chris Coulson <chris.coulson@canonical.com>
+Date: Mon, 1 Jun 2020 14:03:37 +0100
+Subject: UBUNTU: disk/loopback: Don't verify loopback images
+
+When a file is verified, the entire contents of the verified file are
+loaded in to memory and retained until the file handle is closed. A
+consequence of this is that opening a loopback image can incur a
+significant memory cost.
+
+As loopback devices are just another disk implementation, don't treat
+loopback images any differently to physical disk images, and skip
+verification of them. Files opened from the filesystem within a loopback
+image will still be passed to verifier modules where required.
+
+Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
+LP: #1878541
+Forwarded: yes, https://lists.gnu.org/archive/html/grub-devel/2020-06/msg00002.html
+Patch-Name: ubuntu-dont-verify-loopback-images.patch
+---
+ grub-core/disk/loopback.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/grub-core/disk/loopback.c b/grub-core/disk/loopback.c
+index 2bea4e9..f73c2e9 100644
+--- a/grub-core/disk/loopback.c
++++ b/grub-core/disk/loopback.c
+@@ -106,7 +106,7 @@ grub_cmd_loopback (grub_extcmd_context_t ctxt, int argc, char **args)
+     if (grub_strcmp (newdev->devname, args[0]) == 0)
+       return grub_error (GRUB_ERR_BAD_ARGUMENT, "device name already exists");
+ 
+-  file = grub_file_open (args[1], type);
++  file = grub_file_open (args[1], type | GRUB_FILE_TYPE_SKIP_SIGNATURE);
+   if (! file)
+     return grub_errno;
+ 
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-fix-lzma-decompressor-objcopy.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-fix-lzma-decompressor-objcopy.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-fix-lzma-decompressor-objcopy.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-fix-lzma-decompressor-objcopy.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,29 @@
+From: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
+Date: Wed, 3 Jul 2019 15:21:16 -0400
+Subject: UBUNTU: Have the lzma decompressor image only contain the .text
+ section
+
+Previously binutils/objcopy did that correctly, now it seems to be padding to
+an arbitrary size with zeros. Work around this broken by being explicit about
+what we want.
+
+Patch-Name: ubuntu-fix-lzma-decompressor-objcopy.patch
+
+Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
+---
+ grub-core/Makefile.core.def | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
+index 8dfb883..d49a5aa 100644
+--- a/grub-core/Makefile.core.def
++++ b/grub-core/Makefile.core.def
+@@ -569,7 +569,7 @@ image = {
+   i386_pc = boot/i386/pc/startup_raw.S;
+   i386_pc_nodist = rs_decoder.h;
+ 
+-  objcopyflags = '-O binary';
++  objcopyflags = '-O binary -j .text';
+   ldflags = '$(TARGET_IMG_LDFLAGS) $(TARGET_IMG_BASE_LDOPT),0x8200';
+   enable = i386_pc;
+ };
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-grub-install-extra-removable.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-grub-install-extra-removable.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-grub-install-extra-removable.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-grub-install-extra-removable.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,227 @@
+From: Steve McIntyre <93sam@debian.org>
+Date: Wed, 3 Dec 2014 01:25:12 +0000
+Subject: UBUNTU: Add support for forcing EFI installation to the removable
+ media path
+
+Add an extra option to grub-install "--no-extra-removable". On EFI
+platforms, this will cause the copy of the grub-efi image to not be
+written to the removable media path /boot/efi/EFI/BOOT/BOOT$ARCH.EFI.
+This will help with broken UEFI implementations where you can't install
+to the removable path as a fallback option if Boot Entries get corrupt.
+
+Signed-off-by: Steve McIntyre <93sam@debian.org>
+Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
+
+Bug-Debian: https://bugs.debian.org/767037 https://bugs.debian.org/773092
+Forwarded: Not yet
+Last-Update: 2014-12-20
+
+Patch-Name: ubuntu-grub-install-extra-removable.patch
+---
+ util/grub-install.c | 135 +++++++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 133 insertions(+), 2 deletions(-)
+
+diff --git a/util/grub-install.c b/util/grub-install.c
+index 62d1753..36efc01 100644
+--- a/util/grub-install.c
++++ b/util/grub-install.c
+@@ -55,6 +55,7 @@
+ 
+ static char *target;
+ static int removable = 0;
++static int no_extra_removable = 0;
+ static int recheck = 0;
+ static int update_nvram = 1;
+ static char *install_device = NULL;
+@@ -112,7 +113,8 @@ enum
+     OPTION_LABEL_BGCOLOR,
+     OPTION_PRODUCT_VERSION,
+     OPTION_UEFI_SECURE_BOOT,
+-    OPTION_NO_UEFI_SECURE_BOOT
++    OPTION_NO_UEFI_SECURE_BOOT,
++    OPTION_NO_EXTRA_REMOVABLE
+   };
+ 
+ static int fs_probe = 1;
+@@ -215,6 +217,10 @@ argp_parser (int key, char *arg, struct argp_state *state)
+       removable = 1;
+       return 0;
+ 
++    case OPTION_NO_EXTRA_REMOVABLE:
++      no_extra_removable = 1;
++      return 0;
++
+     case OPTION_ALLOW_FLOPPY:
+       allow_floppy = 1;
+       return 0;
+@@ -321,6 +327,9 @@ static struct argp_option options[] = {
+    N_("do not install an image usable with UEFI Secure Boot, even if the "
+       "system was currently started using it. "
+       "This option is only available on EFI."), 2},
++  {"no-extra-removable", OPTION_NO_EXTRA_REMOVABLE, 0, 0,
++   N_("Do not install bootloader code to the removable media path. "
++      "This option is only available on EFI."), 2},
+   {0, 0, 0, 0, 0, 0}
+ };
+ 
+@@ -862,6 +871,116 @@ try_open (const char *path)
+ }
+ #endif
+ 
++/* Helper routine for also_install_removable() below. Walk through the
++   specified dir, looking to see if there is a file/dir that matches
++   the search string exactly, but in a case-insensitive manner. If so,
++   return a copy of the exact file/dir that *does* exist. If not,
++   return NULL */
++static char *
++check_component_exists(const char *dir,
++		       const char *search)
++{
++  grub_util_fd_dir_t d;
++  grub_util_fd_dirent_t de;
++  char *found = NULL;
++
++  d = grub_util_fd_opendir (dir);
++  if (!d)
++    grub_util_error (_("cannot open directory `%s': %s"),
++		     dir, grub_util_fd_strerror ());
++
++  while ((de = grub_util_fd_readdir (d)))
++    {
++      if (strcasecmp (de->d_name, search) == 0)
++	{
++	  found = xstrdup (de->d_name);
++	  break;
++	}
++    }
++  grub_util_fd_closedir (d);
++  return found;
++}
++
++/* Some complex directory-handling stuff in here, to cope with
++ * case-insensitive FAT/VFAT filesystem semantics. Ugh. */
++static void
++also_install_removable(const char *src,
++		       const char *base_efidir,
++		       const char *efi_suffix,
++		       const char *efi_suffix_upper)
++{
++  char *efi_file = NULL;
++  char *dst = NULL;
++  char *cur = NULL;
++  char *found = NULL;
++  char *fb_file = NULL;
++  char *mm_file = NULL;
++  char *generic_efidir = NULL;
++
++  if (!efi_suffix)
++    grub_util_error ("%s", _("efi_suffix not set"));
++  if (!efi_suffix_upper)
++    grub_util_error ("%s", _("efi_suffix_upper not set"));
++
++  efi_file = xasprintf ("BOOT%s.EFI", efi_suffix_upper);
++  fb_file = xasprintf ("fb%s.efi", efi_suffix);
++  mm_file = xasprintf ("mm%s.efi", efi_suffix);
++
++  /* We need to install in $base_efidir/EFI/BOOT/$efi_file, but we
++   * need to cope with case-insensitive stuff here. Build the path one
++   * component at a time, checking for existing matches each time. */
++
++  /* Look for "EFI" in base_efidir. Make it if it does not exist in
++   * some form. */
++  found = check_component_exists(base_efidir, "EFI");
++  if (found == NULL)
++    found = xstrdup("EFI");
++  dst = grub_util_path_concat (2, base_efidir, found);
++  cur = xstrdup (dst);
++  free (dst);
++  free (found);
++  grub_install_mkdir_p (cur);
++
++  /* Now BOOT */
++  found = check_component_exists(cur, "BOOT");
++  if (found == NULL)
++    found = xstrdup("BOOT");
++  dst = grub_util_path_concat (2, cur, found);
++  free (cur);
++  free (found);
++  grub_install_mkdir_p (dst);
++  generic_efidir = xstrdup (dst);
++  free (dst);
++
++  /* Now $efi_file */
++  found = check_component_exists(generic_efidir, efi_file);
++  if (found == NULL)
++    found = xstrdup(efi_file);
++  dst = grub_util_path_concat (2, generic_efidir, found);
++  free (found);
++  grub_install_copy_file (src, dst, 1);
++  free (efi_file);
++  free (dst);
++
++  /* Now try to also install fallback */
++  efi_file = grub_util_path_concat (2, "/usr/lib/shim/", fb_file);
++  dst = grub_util_path_concat (2, generic_efidir, fb_file);
++  grub_install_copy_file (efi_file, dst, 0);
++  free (efi_file);
++  free (dst);
++
++  /* Also install MokManager to the removable path */
++  efi_file = grub_util_path_concat (2, "/usr/lib/shim/", mm_file);
++  dst = grub_util_path_concat (2, generic_efidir, mm_file);
++  grub_install_copy_file (efi_file, dst, 0);
++  free (efi_file);
++  free (dst);
++
++  free (generic_efidir);
++  free (fb_file);
++  free (mm_file);
++}
++
+ int
+ main (int argc, char *argv[])
+ {
+@@ -879,6 +998,7 @@ main (int argc, char *argv[])
+   char *relative_grubdir;
+   char **efidir_device_names = NULL;
+   grub_device_t efidir_grub_dev = NULL;
++  char *base_efidir = NULL;
+   char *efidir_grub_devname;
+   int efidir_is_mac = 0;
+   int is_prep = 0;
+@@ -911,6 +1031,9 @@ main (int argc, char *argv[])
+       bootloader_id = xstrdup ("grub");
+     }
+ 
++  if (removable && no_extra_removable)
++    grub_util_error (_("Invalid to use both --removable and --no_extra_removable"));
++
+   if (!grub_install_source_directory)
+     {
+       if (!target)
+@@ -1152,6 +1275,8 @@ main (int argc, char *argv[])
+ 	    grub_util_error (_("%s doesn't look like an EFI partition"), efidir);
+ 	}
+ 
++      base_efidir = xstrdup(efidir);
++
+       /* The EFI specification requires that an EFI System Partition must
+ 	 contain an "EFI" subdirectory, and that OS loaders are stored in
+ 	 subdirectories below EFI.  Vendors are expected to pick names that do
+@@ -2095,9 +2220,15 @@ main (int argc, char *argv[])
+ 	    fprintf (config_dst_f, "configfile $prefix/grub.cfg\n");
+ 	    fclose (config_dst_f);
+ 	    free (config_dst);
++	    if (!removable && !no_extra_removable)
++	      also_install_removable(efi_signed, base_efidir, efi_suffix, efi_suffix_upper);
+ 	  }
+ 	else
+-	  grub_install_copy_file (imgfile, dst, 1);
++	  {
++	    grub_install_copy_file (imgfile, dst, 1);
++	    if (!removable && !no_extra_removable)
++	      also_install_removable(imgfile, base_efidir, efi_suffix, efi_suffix_upper);
++	  }
+ 
+ 	grub_set_install_backup_ponr ();
+ 
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-install-signed.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-install-signed.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-install-signed.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-install-signed.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,319 @@
+From: Colin Watson <cjwatson@ubuntu.com>
+Date: Mon, 13 Jan 2014 12:13:22 +0000
+Subject: UBUNTU: Install signed images if UEFI Secure Boot is enabled
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 8bit
+
+Author: Stéphane Graber <stgraber@ubuntu.com>
+Author: Steve Langasek <steve.langasek@ubuntu.com>
+Author: Linn Crosetto <linn@hpe.com>
+Author: Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>
+Forwarded: no
+Last-Update: 2016-11-01
+
+Patch-Name: ubuntu-install-signed.patch
+---
+ util/grub-install.c | 221 ++++++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 156 insertions(+), 65 deletions(-)
+
+diff --git a/util/grub-install.c b/util/grub-install.c
+index 2f5031c..62d1753 100644
+--- a/util/grub-install.c
++++ b/util/grub-install.c
+@@ -79,6 +79,7 @@ static char *label_color;
+ static char *label_bgcolor;
+ static char *product_version;
+ static int add_rs_codes = 1;
++static int uefi_secure_boot = 1;
+ 
+ enum
+   {
+@@ -109,7 +110,9 @@ enum
+     OPTION_LABEL_FONT,
+     OPTION_LABEL_COLOR,
+     OPTION_LABEL_BGCOLOR,
+-    OPTION_PRODUCT_VERSION
++    OPTION_PRODUCT_VERSION,
++    OPTION_UEFI_SECURE_BOOT,
++    OPTION_NO_UEFI_SECURE_BOOT
+   };
+ 
+ static int fs_probe = 1;
+@@ -233,6 +236,14 @@ argp_parser (int key, char *arg, struct argp_state *state)
+       bootloader_id = xstrdup (arg);
+       return 0;
+ 
++    case OPTION_UEFI_SECURE_BOOT:
++      uefi_secure_boot = 1;
++      return 0;
++
++    case OPTION_NO_UEFI_SECURE_BOOT:
++      uefi_secure_boot = 0;
++      return 0;
++
+     case ARGP_KEY_ARG:
+       if (install_device)
+ 	grub_util_error ("%s", _("More than one install device?"));
+@@ -302,6 +313,14 @@ static struct argp_option options[] = {
+   {"label-color", OPTION_LABEL_COLOR, N_("COLOR"), 0, N_("use COLOR for label"), 2},
+   {"label-bgcolor", OPTION_LABEL_BGCOLOR, N_("COLOR"), 0, N_("use COLOR for label background"), 2},
+   {"product-version", OPTION_PRODUCT_VERSION, N_("STRING"), 0, N_("use STRING as product version"), 2},
++  {"uefi-secure-boot", OPTION_UEFI_SECURE_BOOT, 0, 0,
++   N_("install an image usable with UEFI Secure Boot. "
++      "This option is only available on EFI and if the grub-efi-amd64-signed "
++      "package is installed."), 2},
++  {"no-uefi-secure-boot", OPTION_NO_UEFI_SECURE_BOOT, 0, 0,
++   N_("do not install an image usable with UEFI Secure Boot, even if the "
++      "system was currently started using it. "
++      "This option is only available on EFI."), 2},
+   {0, 0, 0, 0, 0, 0}
+ };
+ 
+@@ -848,7 +867,8 @@ main (int argc, char *argv[])
+ {
+   int is_efi = 0;
+   const char *efi_distributor = NULL;
+-  const char *efi_file = NULL;
++  const char *efi_suffix = NULL, *efi_suffix_upper = NULL;
++  char *efi_file = NULL;
+   char **grub_devices;
+   grub_fs_t grub_fs;
+   grub_device_t grub_dev = NULL;
+@@ -1140,6 +1160,39 @@ main (int argc, char *argv[])
+       */
+       char *t;
+       efi_distributor = bootloader_id;
++      switch (platform)
++	{
++	case GRUB_INSTALL_PLATFORM_I386_EFI:
++	  efi_suffix = "ia32";
++	  efi_suffix_upper = "IA32";
++	  break;
++	case GRUB_INSTALL_PLATFORM_X86_64_EFI:
++	  efi_suffix = "x64";
++	  efi_suffix_upper = "X64";
++	  break;
++	case GRUB_INSTALL_PLATFORM_IA64_EFI:
++	  efi_suffix = "ia64";
++	  efi_suffix_upper = "IA64";
++	  break;
++	case GRUB_INSTALL_PLATFORM_ARM_EFI:
++	  efi_suffix = "arm";
++	  efi_suffix_upper = "ARM";
++	  break;
++	case GRUB_INSTALL_PLATFORM_ARM64_EFI:
++	  efi_suffix = "aa64";
++	  efi_suffix_upper = "AA64";
++	  break;
++	case GRUB_INSTALL_PLATFORM_RISCV32_EFI:
++	  efi_suffix = "riscv32";
++	  efi_suffix_upper = "RISCV32";
++	  break;
++	case GRUB_INSTALL_PLATFORM_RISCV64_EFI:
++	  efi_suffix = "riscv64";
++	  efi_suffix_upper = "RISCV64";
++	  break;
++	default:
++	  break;
++	}
+       if (removable)
+ 	{
+ 	  /* The specification makes stricter requirements of removable
+@@ -1148,72 +1201,16 @@ main (int argc, char *argv[])
+ 	     must have a specific file name depending on the architecture.
+ 	  */
+ 	  efi_distributor = "BOOT";
+-	  switch (platform)
+-	    {
+-	    case GRUB_INSTALL_PLATFORM_I386_EFI:
+-	      efi_file = "BOOTIA32.EFI";
+-	      break;
+-	    case GRUB_INSTALL_PLATFORM_X86_64_EFI:
+-	      efi_file = "BOOTX64.EFI";
+-	      break;
+-	    case GRUB_INSTALL_PLATFORM_IA64_EFI:
+-	      efi_file = "BOOTIA64.EFI";
+-	      break;
+-	    case GRUB_INSTALL_PLATFORM_ARM_EFI:
+-	      efi_file = "BOOTARM.EFI";
+-	      break;
+-	    case GRUB_INSTALL_PLATFORM_ARM64_EFI:
+-	      efi_file = "BOOTAA64.EFI";
+-	      break;
+-	    case GRUB_INSTALL_PLATFORM_LOONGARCH64_EFI:
+-	      efi_file = "BOOTLOONGARCH64.EFI";
+-	      break;
+-	    case GRUB_INSTALL_PLATFORM_RISCV32_EFI:
+-	      efi_file = "BOOTRISCV32.EFI";
+-	      break;
+-	    case GRUB_INSTALL_PLATFORM_RISCV64_EFI:
+-	      efi_file = "BOOTRISCV64.EFI";
+-	      break;
+-	    default:
+-	      grub_util_error ("%s", _("You've found a bug"));
+-	      break;
+-	    }
++	  if (!efi_suffix)
++	    grub_util_error ("%s", _("You've found a bug"));
++	  efi_file = xasprintf ("BOOT%s.EFI", efi_suffix_upper);
+ 	}
+       else
+ 	{
+ 	  /* It is convenient for each architecture to have a different
+ 	     efi_file, so that different versions can be installed in parallel.
+ 	  */
+-	  switch (platform)
+-	    {
+-	    case GRUB_INSTALL_PLATFORM_I386_EFI:
+-	      efi_file = "grubia32.efi";
+-	      break;
+-	    case GRUB_INSTALL_PLATFORM_X86_64_EFI:
+-	      efi_file = "grubx64.efi";
+-	      break;
+-	    case GRUB_INSTALL_PLATFORM_IA64_EFI:
+-	      efi_file = "grubia64.efi";
+-	      break;
+-	    case GRUB_INSTALL_PLATFORM_ARM_EFI:
+-	      efi_file = "grubarm.efi";
+-	      break;
+-	    case GRUB_INSTALL_PLATFORM_ARM64_EFI:
+-	      efi_file = "grubaa64.efi";
+-	      break;
+-	    case GRUB_INSTALL_PLATFORM_LOONGARCH64_EFI:
+-	      efi_file = "grubloongarch64.efi";
+-	      break;
+-	    case GRUB_INSTALL_PLATFORM_RISCV32_EFI:
+-	      efi_file = "grubriscv32.efi";
+-	      break;
+-	    case GRUB_INSTALL_PLATFORM_RISCV64_EFI:
+-	      efi_file = "grubriscv64.efi";
+-	      break;
+-	    default:
+-	      efi_file = "grub.efi";
+-	      break;
+-	    }
++	  efi_file = xasprintf ("grub%s.efi", efi_suffix);
+ 	}
+       t = grub_util_path_concat (3, efidir, "EFI", efi_distributor);
+       free (efidir);
+@@ -1432,14 +1429,41 @@ main (int argc, char *argv[])
+               debug_image);
+     }
+ 
+-  if (!have_abstractions)
++  char *efi_signed = NULL;
++  switch (platform)
++    {
++    case GRUB_INSTALL_PLATFORM_I386_EFI:
++    case GRUB_INSTALL_PLATFORM_X86_64_EFI:
++    case GRUB_INSTALL_PLATFORM_ARM_EFI:
++    case GRUB_INSTALL_PLATFORM_ARM64_EFI:
++    case GRUB_INSTALL_PLATFORM_IA64_EFI:
++      {
++	char *dir = xasprintf ("%s-signed", grub_install_source_directory);
++	char *signed_image;
++	if (removable)
++	  signed_image = xasprintf ("gcd%s.efi.signed", efi_suffix);
++	else
++	  signed_image = xasprintf ("grub%s.efi.signed", efi_suffix);
++	efi_signed = grub_util_path_concat (2, dir, signed_image);
++	break;
++      }
++
++    default:
++      break;
++    }
++
++  if (!efi_signed || !grub_util_is_regular (efi_signed))
++    uefi_secure_boot = 0;
++
++  if (!have_abstractions || uefi_secure_boot)
+     {
+       if ((disk_module && grub_strcmp (disk_module, "biosdisk") != 0)
+ 	  || grub_drives[1]
+ 	  || (!install_drive
+ 	      && platform != GRUB_INSTALL_PLATFORM_POWERPC_IEEE1275)
+ 	  || (install_drive && !is_same_disk (grub_drives[0], install_drive))
+-	  || !have_bootdev (platform))
++	  || !have_bootdev (platform)
++	  || uefi_secure_boot)
+ 	{
+ 	  char *uuid = NULL;
+ 
+@@ -2006,7 +2030,74 @@ main (int argc, char *argv[])
+     case GRUB_INSTALL_PLATFORM_IA64_EFI:
+       {
+ 	char *dst = grub_util_path_concat (2, efidir, efi_file);
+-	grub_install_copy_file (imgfile, dst, 1);
++	if (uefi_secure_boot)
++	  {
++	    char *shim_signed = NULL;
++	    char *mok_file = NULL;
++	    char *bootcsv = NULL;
++	    char *config_dst;
++	    FILE *config_dst_f;
++
++	    shim_signed = xasprintf ("/usr/lib/shim/shim%s.efi.signed", efi_suffix);
++	    mok_file = xasprintf ("mm%s.efi", efi_suffix);
++	    bootcsv = xasprintf ("BOOT%s.CSV", efi_suffix_upper);
++
++	    if (grub_util_is_regular (shim_signed))
++	      {
++		char *chained_base, *chained_dst;
++		char *mok_src, *mok_dst, *bootcsv_src, *bootcsv_dst;
++
++		/* Install grub as our chained bootloader */
++		chained_base = xasprintf ("grub%s.efi", efi_suffix);
++		chained_dst = grub_util_path_concat (2, efidir, chained_base);
++		grub_install_copy_file (efi_signed, chained_dst, 1);
++		free (chained_dst);
++		free (chained_base);
++
++		/* Now handle shim, and make this our new "default" loader. */
++		if (!removable)
++		  {
++		    free (efi_file);
++		    efi_file = xasprintf ("shim%s.efi", efi_suffix);
++		    free (dst);
++		    dst = grub_util_path_concat (2, efidir, efi_file);
++		  }
++		grub_install_copy_file (shim_signed, dst, 1);
++		free (efi_signed);
++		efi_signed = xstrdup (shim_signed);
++
++		/* Not critical, so not an error if it is not present (as it
++		   won't be for older releases); but if we have MokManager,
++		   make sure it gets installed.  */
++		mok_src = grub_util_path_concat (2, "/usr/lib/shim/",
++						    mok_file);
++		mok_dst = grub_util_path_concat (2, efidir,
++						    mok_file);
++		grub_install_copy_file (mok_src,
++					mok_dst, 0);
++		free (mok_src);
++		free (mok_dst);
++
++		/* Also try to install boot.csv for fallback */
++		bootcsv_src = grub_util_path_concat (2, "/usr/lib/shim/",
++						     bootcsv);
++		bootcsv_dst = grub_util_path_concat (2, efidir, bootcsv);
++		grub_install_copy_file (bootcsv_src, bootcsv_dst, 0);
++		free (bootcsv_src);
++		free (bootcsv_dst);
++	      }
++	    else
++	      grub_install_copy_file (efi_signed, dst, 1);
++
++	    config_dst = grub_util_path_concat (2, efidir, "grub.cfg");
++	    grub_install_copy_file (load_cfg, config_dst, 1);
++	    config_dst_f = grub_util_fopen (config_dst, "ab");
++	    fprintf (config_dst_f, "configfile $prefix/grub.cfg\n");
++	    fclose (config_dst_f);
++	    free (config_dst);
++	  }
++	else
++	  grub_install_copy_file (imgfile, dst, 1);
+ 
+ 	grub_set_install_backup_ponr ();
+ 
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-mkconfig-leave-breadcrumbs.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-mkconfig-leave-breadcrumbs.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-mkconfig-leave-breadcrumbs.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-mkconfig-leave-breadcrumbs.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,28 @@
+From: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
+Date: Fri, 14 Dec 2018 13:46:14 -0500
+Subject: UBUNTU: grub-mkconfig: leave a trace of what files were sourced to
+ generate the config
+
+Patch-Name: ubuntu-mkconfig-leave-breadcrumbs.patch
+Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
+---
+ util/grub-mkconfig.in | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in
+index 2ebb8f3..be2d9eb 100644
+--- a/util/grub-mkconfig.in
++++ b/util/grub-mkconfig.in
+@@ -158,10 +158,12 @@ if [ "x${GRUB_EARLY_INITRD_LINUX_STOCK}" = "x" ]; then
+ fi
+ 
+ if test -f ${sysconfdir}/default/grub ; then
++  gettext_printf "Sourcing file \`%s'\n" "${sysconfdir}/default/grub" 1>&2
+   . ${sysconfdir}/default/grub
+ fi
+ for x in ${sysconfdir}/default/grub.d/*.cfg ; do
+   if [ -e "${x}" ]; then
++    gettext_printf "Sourcing file \`%s'\n" "${x}" 1>&2
+     . "${x}"
+   fi
+ done
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-os-prober-auto.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-os-prober-auto.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-os-prober-auto.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-os-prober-auto.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,51 @@
+From: Julian Andres Klode <julian.klode@canonical.com>
+Date: Wed, 16 Feb 2022 17:19:45 +0100
+Subject: UBUNTU: os-prober: Enable on first run or if last run produced
+ results
+
+To not break existing use cases, if we install alongside another OS
+let's keep running os-prober. For this, introduce an auto mode that
+determines whether we are (a) a new install or (b) have previously
+added any os-prober items.
+
+This patch is not optimal, and it might be nicer to handle this in
+installers and the release upgrader, but that involves touching a
+lot more packages and means we'd also have that policy in multiple
+places, which is detrimental if we want to change it again.
+
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1955109
+---
+ util/grub-mkconfig.in       | 2 +-
+ util/grub.d/30_os-prober.in | 6 ++++++
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in
+index be2d9eb..46b036b 100644
+--- a/util/grub-mkconfig.in
++++ b/util/grub-mkconfig.in
+@@ -141,7 +141,7 @@ GRUB_DEVICE_BOOT="`${grub_probe} --target=device /boot`"
+ GRUB_DEVICE_BOOT_UUID="`${grub_probe} --device ${GRUB_DEVICE_BOOT} --target=fs_uuid 2> /dev/null`" || true
+ 
+ # Disable os-prober by default due to security reasons.
+-GRUB_DISABLE_OS_PROBER="true"
++GRUB_DISABLE_OS_PROBER="auto"
+ 
+ # Filesystem for the device containing our userland.  Used for stuff like
+ # choosing Hurd filesystem module.
+diff --git a/util/grub.d/30_os-prober.in b/util/grub.d/30_os-prober.in
+index ea9004b..866c7a4 100644
+--- a/util/grub.d/30_os-prober.in
++++ b/util/grub.d/30_os-prober.in
+@@ -43,6 +43,12 @@ EOF
+ if ! command -v os-prober > /dev/null || ! command -v linux-boot-prober > /dev/null ; then
+   # missing os-prober and/or linux-boot-prober
+   exit 0
++elif [ "x${GRUB_DISABLE_OS_PROBER}" = "xauto" ]; then
++  # UBUNTU: We do not want to disable os-prober on upgrades if we found items before.
++  if test -e /boot/grub/grub.cfg && ! grep -q osprober /boot/grub/grub.cfg; then
++    grub_warn "$(gettext_printf "os-prober will not be executed to detect other bootable partitions.\nSystems on them will not be added to the GRUB boot configuration.\nCheck GRUB_DISABLE_OS_PROBER documentation entry.")"
++    exit 0
++  fi
+ fi
+ 
+ if [ "x${GRUB_DISABLE_OS_PROBER}" = "xtrue" ]; then
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-recovery-dis_ucode_ldr.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-recovery-dis_ucode_ldr.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-recovery-dis_ucode_ldr.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-recovery-dis_ucode_ldr.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,67 @@
+From: Julian Andres Klode <julian.klode@canonical.com>
+Date: Fri, 19 Jun 2020 12:57:19 +0200
+Subject: Pass dis_ucode_ldr to kernel for recovery mode
+
+In case of a botched microcode update, this allows people to
+easily roll back.
+
+It will of course break in the more unlikely event that you are
+missing a microcode update in your firmware that is needed to boot
+the system, but editing the entry to remove an option is easier than
+having to figure out the option and add it.
+
+LP: #1831789
+Patch-Name: ubuntu-recovery-dis_ucode_ldr.patch
+---
+ util/grub.d/10_linux_zfs.in | 24 +++++++++++++++---------
+ 1 file changed, 15 insertions(+), 9 deletions(-)
+
+diff --git a/util/grub.d/10_linux_zfs.in b/util/grub.d/10_linux_zfs.in
+index 4b2448f..b805909 100755
+--- a/util/grub.d/10_linux_zfs.in
++++ b/util/grub.d/10_linux_zfs.in
+@@ -39,6 +39,16 @@ imported_pools=""
+ MNTDIR="$(mktemp -d ${TMPDIR:-/tmp}/zfsmnt.XXXXXX)"
+ ZFSTMP="$(mktemp -d ${TMPDIR:-/tmp}/zfstmp.XXXXXX)"
+ 
++
++machine="$(uname -m)"
++case "${machine}" in
++    i?86) GENKERNEL_ARCH="x86" ;;
++    mips|mips64) GENKERNEL_ARCH="mips" ;;
++    mipsel|mips64el) GENKERNEL_ARCH="mipsel" ;;
++    arm*) GENKERNEL_ARCH="arm" ;;
++    *) GENKERNEL_ARCH="${machine}" ;;
++esac
++
+ RC=0
+ on_exit() {
+     # Restore initial zpool import state
+@@ -406,15 +416,6 @@ get_dataset_info() {
+         return
+     fi
+ 
+-    machine="$(uname -m)"
+-    case "${machine}" in
+-        i?86) GENKERNEL_ARCH="x86" ;;
+-        mips|mips64) GENKERNEL_ARCH="mips" ;;
+-        mipsel|mips64el) GENKERNEL_ARCH="mipsel" ;;
+-        arm*) GENKERNEL_ARCH="arm" ;;
+-        *) GENKERNEL_ARCH="${machine}" ;;
+-    esac
+-
+     initrd_list=""
+     kernel_list=""
+     candidate_kernel_list="$(find "${boot_dir}" -maxdepth 1 -type f -regex '.*/\(vmlinuz\|vmlinux\|kernel\)-.*')"
+@@ -924,6 +925,11 @@ generate_grub_menu() {
+         GRUB_CMDLINE_LINUX_RECOVERY="${GRUB_CMDLINE_LINUX_RECOVERY} nomodeset"
+     fi
+ 
++    case "$GENKERNEL_ARCH" in
++        x86*) GRUB_CMDLINE_LINUX_RECOVERY="$GRUB_CMDLINE_LINUX_RECOVERY dis_ucode_ldr";;
++    esac
++
++
+     if [ "${vt_handoff}" = 1 ]; then
+         for word in ${GRUB_CMDLINE_LINUX_DEFAULT}; do
+             if [ "${word}" = splash ]; then
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-resilient-boot-boot-order.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-resilient-boot-boot-order.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-resilient-boot-boot-order.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-resilient-boot-boot-order.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,236 @@
+From: Julian Andres Klode <julian.klode@canonical.com>
+Date: Wed, 8 Apr 2020 11:05:25 +0200
+Subject: UBUNTU: efivar: Correctly handle boot order of multiple ESPs
+
+Modify the code to insert the ESP mounted to /boot/efi (the *primary*
+ESP) as the first item, but any other ESP after any other of _our_
+ESPs.
+
+So assume we have three ESPs A, B, C (_ours_), and three other
+boot entries X, Y, Z. We configure A, B, and C in that order,
+though some might already be in it, some examples:
+
+	XYZ -> ABCXYZ  (A is added to front, B after it, C after B)
+	BXCYZ -> ABXCYZ (A is added to front, B and C remain unchanged)
+	AXCYZ -> AXCBYZ  (the previously unconfigured ESP B is added after last ESP C)
+
+Doing this requires us passing the path of the ESP directory down to
+the code doing the install, so it can then check whether it was the
+primary ESP - that is, mounted to /boot/efi - or not.
+
+Patch-Name: ubuntu-resilient-boot-boot-order.patch
+---
+ grub-core/osdep/basic/no_platform.c |  2 +-
+ grub-core/osdep/unix/efivar.c       | 48 ++++++++++++++++++++++++++++++++-----
+ grub-core/osdep/unix/platform.c     |  6 ++---
+ grub-core/osdep/windows/platform.c  |  2 +-
+ include/grub/util/install.h         | 17 +++++++------
+ util/grub-install.c                 |  8 +++----
+ 6 files changed, 59 insertions(+), 24 deletions(-)
+
+diff --git a/grub-core/osdep/basic/no_platform.c b/grub-core/osdep/basic/no_platform.c
+index d76c34c..152a328 100644
+--- a/grub-core/osdep/basic/no_platform.c
++++ b/grub-core/osdep/basic/no_platform.c
+@@ -31,7 +31,7 @@ grub_install_register_ieee1275 (int is_prep, const char *install_device,
+ }
+ 
+ void
+-grub_install_register_efi (grub_device_t efidir_grub_dev,
++grub_install_register_efi (grub_device_t efidir_grub_dev, const char *efidir,
+ 			   const char *efifile_path,
+ 			   const char *efi_distributor)
+ {
+diff --git a/grub-core/osdep/unix/efivar.c b/grub-core/osdep/unix/efivar.c
+index f140676..19b6550 100644
+--- a/grub-core/osdep/unix/efivar.c
++++ b/grub-core/osdep/unix/efivar.c
+@@ -269,9 +269,10 @@ remove_from_boot_order (struct efi_variable *order, uint16_t num)
+ }
+ 
+ static void
+-add_to_boot_order (struct efi_variable *order, uint16_t num)
++add_to_boot_order (struct efi_variable *order, uint16_t num,
++		   uint16_t *alt_nums, size_t n_alt_nums, bool is_boot_efi)
+ {
+-  int i;
++  int i, j, position = -1;
+   size_t new_data_size;
+   uint8_t *new_data;
+ 
+@@ -281,10 +282,36 @@ add_to_boot_order (struct efi_variable *order, uint16_t num)
+     if (GET_ORDER (order->data, i) == num)
+       return;
+ 
++  if (!is_boot_efi)
++    {
++      for (i = 0; i < order->data_size / sizeof (uint16_t); ++i)
++	for (j = 0; j < n_alt_nums; j++)
++	  if (GET_ORDER (order->data, i) == alt_nums[j])
++	    position = i;
++    }
++
+   new_data_size = order->data_size + sizeof (uint16_t);
+   new_data = xmalloc (new_data_size);
+-  SET_ORDER (new_data, 0, num);
+-  memcpy (new_data + sizeof (uint16_t), order->data, order->data_size);
++
++  if (position != -1)
++    {
++      /* So we should be inserting after something else, as we're not the
++	 preferred ESP. Could write this as memcpy(), but this is far more
++	 readable. */
++      for (i = 0; i <= position; ++i)
++	SET_ORDER (new_data, i, GET_ORDER (order->data, i));
++
++      SET_ORDER (new_data, position + 1, num);
++
++      for (i = position + 1; i < order->data_size / sizeof (uint16_t); ++i)
++	SET_ORDER (new_data, i + 1, GET_ORDER (order->data, i));
++    }
++  else
++    {
++      SET_ORDER (new_data, 0, num);
++      memcpy (new_data + sizeof (uint16_t), order->data, order->data_size);
++    }
++
+   free (order->data);
+   order->data = new_data;
+   order->data_size = new_data_size;
+@@ -512,7 +539,7 @@ devices_equal (const_efidp a, const_efidp b)
+ 
+ int
+ grub_install_efivar_register_efi (grub_device_t efidir_grub_dev,
+-				  const char *efifile_path,
++				  const char *efidir, const char *efifile_path,
+ 				  const char *efi_distributor)
+ {
+   const char *efidir_disk;
+@@ -522,7 +549,10 @@ grub_install_efivar_register_efi (grub_device_t efidir_grub_dev,
+   efidp *alternatives;
+   efidp this;
+   int entry_num = -1;
++  uint16_t *alt_nums = NULL;
++  size_t n_alt_nums = 0;
+   int rc;
++  bool is_boot_efi;
+ 
+   /* Check if EFI variable can be written */
+   if (!efivar_is_rw ())
+@@ -532,6 +562,7 @@ grub_install_efivar_register_efi (grub_device_t efidir_grub_dev,
+       return 0;
+     }
+ 
++  is_boot_efi = strstr (efidir, "/boot/efi") != NULL;
+   efidir_disk = grub_util_biosdisk_get_osdev (efidir_grub_dev->disk);
+   efidir_part = efidir_grub_dev->disk->partition ? efidir_grub_dev->disk->partition->number + 1 : 1;
+   alternatives = get_alternative_esps ();
+@@ -610,6 +641,10 @@ grub_install_efivar_register_efi (grub_device_t efidir_grub_dev,
+ 	    {
+ 	      grub_util_info ("not deleting alternative EFI variable %s (%s)",
+ 			      entry->name, label);
++
++	      alt_nums
++		  = xrealloc (alt_nums, (++n_alt_nums) * sizeof (*alt_nums));
++	      alt_nums[n_alt_nums - 1] = entry->num;
+ 	      continue;
+ 	    }
+ 	}
+@@ -645,7 +680,8 @@ grub_install_efivar_register_efi (grub_device_t efidir_grub_dev,
+   if (rc < 0)
+     goto err;
+ 
+-  add_to_boot_order (order, (uint16_t) entry_num);
++  add_to_boot_order (order, (uint16_t)entry_num, alt_nums, n_alt_nums,
++		     is_boot_efi);
+ 
+   grub_util_info ("setting EFI variable BootOrder");
+   rc = set_efi_variable ("BootOrder", order);
+diff --git a/grub-core/osdep/unix/platform.c b/grub-core/osdep/unix/platform.c
+index 302446b..947cb7c 100644
+--- a/grub-core/osdep/unix/platform.c
++++ b/grub-core/osdep/unix/platform.c
+@@ -76,13 +76,13 @@ get_ofpathname (const char *dev)
+ }
+ 
+ int
+-grub_install_register_efi (grub_device_t efidir_grub_dev,
++grub_install_register_efi (grub_device_t efidir_grub_dev, const char *efidir,
+ 			   const char *efifile_path,
+ 			   const char *efi_distributor)
+ {
+ #ifdef HAVE_EFIVAR
+-  return grub_install_efivar_register_efi (efidir_grub_dev, efifile_path,
+-					   efi_distributor);
++  return grub_install_efivar_register_efi (efidir_grub_dev, efidir,
++					   efifile_path, efi_distributor);
+ #else
+   grub_util_error ("%s",
+ 		   _("GRUB was not built with efivar support; "
+diff --git a/grub-core/osdep/windows/platform.c b/grub-core/osdep/windows/platform.c
+index e9156af..fac2101 100644
+--- a/grub-core/osdep/windows/platform.c
++++ b/grub-core/osdep/windows/platform.c
+@@ -208,7 +208,7 @@ set_efi_variable_bootn (grub_uint16_t n, void *in, grub_size_t len)
+ }
+ 
+ int
+-grub_install_register_efi (grub_device_t efidir_grub_dev,
++grub_install_register_efi (grub_device_t efidir_grub_dev, const char *efidir,
+ 			   const char *efifile_path,
+ 			   const char *efi_distributor)
+ {
+diff --git a/include/grub/util/install.h b/include/grub/util/install.h
+index ea4a6aa..6e4ee4f 100644
+--- a/include/grub/util/install.h
++++ b/include/grub/util/install.h
+@@ -231,15 +231,14 @@ grub_install_get_default_x86_platform (void);
+ const char *
+ grub_install_get_default_powerpc_machtype (void);
+ 
+-int
+-grub_install_efivar_register_efi (grub_device_t efidir_grub_dev,
+-				  const char *efifile_path,
+-				  const char *efi_distributor);
+-
+-int
+-grub_install_register_efi (grub_device_t efidir_grub_dev,
+-			   const char *efifile_path,
+-			   const char *efi_distributor);
++int grub_install_efivar_register_efi (grub_device_t efidir_grub_dev,
++				      const char *efidir,
++				      const char *efifile_path,
++				      const char *efi_distributor);
++
++int grub_install_register_efi (grub_device_t efidir_grub_dev,
++			       const char *efidir, const char *efifile_path,
++			       const char *efi_distributor);
+ 
+ void
+ grub_install_register_ieee1275 (int is_prep, const char *install_device,
+diff --git a/util/grub-install.c b/util/grub-install.c
+index 36efc01..40663d6 100644
+--- a/util/grub-install.c
++++ b/util/grub-install.c
+@@ -2133,9 +2133,9 @@ main (int argc, char *argv[])
+ 	    {
+ 	      /* Try to make this image bootable using the EFI Boot Manager, if available.  */
+ 	      int ret;
+-	      ret = grub_install_register_efi (efidir_grub_dev,
+-					       "\\System\\Library\\CoreServices",
+-					       efi_distributor);
++	      ret = grub_install_register_efi (
++		  efidir_grub_dev, efidir, "\\System\\Library\\CoreServices",
++		  efi_distributor);
+ 	      if (ret)
+ 	        grub_util_error (_("failed to register the EFI boot entry: %s"),
+ 				 strerror (ret));
+@@ -2255,7 +2255,7 @@ main (int argc, char *argv[])
+ 			  efidir_grub_dev->disk->name,
+ 			  (part ? ",": ""), (part ? : ""));
+ 	  grub_free (part);
+-	  ret = grub_install_register_efi (efidir_grub_dev,
++	  ret = grub_install_register_efi (efidir_grub_dev, efidir,
+ 					   efifile_path, efi_distributor);
+ 	  if (ret)
+ 	    grub_util_error (_("failed to register the EFI boot entry: %s"),
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-resilient-boot-ignore-alternative-esps.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-resilient-boot-ignore-alternative-esps.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-resilient-boot-ignore-alternative-esps.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-resilient-boot-ignore-alternative-esps.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,212 @@
+From: Julian Andres Klode <julian.klode@canonical.com>
+Date: Fri, 3 Apr 2020 13:43:49 +0200
+Subject: UBUNTU: efivar: Ignore alternative ESPs
+
+This is an ugly hack to get resilient boot somewhat working:
+We pass in a list of all ESPS in _UBUNTU_ALTERNATIVE_ESPS, and
+then we ignore those when looking for entries to change/remove.
+
+Patch-Name: ubuntu-resilient-boot-ignore-alternative-esps.patch
+---
+ grub-core/osdep/unix/efivar.c | 130 ++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 125 insertions(+), 5 deletions(-)
+
+diff --git a/grub-core/osdep/unix/efivar.c b/grub-core/osdep/unix/efivar.c
+index b53f32d..f140676 100644
+--- a/grub-core/osdep/unix/efivar.c
++++ b/grub-core/osdep/unix/efivar.c
+@@ -37,12 +37,14 @@
+ #include <grub/list.h>
+ #include <grub/misc.h>
+ #include <grub/emu/exec.h>
++#include <grub/emu/getroot.h>
+ #include <linux/magic.h>
+ #include <sys/types.h>
+ #include <sys/vfs.h>
+ #include <sys/statvfs.h>
+ #include <ctype.h>
+ #include <errno.h>
++#include <stdbool.h>
+ #include <stdlib.h>
+ #include <string.h>
+ 
+@@ -339,14 +341,12 @@ get_edd_version (void)
+   return 1;
+ }
+ 
+-static struct efi_variable *
+-make_boot_variable (int num, const char *disk, int part, const char *loader,
+-		    const char *label)
++static ssize_t
++make_efidp (const char *disk, int part, const char *loader, efidp *out)
+ {
+-  struct efi_variable *entry = new_boot_variable ();
+   uint32_t options;
+   uint32_t edd10_devicenum;
+-  ssize_t dp_needed, loadopt_needed;
++  ssize_t dp_needed;
+   efidp dp = NULL;
+ 
+   options = EFIBOOT_ABBREV_HD;
+@@ -377,6 +377,27 @@ make_boot_variable (int num, const char *disk, int part, const char *loader,
+   if (dp_needed < 0)
+     goto err;
+ 
++  *out = dp;
++  return dp_needed;
++
++err:
++  free (dp);
++  *out = NULL;
++  return -1;
++}
++
++static struct efi_variable *
++make_boot_variable (int num, const char *disk, int part, const char *loader,
++		    const char *label)
++{
++  struct efi_variable *entry = new_boot_variable ();
++  ssize_t dp_needed, loadopt_needed;
++  efidp dp = NULL;
++
++  dp_needed = make_efidp (disk, part, loader, &dp);
++  if (dp_needed < 0)
++    goto err;
++
+   loadopt_needed = efi_loadopt_create (NULL, 0, LOAD_OPTION_ACTIVE,
+ 				       dp, dp_needed, (unsigned char *) label,
+ 				       NULL, 0);
+@@ -424,6 +445,71 @@ efivar_is_rw (void)
+   return true;
+ }
+ 
++// I hurt my grub today, to see what I can do.
++static efidp *
++get_alternative_esps (void)
++{
++  size_t result_size = 0;
++  efidp *result = NULL;
++  char *alternatives = getenv ("_UBUNTU_ALTERNATIVE_ESPS");
++  char *esp;
++
++  if (!alternatives)
++    goto out;
++
++  for (esp = strtok (alternatives, ", "); esp; esp = strtok (NULL, ", "))
++    {
++      while (isspace (*esp))
++	esp++;
++      if (!*esp)
++	continue;
++
++      char *devname = grub_util_get_grub_dev (esp);
++      if (!devname)
++	continue;
++      grub_device_t dev = grub_device_open (devname);
++      free (devname);
++      if (!dev)
++	continue;
++
++      const char *disk = grub_util_biosdisk_get_osdev (dev->disk);
++      int part = dev->disk->partition ? dev->disk->partition->number + 1 : 1;
++
++      result = xrealloc (result, (++result_size) * sizeof (*result));
++      if (make_efidp (disk, part, "", &result[result_size - 1]) < 0)
++	continue;
++      grub_device_close (dev);
++    }
++
++out:
++  result = xrealloc (result, (++result_size) * sizeof (*result));
++  result[result_size - 1] = NULL;
++  return result;
++}
++
++/* Check if both efidp are on the same device. */
++static bool
++devices_equal (const_efidp a, const_efidp b)
++{
++  while (a && b)
++    {
++      // We reached a file, so we must be on the same device, woohoo
++      if (efidp_subtype (a) == EFIDP_MEDIA_FILE
++	  && efidp_subtype (b) == EFIDP_MEDIA_FILE)
++	return true;
++      if (efidp_node_size (a) != efidp_node_size (b))
++	break;
++      if (memcmp (a, b, efidp_node_size (a)) != 0)
++	break;
++      if (efidp_next_node (a, &a) < 0)
++	break;
++      if (efidp_next_node (b, &b) < 0)
++	break;
++    }
++
++  return false;
++}
++
+ int
+ grub_install_efivar_register_efi (grub_device_t efidir_grub_dev,
+ 				  const char *efifile_path,
+@@ -433,6 +519,8 @@ grub_install_efivar_register_efi (grub_device_t efidir_grub_dev,
+   int efidir_part;
+   struct efi_variable *entries = NULL, *entry;
+   struct efi_variable *order;
++  efidp *alternatives;
++  efidp this;
+   int entry_num = -1;
+   int rc;
+ 
+@@ -446,6 +534,13 @@ grub_install_efivar_register_efi (grub_device_t efidir_grub_dev,
+ 
+   efidir_disk = grub_util_biosdisk_get_osdev (efidir_grub_dev->disk);
+   efidir_part = efidir_grub_dev->disk->partition ? efidir_grub_dev->disk->partition->number + 1 : 1;
++  alternatives = get_alternative_esps ();
++
++  if (make_efidp (efidir_disk, efidir_part, "", &this) < 0)
++    {
++      grub_util_warn ("Internal error");
++      return 1;
++    }
+ 
+ #ifdef __linux__
+   /*
+@@ -487,6 +582,8 @@ grub_install_efivar_register_efi (grub_device_t efidir_grub_dev,
+     {
+       efi_load_option *load_option = (efi_load_option *) entry->data;
+       const char *label;
++      efidp path;
++      efidp *alt;
+ 
+       if (entry->num < 0)
+ 	continue;
+@@ -494,6 +591,29 @@ grub_install_efivar_register_efi (grub_device_t efidir_grub_dev,
+       if (strcasecmp (label, efi_distributor) != 0)
+ 	continue;
+ 
++      path = efi_loadopt_path (load_option, entry->data_size);
++      if (!path)
++	continue;
++
++      /* Do not remove this entry if it's an alternative ESP, but do reuse
++       * or remove this entry if it is for the current ESP or any unspecified
++       * ESP */
++      if (!devices_equal (path, this))
++	{
++	  for (alt = alternatives; *alt; alt++)
++	    {
++	      if (devices_equal (path, *alt))
++		break;
++	    }
++
++	  if (*alt)
++	    {
++	      grub_util_info ("not deleting alternative EFI variable %s (%s)",
++			      entry->name, label);
++	      continue;
++	    }
++	}
++
+       /* To avoid problems with some firmware implementations, reuse the first
+          matching variable we find rather than deleting and recreating it.  */
+       if (entry_num == -1)
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-shorter-version-info.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-shorter-version-info.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-shorter-version-info.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-shorter-version-info.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,40 @@
+From: Julian Andres Klode <julian.klode@canonical.com>
+Date: Thu, 8 Feb 2018 10:48:37 +0100
+Subject: UBUNTU: Show only upstream version,
+ hide rest in package_version variable
+
+The complete package version can get a bit long, so only show the
+upstream version in the menu and on the top of the console, and
+hide the complete version in a package_version variable.
+
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1723434
+Last-Updated: 2018-02-08
+
+Patch-Name: ubuntu-shorter-version-info.patch
+---
+ grub-core/normal/main.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
+index 7c6c048..470cdf2 100644
+--- a/grub-core/normal/main.c
++++ b/grub-core/normal/main.c
+@@ -209,7 +209,7 @@ grub_normal_init_page (struct grub_term_output *term,
+ 
+   grub_term_cls (term);
+ 
+-  msg_formatted = grub_xasprintf (_("GNU GRUB  version %s"), PACKAGE_VERSION);
++  msg_formatted = grub_xasprintf (_("GNU GRUB  version %s"), VERSION);
+   if (!msg_formatted)
+     return;
+ 
+@@ -656,6 +656,9 @@ GRUB_MOD_INIT(normal)
+   grub_env_set ("grub_platform", GRUB_PLATFORM);
+   grub_env_export ("grub_platform");
+ 
++  grub_env_set ("package_version", PACKAGE_VERSION);
++  grub_env_export ("package_version");
++
+   grub_boot_time ("Normal module prepared");
+ }
+ 
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-speed-zsys-history.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-speed-zsys-history.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-speed-zsys-history.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-speed-zsys-history.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,157 @@
+From: Didier Roche <didrocks@ubuntu.com>
+Date: Mon, 13 Apr 2020 15:12:21 +0200
+Subject: UBUNTU: Improve performance in bootmenu for zsys
+
+In case there are a lot of zfs snapshots, we end up with a huge delay
+when navigating grub (eg 80 seconds, displaying a black screen, for 100
+system snapshots).
+Reduce the grub.cfg file size by moving the entries in a single
+function with parameter instead of duplicating each entry.
+Ensure the user can still easily edit them easily by naming the
+parameters.
+
+Patch-Name: ubuntu-speed-zsys-history.patch
+---
+ util/grub.d/10_linux_zfs.in | 77 ++++++++++++++++++++++++++++++++-------------
+ 1 file changed, 56 insertions(+), 21 deletions(-)
+
+diff --git a/util/grub.d/10_linux_zfs.in b/util/grub.d/10_linux_zfs.in
+index 99d33da..4b2448f 100755
+--- a/util/grub.d/10_linux_zfs.in
++++ b/util/grub.d/10_linux_zfs.in
+@@ -819,9 +819,10 @@ zfs_linux_entry () {
+     boot_device="$5"
+     initrd="$6"
+     kernel="$7"
+-    kernel_additional_args="${8:-}"
++    kernel_version="$8"
++    kernel_additional_args="${9:-}"
++    boot_devices="${10:-}"
+ 
+-    kernel_version=$(basename "${kernel}" | sed -e "s,^[^0-9]*-,,g")
+     submenu_indentation="$(printf %${submenu_level}s | tr " " "${grub_tab}")"
+ 
+     echo "${submenu_indentation}menuentry '$(echo "${title}" | grub_quote)' ${CLASS} \${menuentry_id_option} 'gnulinux-${dataset}-${kernel_version}' {"
+@@ -856,7 +857,15 @@ zfs_linux_entry () {
+     echo "${submenu_indentation}	insmod gzio"
+     echo "${submenu_indentation}	if [ \"\${grub_platform}\" = xen ]; then insmod xzio; insmod lzopio; fi"
+ 
+-    echo "$(prepare_grub_to_access_device_cached "${boot_device}" "${submenu_level}")"
++    if [ -n "$boot_devices" ]; then
++        for device in ${boot_devices}; do
++            echo "${submenu_indentation}	if [ "${boot_device}" = "${device}" ]; then"
++            echo "$(prepare_grub_to_access_device_cached "${device}" $(( submenu_level +1 )) )"
++            echo "${submenu_indentation}	fi"
++        done
++    else
++        echo "$(prepare_grub_to_access_device_cached "${boot_device}" "${submenu_level}")"
++    fi
+ 
+     if [ "${quiet_boot}" = 0 ] || [ "${type}" != simple ]; then
+         echo "${submenu_indentation}	echo $(gettext_printf "Loading Linux %s ..." ${kernel_version} | grub_quote)"
+@@ -925,6 +934,40 @@ generate_grub_menu() {
+ 
+     print_menu_prologue
+ 
++    cat<<'EOF'
++function zsyshistorymenu {
++	# $1: root dataset (eg rpool/ROOT/ubuntu_2zhm07@autozsys_k56fr6)
++	# $2: boot device id (eg 411f29ce1557bfed)
++	# $3: initrd (eg /BOOT/ubuntu_2zhm07@autozsys_k56fr6/initrd.img-5.4.0-21-generic)
++	# $4: kernel (eg /BOOT/ubuntu_2zhm07@autozsys_k56fr6/vmlinuz-5.4.0-21-generic)
++	# $5: kernel_version (eg 5.4.0-21-generic)
++
++	set root_dataset="${1}"
++	set boot_device="${2}"
++	set initrd="${3}"
++	set kernel="${4}"
++	set kversion="${5}"
++
++EOF
++    boot_devices=$(echo "${menu_metadata}" | cut -d"$(printf '\t')" -f6 | sort -u)
++
++    title=$(gettext_printf "Revert system only")
++    zfs_linux_entry 1 "${title}" "simple" '${root_dataset}' '${boot_device}' '${initrd}' '${kernel}' '${kversion}' '' "${boot_devices}"
++
++    title="$(gettext_printf "Revert system and user data")"
++    zfs_linux_entry 1 "${title}" "simple" '${root_dataset}' '${boot_device}' '${initrd}' '${kernel}' '${kversion}' 'zsys-revert=userdata' "${boot_devices}"
++
++    GRUB_DISABLE_RECOVERY="${GRUB_DISABLE_RECOVERY:-}"
++    if [ "${GRUB_DISABLE_RECOVERY}" != "true" ]; then
++        title="$(gettext_printf "Revert system only (%s)" "$(gettext "${GRUB_RECOVERY_TITLE}")")"
++        zfs_linux_entry 1 "${title}" "recovery" '${root_dataset}' '${boot_device}' '${initrd}' '${kernel}' '${kversion}' '' "${boot_devices}"
++
++        title="$(gettext_printf "Revert system and user data (%s)" "$(gettext "${GRUB_RECOVERY_TITLE}")")"
++        zfs_linux_entry 1 "${title}" "recovery" '${root_dataset}' '${boot_device}' '${initrd}' '${kernel}' '${kversion}' 'zsys-revert=userdata' "${boot_devices}"
++    fi
++echo "}"
++echo
++
+     # IFS is set to TAB (ASCII 0x09)
+     echo "${menu_metadata}" |
+     {
+@@ -955,7 +998,8 @@ generate_grub_menu() {
+                     main_dataset_name="${name}"
+                     main_dataset="${dataset}"
+ 
+-                    zfs_linux_entry 0 "${title}" "simple" "${dataset}" "${device}" "${initrd}" "${kernel}"
++                    kernel_version=$(basename "${kernel}" | sed -e "s,^[^0-9]*-,,g")
++                    zfs_linux_entry 0 "${title}" "simple" "${dataset}" "${device}" "${initrd}" "${kernel}" "${kernel_version}"
+                     at_least_one_entry=1
+                 ;;
+                 advanced)
+@@ -971,12 +1015,12 @@ generate_grub_menu() {
+ 
+                     kernel_version=$(basename "${kernel}" | sed -e "s,^[^0-9]*-,,g")
+                     title="$(gettext_printf "%s%s, with Linux %s" "${last_booted_kernel_marker}" "${name}" "${kernel_version}")"
+-                    zfs_linux_entry 1 "${title}" "advanced" "${dataset}" "${device}" "${initrd}" "${kernel}"
++                    zfs_linux_entry 1 "${title}" "advanced" "${dataset}" "${device}" "${initrd}" "${kernel}" "${kernel_version}"
+ 
+                     GRUB_DISABLE_RECOVERY=${GRUB_DISABLE_RECOVERY:-}
+                     if [ "${GRUB_DISABLE_RECOVERY}" != "true" ]; then
+                         title="$(gettext_printf "%s%s, with Linux %s (%s)" "${last_booted_kernel_marker}" "${name}" "${kernel_version}" "$(gettext "${GRUB_RECOVERY_TITLE}")")"
+-                        zfs_linux_entry 1 "${title}" "recovery" "${dataset}" "${device}" "${initrd}" "${kernel}"
++                        zfs_linux_entry 1 "${title}" "recovery" "${dataset}" "${device}" "${initrd}" "${kernel}" "${kernel_version}"
+                     fi
+                     at_least_one_entry=1
+                 ;;
+@@ -994,33 +1038,24 @@ generate_grub_menu() {
+                     fi
+                     echo "	submenu '${title}' \${menuentry_id_option} 'gnulinux-history-${dataset}' {"
+ 
++                    kernel_version=$(basename "${kernel}" | sed -e "s,^[^0-9]*-,,g")
++
+                     # Zsys only: let revert system without destroying snapshots
+                     if [ "${iszsys}" = "yes" ]; then
+-                        title="$(gettext_printf "Revert system only")"
+-                        zfs_linux_entry 2 "${title}" "simple" "${dataset}" "${device}" "${initrd}" "${kernel}"
+-                        title="$(gettext_printf "Revert system and user data")"
+-                        zfs_linux_entry 2 "${title}" "simple" "${dataset}" "${device}" "${initrd}" "${kernel}" "zsys-revert=userdata"
+-
+-                        GRUB_DISABLE_RECOVERY="${GRUB_DISABLE_RECOVERY:-}"
+-                        if [ "${GRUB_DISABLE_RECOVERY}" != "true" ]; then
+-                            title="$(gettext_printf "Revert system only (%s)" "$(gettext "${GRUB_RECOVERY_TITLE}")")"
+-                            zfs_linux_entry 2 "${title}" "recovery" "${dataset}" "${device}" "${initrd}" "${kernel}"
+-                            title="$(gettext_printf "Revert system and user data (%s)" "$(gettext "${GRUB_RECOVERY_TITLE}")")"
+-                            zfs_linux_entry 2 "${title}" "recovery" "${dataset}" "${device}" "${initrd}" "${kernel}" "zsys-revert=userdata"
+-                        fi
++                        echo "${grub_tab}${grub_tab}zsyshistorymenu" \"${dataset}\" \"${device}\" \"${initrd}\" \"${kernel}\" \"${kernel_version}\"
+                     # Non-zsys: boot temporarly on snapshots or rollback (destroying intermediate snapshots)
+                     else
+                         title="$(gettext_printf "One time boot")"
+-                        zfs_linux_entry 2 "${title}" "simple" "${dataset}" "${device}" "${initrd}" "${kernel}"
++                        zfs_linux_entry 2 "${title}" "simple" "${dataset}" "${device}" "${initrd}" "${kernel}" "${kernel_version}"
+ 
+                         GRUB_DISABLE_RECOVERY="${GRUB_DISABLE_RECOVERY:-}"
+                         if [ "${GRUB_DISABLE_RECOVERY}" != "true" ]; then
+                             title="$(gettext_printf "One time boot (%s)" "$(gettext "${GRUB_RECOVERY_TITLE}")")"
+-                            zfs_linux_entry 2 "${title}" "recovery" "${dataset}" "${device}" "${initrd}" "${kernel}"
++                            zfs_linux_entry 2 "${title}" "recovery" "${dataset}" "${device}" "${initrd}" "${kernel}" "${kernel_version}"
+                         fi
+ 
+                         title="$(gettext_printf "Revert system (all intermediate snapshots will be destroyed)")"
+-                        zfs_linux_entry 2 "${title}" "simple" "${dataset}" "${device}" "${initrd}" "${kernel}" "rollback=yes"
++                        zfs_linux_entry 2 "${title}" "simple" "${dataset}" "${device}" "${initrd}" "${kernel}" "${kernel_version}" "rollback=yes"
+                     fi
+ 
+                     echo "	}"
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-support-initrd-less-boot.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-support-initrd-less-boot.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-support-initrd-less-boot.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-support-initrd-less-boot.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,80 @@
+From: Chris Glass <chris.glass@canonical.com>
+Date: Thu, 10 Nov 2016 13:44:25 -0500
+Subject: UBUNTU: Added knobs to allow non-initrd boot config
+
+Added GRUB_FORCE_PARTUUID and GRUB_DISABLE_INITRD configuration knobs to allow
+users to generate grub menu entries that boot directly to the kernel, without
+using an initramfs.
+
+Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
+
+Patch-Name: ubuntu-support-initrd-less-boot.patch
+---
+ docs/grub.texi          | 13 +++++++++++++
+ util/grub-mkconfig.in   |  4 +++-
+ util/grub.d/10_linux.in | 12 +++++++++---
+ 3 files changed, 25 insertions(+), 4 deletions(-)
+
+diff --git a/docs/grub.texi b/docs/grub.texi
+index 00bf798..4d86521 100644
+--- a/docs/grub.texi
++++ b/docs/grub.texi
+@@ -1623,6 +1623,19 @@ This option sets the English text of the string that will be displayed in
+ parentheses to indicate that a boot option is provided to help users recover
+ a broken system.  The default is "recovery mode".
+ 
++@item GRUB_FORCE_PARTUUID
++This option forces the root disk entry to be the specified PARTUUID instead
++of whatever would be used instead. This is useful when you control the
++partitioning of the disk but cannot guarantee what the actual hardware
++will be, for example in virtual machine images.
++Setting this option to @samp{12345678-01} will produce:
++root=PARTUUID=12345678-01
++
++@item GRUB_DISABLE_INITRD
++Then set to @samp{true}, this option prevents an initrd to be used at boot
++time, regardless of whether one is detected or not. @command{grub-mkconfig}
++will therefore not generate any initrd lines.
++
+ @end table
+ 
+ The following options are still accepted for compatibility with existing
+diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in
+index 13e436b..2ebb8f3 100644
+--- a/util/grub-mkconfig.in
++++ b/util/grub-mkconfig.in
+@@ -266,7 +266,9 @@ export GRUB_DEFAULT \
+   GRUB_OS_PROBER_SKIP_LIST \
+   GRUB_DISABLE_SUBMENU \
+   GRUB_RECORDFAIL_TIMEOUT \
+-  GRUB_RECOVERY_TITLE
++  GRUB_RECOVERY_TITLE \
++  GRUB_FORCE_PARTUUID \
++  GRUB_DISABLE_INITRD
+ 
+ if test "x${grub_cfg}" != "x"; then
+   rm -f "${grub_cfg}.new"
+diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
+index d6ae61f..695ad5e 100644
+--- a/util/grub.d/10_linux.in
++++ b/util/grub.d/10_linux.in
+@@ -181,10 +181,16 @@ linux_entry ()
+ 	echo	'$(echo "$message" | grub_quote)'
+ EOF
+   fi
+-  sed "s/^/$submenu_indentation/" << EOF
+-	linux	${rel_dirname}/${basename} root=${linux_root_device_thisversion} ro ${args}
++  if [ x"$GRUB_FORCE_PARTUUID" = x ]; then
++      sed "s/^/$submenu_indentation/" << EOF
++        linux	${rel_dirname}/${basename} root=${linux_root_device_thisversion} ro ${args}
++EOF
++  else
++      sed "s/^/$submenu_indentation/" << EOF
++        linux	${rel_dirname}/${basename} root=PARTUUID=${GRUB_FORCE_PARTUUID} ro ${args}
+ EOF
+-  if test -n "${initrd}" ; then
++  fi
++  if test -n "${initrd}" && [ x"$GRUB_DISABLE_INITRD" != xtrue ]; then
+     # TRANSLATORS: ramdisk isn't identifier. Should be translated.
+     if [ x"$quiet_boot" = x0 ] || [ x"$type" != xsimple ]; then
+       message="$(gettext_printf "Loading initial ramdisk ...")"
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-verifiers-last.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-verifiers-last.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-verifiers-last.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-verifiers-last.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,59 @@
+From: Julian Andres Klode <julian.klode@canonical.com>
+Date: Wed, 15 Dec 2021 16:10:40 +0100
+Subject: UBUNTU: Move verifiers after decompressors
+
+Our arm64 kernels are compressed as Image.gz, and decompressed
+in grub using gzio. This fails shim_lock verifier as the verifiers
+run before the decompression.
+
+Change the order so that the verifier runs last.
+
+This change changes behavior of the pgp verifier, which we do not
+use, but which always ran first. Since we do not use that verifier,
+the change here should be correct.
+
+This changes TPM measurements for compressed kernels to measure
+the kernel binary rather than the gzip archive as well.
+
+This patch is sort of rejected upstream, as upstream uses
+LoadImage which apparently does not work with a compressed
+kernel anyway - this is just a temporary workaround.
+
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1954683
+Forwarded: not-needed
+---
+ include/grub/file.h        | 4 ++--
+ tests/file_filter/test.cfg | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/grub/file.h b/include/grub/file.h
+index 59d53f6..06f2839 100644
+--- a/include/grub/file.h
++++ b/include/grub/file.h
+@@ -183,13 +183,13 @@ extern grub_disk_read_hook_t EXPORT_VAR(grub_file_progress_hook);
+ /* Filters with lower ID are executed first.  */
+ typedef enum grub_file_filter_id
+   {
+-    GRUB_FILE_FILTER_VERIFY,
+     GRUB_FILE_FILTER_GZIO,
+     GRUB_FILE_FILTER_XZIO,
+     GRUB_FILE_FILTER_LZOPIO,
+-    GRUB_FILE_FILTER_MAX,
+     GRUB_FILE_FILTER_COMPRESSION_FIRST = GRUB_FILE_FILTER_GZIO,
+     GRUB_FILE_FILTER_COMPRESSION_LAST = GRUB_FILE_FILTER_LZOPIO,
++    GRUB_FILE_FILTER_VERIFY,
++    GRUB_FILE_FILTER_MAX,
+   } grub_file_filter_id_t;
+ 
+ typedef grub_file_t (*grub_file_filter_t) (grub_file_t in, enum grub_file_type type);
+diff --git a/tests/file_filter/test.cfg b/tests/file_filter/test.cfg
+index 4308aac..17dc4a8 100644
+--- a/tests/file_filter/test.cfg
++++ b/tests/file_filter/test.cfg
+@@ -1,5 +1,5 @@
+ trust /keys.pub
+-set check_signatures=enforce
++set check_signatures=
+ cat /file.gz
+ cat /file.xz
+ cat /file.lzop
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-enhance-support.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-enhance-support.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-enhance-support.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-enhance-support.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,1048 @@
+From: Didier Roche <didrocks@ubuntu.com>
+Date: Fri, 12 Jul 2019 11:06:06 -0400
+Subject: UBUNTU: Enhance ZFS grub support
+
+* Support multiple zfs systems (grouped by machine-id)
+* Group zfs snapshots and clones with latest dataset for a given
+  installation.
+* Support "history" entry with one time boot, recovery mode and
+  consecutive reboots.
+* Pin kernel to particular snapshot, trying to reboot with the exact
+  same kernel and initrd.
+* Disable in 10_linux zfs support if 10_linux_zfs is installed so that
+  we don't end up with the same installation multiple times.
+
+Author: Jean-Baptiste Lallement <jean-baptiste@ubuntu.com>
+Author: Didier Roche <didrocks@ubuntu.com>
+Author: Adam R Bell <a_0x07@protonmail.ch>
+Last-Update: 2022-08-27
+Patch-Name: ubuntu-zfs-enhance-support.patch
+
+Signed-off-by: Didier Roche <didier.roche@canonical.com>
+---
+ Makefile.util.def           |   7 +
+ util/grub.d/10_linux.in     |   4 +
+ util/grub.d/10_linux_zfs.in | 981 ++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 992 insertions(+)
+ create mode 100755 util/grub.d/10_linux_zfs.in
+
+diff --git a/Makefile.util.def b/Makefile.util.def
+index 3981317..8cf35ae 100644
+--- a/Makefile.util.def
++++ b/Makefile.util.def
+@@ -542,6 +542,13 @@ script = {
+   condition = COND_HOST_LINUX;
+ };
+ 
++script = {
++  name = '10_linux_zfs';
++  common = util/grub.d/10_linux_zfs.in;
++  installdir = grubconf;
++  condition = COND_HOST_LINUX;
++};
++
+ script = {
+   name = '10_xnu';
+   common = util/grub.d/10_xnu.in;
+diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
+index 268121d..d6ae61f 100644
+--- a/util/grub.d/10_linux.in
++++ b/util/grub.d/10_linux.in
+@@ -89,6 +89,10 @@ case x"$GRUB_FS" in
+ 	    GRUB_CMDLINE_LINUX="rootflags=subvol=${rootsubvol} ${GRUB_CMDLINE_LINUX}"
+ 	fi;;
+     xzfs)
++	# We have a more specialized ZFS handler, with multiple system in 10_linux_zfs.
++	if [ -e "`dirname $(readlink -f $0)`/10_linux_zfs" ]; then
++	  exit 0
++	fi
+ 	rpool=`${grub_probe} --device ${GRUB_DEVICE} --target=fs_label 2>/dev/null || zdb -l ${GRUB_DEVICE} | awk -F \' '/ name/ { print $2 }'`
+ 	bootfs="`make_system_path_relative_to_its_root / | sed -e "s,@$,,"`"
+ 	LINUX_ROOT_DEVICE="ZFS=${rpool}${bootfs%/}"
+diff --git a/util/grub.d/10_linux_zfs.in b/util/grub.d/10_linux_zfs.in
+new file mode 100755
+index 0000000..a57757f
+--- /dev/null
++++ b/util/grub.d/10_linux_zfs.in
+@@ -0,0 +1,981 @@
++#! /bin/sh
++set -e
++
++# grub-mkconfig helper script.
++# Copyright (C) 2019 Canonical Ltd.
++#
++# GRUB is free software: you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation, either version 3 of the License, or
++# (at your option) any later version.
++#
++# GRUB is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++# GNU General Public License for more details.
++#
++# You should have received a copy of the GNU General Public License
++# along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
++
++prefix="@prefix@"
++datarootdir="@datarootdir@"
++
++. "${pkgdatadir}/grub-mkconfig_lib"
++
++export TEXTDOMAIN=@PACKAGE@
++export TEXTDOMAINDIR="@localedir@"
++
++## Skip early if zfs utils isn't installed (instead of failing on first zpool list)
++if ! `which zfs >/dev/null 2>&1`; then
++    exit 0
++fi
++
++imported_pools=""
++MNTDIR="$(mktemp -d ${TMPDIR:-/tmp}/zfsmnt.XXXXXX)"
++ZFSTMP="$(mktemp -d ${TMPDIR:-/tmp}/zfstmp.XXXXXX)"
++
++RC=0
++on_exit() {
++    # Restore initial zpool import state
++    for pool in ${imported_pools}; do
++        zpool export "${pool}"
++    done
++
++    mountpoint -q "${MNTDIR}/boot"  && umount "${MNTDIR}/boot" || true
++    mountpoint -q "${MNTDIR}"  && umount "${MNTDIR}" || true
++    rmdir "${MNTDIR}"
++    rm -rf "${ZFSTMP}"
++    exit "${RC}"
++}
++trap on_exit EXIT INT QUIT ABRT PIPE TERM
++
++# List ONLINE and DEGRADED pools
++import_pools() {
++    # We have to ignore zpool import output, as potentially multiple / will be available,
++    # and we need to autodetect all zpools this way with their real mountpoints.
++    local initial_pools="$(zpool list | awk '{if (NR>1) print $1}')"
++    local all_pools=""
++    local imported_pools=""
++    local err=""
++
++    set +e
++    err="$(zpool import -f -a -o cachefile=none -o readonly=on -N 2>&1)"
++    # Only print stderr if the command returned an error
++    # (it can echo "No zpool to import" with success, which we don't want)
++    if [ $? -ne 0 ]; then
++        echo "Some pools couldn't be imported and will be ignored:\n${err}" >&2
++    fi
++    set -e
++
++    all_pools="$(zpool list | awk '{if (NR>1) print $1}')"
++    for pool in ${all_pools}; do
++        if echo "${initial_pools}" | grep -wq "${pool}"; then
++            continue
++        fi
++        imported_pools="${imported_pools} ${pool}"
++    done
++
++    echo "${imported_pools}"
++}
++
++# List all the dataset with a root mountpoint
++get_root_datasets() {
++    local pools="$(zpool list | awk '{if (NR>1) print $1}')"
++
++    for p in ${pools}; do
++        local rel_pool_root=$(zpool get -H altroot ${p} | awk '{print $3}')
++        if [ "${rel_pool_root}" = "-" ]; then
++            rel_pool_root="/"
++        fi
++
++        zfs list -H -o name,canmount,mountpoint -t filesystem | grep -E '^'"${p}"'(\s|/[[:print:]]*\s)(on|noauto)\s'"${rel_pool_root}"'$' | awk '{print $1}'
++    done
++}
++
++# find if given datasets can be mounted for directory and return its path (snapshot or real path)
++# $1 is our current dataset name
++# $2 directory path we look for (cannot contains /)
++# $3 is the temporary mount directory to use
++# $4 is the optional snapshot name
++# return path for directory (which can be a mountpoint)
++validate_system_dataset() {
++    local dataset="$1"
++    local directory="$2"
++    local mntdir="$3"
++    local snapshot_name="$4"
++
++    local mount_path="${mntdir}/${directory}"
++
++    if ! zfs list "${dataset}" >/dev/null 2>&1; then
++        return
++    fi
++
++    if ! mount -o noatime,zfsutil -t zfs "${dataset}" "${mount_path}"; then
++        grub_warn "Failed to find a valid directory '${directory}' for dataset '${dataset}@${snapshot_name}'. Ignoring"
++        return
++    fi
++
++    local candidate_path="${mount_path}"
++    if [ -n "${snapshot_name}" ]; then
++        # WORKAROUND a bug https://github.com/zfsonlinux/zfs/issues/9958
++        # Reading the content of a snapshot fails if it is not the first mount
++        # for a given dataset
++        first_mntdir=$(awk '{if ($1 == "'${dataset}'") {print $2; exit;}}' /proc/mounts)
++        if [ "${first_mntdir}" = "/" ]; then
++            # prevents // on candidate_path
++            first_mntdir=""
++        fi
++        candidate_path="${first_mntdir}/.zfs/snapshot/${snapshot_name}"
++    fi
++
++    if [ -n "$(ls "${candidate_path}" 2>/dev/null)" ]; then
++        echo "${candidate_path}"
++        return
++    else
++        mountpoint -q "${mount_path}" && umount "${mount_path}" || true
++    fi
++}
++
++# Detect system directory relevant to the other, trying to find the ones associated on the current dataset or snapshot/
++# System directory should be at most a direct child dataset of main datasets (no recursivity)
++# We can fallback trying other zfs pools if no match has been found.
++# $1 is our current dataset name (which can have @snapshot name)
++# $2 directory path we look for (cannot contains /)
++# $3 restrict_to_same_pool (true|false) force looking for dataset with the same basename in the current dataset pool only
++# $4 is the temporary mount directory to use
++# $5 is the optional etc directory (if not $2 is not etc itself)
++# return path for directory (which can be a mountpoint)
++get_system_directory() {
++    local dataset_path="$1"
++    local directory="$2"
++    local restrict_to_same_pool="$3"
++    local mntdir="$4"
++    local etc_dir="$5"
++
++    if [ -z "${etc_dir}" ]; then
++        etc_dir="${mntdir}/etc"
++    fi
++
++    local candidate_path="${mntdir}/${directory}"
++
++    # 1. Look for /etc/fstab first (which will mount even on top of non empty $directory)
++    local mounted_fstab_entry="false"
++    if [ -f "${etc_dir}/fstab" ]; then
++        mount_args=$(awk '/^[^#].*[ \t]\/'"${directory}"'[ \t]/ {print "-t", $3, $1}' "${etc_dir}/fstab")
++        if [ -n "${mount_args}" ]; then
++            mounted_fstab_entry="true"
++            mount -o noatime ${mount_args} "${candidate_path}" || mounted_fstab_entry="false"
++        fi
++    fi
++
++    # If directory isn't empty. Only count if coming from /etc/fstab. Will be
++    # handled below otherwise as we are interested in potential snapshots.
++    if [ "${mounted_fstab_entry}" = "true" -a -n "$(ls ${candidate_path} 2>/dev/null)" ]; then
++        echo "${candidate_path}"
++        return
++    fi
++
++    # 2. Handle zfs case, which can be a snapshots.
++
++    local base_dataset_path="${dataset_path}"
++    local snapshot_name=""
++    # For snapshots we extract the parent dataset
++    if echo "${dataset_path}" | grep -q '@'; then
++        base_dataset_path=$(echo "${dataset_path}" | cut -d '@' -f1)
++        snapshot_name=$(echo "${dataset_path}" | cut -d '@' -f2)
++    fi
++    base_dataset_name="${base_dataset_path##*/}"
++    base_pool="$(echo "${base_dataset_path}" | cut -d'/' -f1)"
++
++    # 2.a) Look for child dataset included in base dataset, which needs to hold same snapshot if any
++    candidate_path=$(validate_system_dataset "${base_dataset_path}/${directory}" "${directory}" "${mntdir}" "${snapshot_name}")
++    if [ -n "${candidate_path}" ]; then
++        echo "${candidate_path}"
++        return
++    fi
++
++    # 2.b) Look for current dataset (which is already mounted as /)
++    candidate_path="${mntdir}/${directory}"
++    if [ -n "${snapshot_name}" ]; then
++        # WORKAROUND a bug https://github.com/zfsonlinux/zfs/issues/9958
++        # Reading the content of a snapshot fails if it is not the first mount
++        # for a given dataset
++        first_mntdir=$(awk '{if ($1 == "'${base_dataset_path}'") {print $2; exit;}}' /proc/mounts)
++        if [ "${first_mntdir}" = "/" ]; then
++            # prevents // on candidate_path
++            first_mntdir=""
++        fi
++        candidate_path="${first_mntdir}/.zfs/snapshot/${snapshot_name}/${directory}"
++    fi
++    if [ -n "$(ls "${candidate_path}" 2>/dev/null)" ]; then
++        echo "${candidate_path}"
++        return
++    fi
++
++    # 2.c) Look for every datasets in every pool which isn't the current dataset which holds:
++    # - the same dataset name (last section) than our base_dataset_name
++    # - mountpoint=directory
++    # - canmount!=off
++    all_same_base_dataset_name="$(zfs list -H -t filesystem -o name,canmount | awk '/^[^ ]+\/'"${base_dataset_name}"'[ \t](on|noauto)/ {print $1}') "
++
++    # order by local pool datasets first
++    current_pool_same_base_datasets=""
++    other_pools_same_base_datasets=""
++    root_pool=$(echo "${dataset_path%%/*}")
++    for d in ${all_same_base_dataset_name}; do
++        cur_dataset_pool=$(echo "${d%%/*}")
++        if echo "${cur_dataset_pool}" | grep -wq "${root_pool}" 2>/dev/null ; then
++            current_pool_same_base_datasets="${current_pool_same_base_datasets} ${d}"
++        else
++            other_pools_same_base_datasets="${other_pools_same_base_datasets} ${d}"
++        fi
++    done
++    ordered_same_base_datasets="${current_pool_same_base_datasets} ${other_pools_same_base_datasets}"
++    if [ "${restrict_to_same_pool}" = "true" ]; then
++        ordered_same_base_datasets="${current_pool_same_base_datasets}"
++    fi
++
++    # now, loop over them
++    for d in ${ordered_same_base_datasets}; do
++        cur_dataset_pool=$(echo "${d%%/*}")
++
++        rel_pool_root=$(zpool get -H altroot ${cur_dataset_pool} | awk '{print $3}')
++        if [ "${rel_pool_root}" = "-" ]; then
++            rel_pool_root=""
++        fi
++
++        # check mountpoint match
++        candidate_dataset=$(zfs get -H mountpoint ${d} | grep -E "mountpoint\s${rel_pool_root}/${directory}\s" | awk '{print $1}')
++        if [ -z "${candidate_dataset}" ]; then
++            continue
++        fi
++
++        candidate_path=$(validate_system_dataset "${candidate_dataset}" "${directory}" "${mntdir}" "${snapshot_name}")
++        if [ -n "${candidate_path}" ]; then
++            echo "${candidate_path}"
++            return
++        fi
++    done
++
++    # 2.d) If we didn't find anything yet: check for persistent datasets corresponding to our mountpoint, with canmount=on without any snapshot associated:
++    # Note: we go over previous datasets as well, but this is ok, as we didn't include them before.
++    all_mountable_datasets="$(zfs list -t filesystem -o name,canmount | awk  '/^[^ ]+[ \t]+on/ {print $1}')"
++
++    # order by local pool datasets first
++    current_pool_datasets=""
++    other_pools_datasets=""
++    root_pool=$(echo "${dataset_path%%/*}")
++    for d in ${all_mountable_datasets}; do
++        cur_dataset_pool=$(echo "${d%%/*}")
++        if echo "${cur_dataset_pool}" | grep -wq "${root_pool}" 2>/dev/null ; then
++            current_pool_datasets="${current_pool_datasets} ${d}"
++        else
++            other_pools_datasets="${other_pools_datasets} ${d}"
++        fi
++    done
++    ordered_datasets="${current_pool_datasets} ${other_pools_datasets}"
++    if [ "${restrict_to_same_pool}" = "true" ]; then
++        ordered_datasets="${current_pool_datasets}"
++    fi
++
++    for d in ${ordered_datasets}; do
++        cur_dataset_pool=$(echo "${d%%/*}")
++
++        rel_pool_root=$(zpool get -H altroot ${cur_dataset_pool} | awk '{print $3}')
++        if [ "${rel_pool_root}" = "-" ]; then
++            rel_pool_root=""
++        fi
++
++        # check mountpoint match
++        candidate_dataset=$(zfs get -H mountpoint ${d} | grep -E "mountpoint\s${rel_pool_root}/${directory}\s" | awk '{print $1}')
++        if [ -z "${candidate_dataset}" ]; then
++            continue
++        fi
++
++        candidate_path=$(validate_system_dataset "${d}" "${directory}" "${mntdir}" "")
++        if [ -n "${candidate_path}" ]; then
++            echo "${candidate_path}"
++            return
++        fi
++    done
++
++    grub_warn "Failed to find a valid directory '${directory}' for dataset '${dataset_path}'. Ignoring"
++    return
++}
++
++# Try our default layout bpool as a prefered layout (fast path)
++# This is get_system_directory for boot optimized for our default installation layout
++# $1 is our current dataset name (which can have @snapshot name)
++# $2 is the temporary mount directory to use
++# return path for directory (which can be a mountpoint) if found
++try_default_layout_bpool() {
++    local root_dataset_path="$1"
++    local mntdir="$2"
++
++    dataset_basename="${root_dataset_path##*/}"
++    candidate_dataset="bpool/BOOT/${dataset_basename}"
++    dataset_properties="$(zfs get -H mountpoint,canmount "${candidate_dataset}" 2>/dev/null | cut -f3 | paste -sd ' ')"
++    if [ -z "${dataset_properties}" ]; then
++        return
++    fi
++
++    rel_pool_root=$(zpool get -H altroot bpool | awk '{print $3}')
++    if [ "${rel_pool_root}" = "-" ]; then
++        rel_pool_root=""
++    fi
++
++    snapshot_name="${dataset_basename##*@}"
++    [ "${snapshot_name}" = "${dataset_basename}" ] && snapshot_name=""
++    if [ -z "${snapshot_name}" ]; then
++        if ! echo "${dataset_properties}" | grep -Eq "${rel_pool_root}/boot (on|noauto)"; then
++            return
++        fi
++    else
++        candidate_dataset=$(echo "${candidate_dataset}" | cut -d '@' -f1)
++    fi
++
++    validate_system_dataset "${candidate_dataset}" "boot" "${mntdir}" "${snapshot_name}"
++}
++
++# Given a filesystem or snapshot dataset, returns dataset|machine id|pretty name|last used
++# $1 is dataset we want information from
++# $2 is the temporary mount directory to use
++get_dataset_info() {
++    local dataset="$1"
++    local mntdir="$2"
++
++    local base_dataset="${dataset}"
++    local etc_dir="${mntdir}/etc"
++    local is_snapshot="false"
++    # For snapshot we extract the parent dataset
++    if echo "${dataset}" | grep -q '@'; then
++        base_dataset=$(echo "${dataset}" | cut -d '@' -f1)
++        is_snapshot="true"
++    fi
++
++    mount -o noatime,zfsutil -t zfs "${base_dataset}" "${mntdir}"
++
++    # read machine-id/os-release from /etc
++    etc_dir=$(get_system_directory "${dataset}" "etc" "true" "${mntdir}" "")
++    if [ -z  "${etc_dir}" ]; then
++        grub_warn "Ignoring ${dataset}"
++        mountpoint -q "${mntdir}/etc" && umount "${mntdir}/etc" || true
++        umount "${mntdir}"
++        return
++    fi
++
++    machine_id=""
++    if [ -f "${etc_dir}/machine-id" ]; then
++        machine_id=$(cat "${etc_dir}/machine-id")
++    fi
++    # We have to use a random temporary id if we don't have any machine-id file or if this one is empty
++    # (mostly the case of new installations before first boot).
++    # Let's use the dataset name directly for this.
++    # Consequence is that all datasets are then separated.
++    if [ -z "${machine_id}" ]; then
++        machine_id="${dataset}"
++    fi
++    pretty_name=$(. "${etc_dir}/os-release" && echo "${PRETTY_NAME}")
++    mountpoint -q "${mntdir}/etc" && umount "${mntdir}/etc" || true
++
++    # read available kernels from /boot
++    boot_dir="$(try_default_layout_bpool "${dataset}" "${mntdir}")"
++    if [ -z "${boot_dir}" ]; then
++        boot_dir=$(get_system_directory "${dataset}" "boot" "false" "${mntdir}" "${etc_dir}")
++    fi
++
++    if [ -z  "${boot_dir}" ]; then
++        grub_warn "Ignoring ${dataset}"
++        mountpoint -q "${mntdir}/boot" && umount "${mntdir}/boot" || true
++        umount "${mntdir}"
++        return
++    fi
++
++    machine="$(uname -m)"
++    case "${machine}" in
++        i?86) GENKERNEL_ARCH="x86" ;;
++        mips|mips64) GENKERNEL_ARCH="mips" ;;
++        mipsel|mips64el) GENKERNEL_ARCH="mipsel" ;;
++        arm*) GENKERNEL_ARCH="arm" ;;
++        *) GENKERNEL_ARCH="${machine}" ;;
++    esac
++
++    initrd_list=""
++    kernel_list=""
++    candidate_kernel_list="$(find "${boot_dir}" -maxdepth 1 -type f -regex '.*/\(vmlinuz\|vmlinux\|kernel\)-.*')"
++
++    # Perform a reverse version sort on the entire list.
++    # Temporarily replace the '.old' suffix by ' 1' and append ' 2' for all
++    # other files to order the '.old' files after their non-old counterpart
++    # in reverse-sorted order.
++
++    reverse_sorted_list=$(echo $candidate_kernel_list | tr ' ' '\n' | sed -e 's/\.old$/ 1/; / 1$/! s/$/ 2/' | version_sort -r | sed -e 's/ 1$/.old/; s/ 2$//')
++
++    for linux in ${reverse_sorted_list}; do
++        if ! grub_file_is_not_garbage "${linux}" ; then
++            continue
++        fi
++
++        linux_basename=$(basename "${linux}")
++        linux_dirname=$(dirname "${linux}")
++        version=$(echo "${linux_basename}" | sed -e "s,^[^0-9]*-,,g")
++        alt_version=$(echo "${version}" | sed -e "s,\.old$,,g")
++
++        gettext_printf "Found linux image: %s in %s\n" "${linux_basename}" "${dataset}" >&2
++
++        initrd=""
++        for i in "initrd.img-${version}" "initrd-${version}.img" "initrd-${version}.gz" \
++            "initrd-${version}" "initramfs-${version}.img" \
++            "initrd.img-${alt_version}" "initrd-${alt_version}.img" \
++            "initrd-${alt_version}" "initramfs-${alt_version}.img" \
++            "initramfs-genkernel-${version}" \
++            "initramfs-genkernel-${alt_version}" \
++            "initramfs-genkernel-${GENKERNEL_ARCH}-${version}" \
++            "initramfs-genkernel-${GENKERNEL_ARCH}-${alt_version}"; do
++            if test -e "${linux_dirname}/${i}" ; then
++                initrd="$i"
++                break
++            fi
++        done
++
++        if test -z "${initrd}" ; then
++            grub_warn "Couldn't find any valid initrd for dataset ${dataset}."
++            continue
++        fi
++
++        gettext_printf "Found initrd image: %s in %s\n" "${initrd}" "${dataset}" >&2
++
++        rel_linux_dirname=$(make_system_path_relative_to_its_root "${linux_dirname}")
++
++        initrd_list="${initrd_list}|${rel_linux_dirname}/${initrd}"
++        kernel_list="${kernel_list}|${rel_linux_dirname}/${linux_basename}"
++    done
++
++    initrd_list="${initrd_list#|}"
++    kernel_list="${kernel_list#|}"
++
++    initrd_device=$(${grub_probe} --target=device "${boot_dir}" | head -1)
++
++    mountpoint -q "${mntdir}/boot" && umount "${mntdir}/boot" || true
++    # We needed to look in / for snapshots on root dataset, umount there before zfs lazily unmount it
++    case "${boot_dir}" in /boot/.zfs/snapshot/*)
++        umount "${boot_dir}" || true
++        ;;
++    esac
++
++    # for zsys snapshots: we want to know which kernel we successful last booted with
++    last_booted_kernel=$(zfs get -H com.ubuntu.zsys:last-booted-kernel "${dataset}" | awk -v FS='\t' '{print $3}')
++
++    # snapshot: last_used is dataset creation time
++    if [ "${is_snapshot}" = "true" ]; then
++        last_used="$(zfs get -pH creation "${dataset}" | awk -F '\t' '{print $3}')"
++    # otherwise, last_used is manually marked at boot/shutdown on a root dataset for zsys
++    else
++        # if current system, take current time
++        if zfs mount | awk '/[ \t]+\/$/ {print $1}' | grep -q "${dataset}"; then
++            last_used=$(date +%s)
++        else
++            last_used=$(zfs get -H com.ubuntu.zsys:last-used "${dataset}" | awk '{print $3}')
++            # case of non zsys, or zsys without annotation, take /etc/machine-id stat (as we mounted with noatime).
++            # However, as systems can be relatime, if system is current mounted one, set current time (case of clone + reboot
++            # within the same d).
++            if [ "${last_used}" = "-" ]; then
++                last_used=$(stat --printf="%X" "${mntdir}/etc/os-release")
++                if [ -f "${mntdir}/etc/machine-id" ]; then
++                    last_used=$(stat --printf="%X" "${mntdir}/etc/machine-id")
++                fi
++            fi
++        fi
++    fi
++
++    is_zsys=$(zfs get -H com.ubuntu.zsys:bootfs "${base_dataset}" | awk '{print $3}')
++
++    if [ -n "${initrd_list}" -a -n "${kernel_list}" ]; then
++        echo "${dataset}\t${is_zsys}\t${machine_id}\t${pretty_name}\t${last_used}\t${initrd_device}\t${initrd_list}\t${kernel_list}\t${last_booted_kernel}"
++    else
++        grub_warn "didn't find any valid initrd or kernel."
++    fi
++
++    umount "${mntdir}" || true
++    # We needed to look in / for snapshots on root dataset, umount the snapshot for etc before zfs lazily unmount it
++    # This process only needs to run if the snapshot contains an .../etc path,
++    #  otherwise the build process may silently fail and produce no kernel lines in grub.cfg
++    if [ -e "${etc_dir}" ]; then
++        case "${etc_dir}" in /.zfs/snapshot/*/etc)
++            snapshot_path="$(findmnt -n -o TARGET -T "${etc_dir}")"
++            umount "${snapshot_path}" || true
++            ;;
++        esac
++    fi
++}
++
++# Scan available boot options and returns in a formatted list
++# $1 is the temporary mount directory to use
++bootlist() {
++    local mntdir="$1"
++    local boot_list=""
++
++    for dataset in $(get_root_datasets); do
++        # get information from current root dataset
++        boot_list="${boot_list}$(get_dataset_info "${dataset}" ${mntdir})\n"
++
++        # get information from snapshots of this root dataset
++        snapshots="$(zfs list -H -o name -t snapshot "${dataset}"|while read snapshot_dataset; do
++            get_dataset_info "${snapshot_dataset}" ${mntdir}
++        done)"
++        [ -n "${snapshots}" ] && boot_list="${boot_list}${snapshots}\n"
++    done
++    echo "${boot_list}"
++}
++
++
++# Order machine ids by last_used from their main entry
++get_machines_sorted() {
++    local bootlist="$1"
++
++    local machineids="$(echo "${bootlist}" | awk '{print $3}' | sort -u)"
++    for machineid in ${machineids}; do
++        echo "${bootlist}" | awk 'BEGIN{FS="\t"} $1 !~ /.*@.*/  {print $5, $3}' | sort -nr | grep -E "[^^]\b${machineid}\b" | head -1
++    done | sort -nr | awk '{print $2}'
++}
++
++# Sort entries by last_used for a given machineid
++sort_entries_for_machineid() {
++    local bootlist="$1"
++    local machineid="$2"
++
++    tab="$(printf '\t')"
++    echo "${bootlist}" | grep -E "[^^]\b${machineid}\b" | sort -k5,5r -k1,1 -t "${tab}"
++}
++
++# Return main entry index
++get_main_entry() {
++    local entries="$1"
++
++    echo "${entries}" | awk 'BEGIN{FS="\t"} $1 !~ /.*@.*/  {print}' | head -1
++}
++
++# Return specific field at index from entry
++get_field_from_entry() {
++    local entry="$1"
++    local index="$2"
++
++    echo "${entry}" | awk "BEGIN{FS=\"\t\"} {print \$$index}"
++}
++
++# Get the main entry metadata
++main_entry_meta() {
++    local main_entry="$1"
++
++    initrd=$(get_field_from_entry "${main_entry}" 7 | cut -d'|' -f1)
++    kernel=$(get_field_from_entry "${main_entry}" 8 | cut -d'|' -f1)
++
++    # Take first element (most recent entry) which is not a snapshot
++    echo "${main_entry}" | awk "BEGIN{ FS=\"\t\"; OFS=\"\t\"} {print \$3, \$2, \"main\", \$4, \$1, \$6, \"$initrd\", \"$kernel\"}"
++}
++
++# Get advanced entries metadata
++advanced_entries_meta() {
++    local main_entry="$1"
++
++    last_used_kernel="$(get_field_from_entry "${main_entry}" 9 )"
++
++    # We must align initrds with kernels.
++    # Adds initrds to the stack then pop them 1 by 1 as we process the kernels
++    oldIFS="$IFS"
++    export IFS='|'
++    set -- $(get_field_from_entry "${main_entry}" 7)
++    for kernel in $(get_field_from_entry "${main_entry}" 8); do
++        # get initrd and pop to the next one
++        initrd="$1"; shift
++
++        was_last_used_kernel="false"
++        kernel_basename=$(basename "${kernel}")
++        if [ "${kernel_basename}" = "${last_used_kernel}" ]; then
++            was_last_used_kernel="true"
++        fi
++
++        echo "${main_entry}" | awk "BEGIN{ FS=\"\t\"; OFS=\"\t\"}    {print \$3, \$2, \"advanced\", \$4, \$1, \$6, \"$initrd\", \"$kernel\", \"$was_last_used_kernel\"}"
++    done
++    IFS="$oldIFS"
++}
++
++# Get history metadata
++history_entries_meta() {
++    local entries="$1"
++    local main_dataset_name="$2"
++    local main_dataset_releasename="$3"
++
++    if [ -z "${entries}" ]; then
++        return
++    fi
++
++    # Traverse snapshots and clones
++    echo "${entries}" | while read entry; do
++        name=""
++        # Compute snapshot/filesystem dataset name
++        snap_dataset_name="$(get_field_from_entry "${entry}" 1)"
++
++        snapname="${snap_dataset_name##*@}"
++        # If, this is a clone, take what is after main_dataset_name
++        if [ "${snapname}" = "${snap_dataset_name}" ]; then
++            snapname="${snap_dataset_name##${main_dataset_name}_}"
++
++            # Handle manual user clone (not prefixed by "main_dataset_name")
++            snapname="${snapname##*/}"
++        fi
++
++        # We keep the snapname only if it is not only a zsys auto snapshot
++        if echo "${snapname}" | grep -q "^autozsys_"; then
++            snapname=""
++        fi
++
++        # We store the release only if it different from main dataset release (snapshot before a release upgrade)
++        releasename=$(get_field_from_entry "${entry}" 4)
++        if [ "${releasename}" = "${main_dataset_releasename}" ]; then
++            releasename=""
++        fi
++
++        # Snapshot date
++        foo="$(get_field_from_entry "${entry}" 5)"
++        snapdate="$(date -d @$(get_field_from_entry "${entry}" 5) "+%x @ %H:%M")"
++
++        # For snapshots/clones the name can have the following formats:
++        # 	<DATE>: autozsys, same release
++        #   <OLD_RELEASE> on <DATE>: autozsys, different release
++        #   <SNAPNAME> on <DATE>: Manual snapshot, same release
++        #   <SNAPNAME>, <OLD_RELEASE> on <DATE>: Manual snapshot, different release
++        if [ "${snapname}" = "" -a "${releasename}" = "" ]; then
++            name="${snapdate}"
++        elif [ "${snapname}" = "" -a "${releasename}" != "" ]; then
++            name=$(gettext_printf "%s on %s" "${releasename}" "${snapdate}")
++        elif [ "${snapname}" != "" -a "${releasename}" = "" ]; then
++            name=$(gettext_printf "%s on %s" "${snapname}" "${snapdate}")
++        else # snapname != "" && releasename != ""
++            name=$(gettext_printf "%s, %s on %s" "${snapname}" "${releasename}" "${snapdate}")
++        fi
++
++        # Choose kernel and initrd if the snapshot was booted successfully on a specific kernel before
++        # Take latest by default if no match
++        initrd=$(get_field_from_entry "${entry}" 7 | cut -d'|' -f1)
++        kernel=$(get_field_from_entry "${entry}" 8 | cut -d'|' -f1)
++        last_used_kernel="$(get_field_from_entry "${entry}" 9)"
++
++        # We must align initrds with kernels.
++        # Adds initrds to the stack then pop them 1 by 1 as we process the kernels
++        oldIFS="$IFS"
++        export IFS='|'
++        set -- $(get_field_from_entry "${entry}" 7)
++        for k in $(get_field_from_entry "${entry}" 8); do
++            # get initrd and pop to the next one
++            candidate_initrd="$1"; shift
++
++            kernel_basename=$(basename -- "${k}")
++            if [ "${kernel_basename}" = "${last_used_kernel}" ]; then
++                kernel="${k}"
++                initrd="${candidate_initrd}"
++                break
++            fi
++        done
++        IFS="$oldIFS"
++
++        echo "${entry}" | awk "BEGIN{ FS=\"\t\"; OFS=\"\t\"}    {print \$3, \$2, \"history\", \"$name\", \$1, \$6, \"$initrd\", \"$kernel\"}"
++    done
++}
++
++# Generate metadata from a BOOTLIST that will subsequently used to generate
++# the final grub menu entries
++generate_grub_menu_metadata() {
++    local bootlist="$1"
++
++    # Sort machineids by last_used from their main entry
++    for machineid in $(get_machines_sorted "${bootlist}"); do
++        entries="$(sort_entries_for_machineid "${bootlist}" ${machineid})"
++        main_entry="$(get_main_entry "${entries}")"
++
++        if [ -z "$main_entry" ]; then
++            continue
++        fi
++
++        main_entry_meta "${main_entry}"
++        advanced_entries_meta "${main_entry}"
++
++        main_dataset_name="$(get_field_from_entry "${main_entry}" 1)"
++        main_dataset_releasename="$(get_field_from_entry "${main_entry}" 4)"
++        # grep -v errcode != 0 if there is no match. || true to not fail with -e
++        other_entries="$(echo "${entries}" | grep -v "${main_entry}" || true)"
++        history_entries_meta "${other_entries}" "${main_dataset_name}" "${main_dataset_releasename}"
++    done
++}
++
++# Cache for prepare_grub_to_access_device call
++# $1: boot_device
++# $2: submenu_level
++prepare_grub_to_access_device_cached() {
++    local boot_device="$1"
++    local submenu_level="$2"
++
++    local boot_device_idx="$(echo ${boot_device} | tr '/' '_')"
++
++    cache_file="${ZFSTMP}/$(echo boot_device${boot_device_idx})"
++    if [ ! -f "${cache_file}" ]; then
++        set +u
++        echo "$(prepare_grub_to_access_device "${boot_device}")" > "${cache_file}"
++        set -u
++        for i in 0 1 2; do
++            submenu_indentation="$(printf %${i}s | tr " " "${grub_tab}")"
++            sed "s/^/${submenu_indentation}	/" "${cache_file}" > "${cache_file}--${i}"
++        done
++    fi
++
++    cat "${cache_file}--${submenu_level}"
++}
++
++
++# Print a grub menu entry
++zfs_linux_entry () {
++    submenu_level="$1"
++    title="$2"
++    type="$3"
++    dataset="$4"
++    boot_device="$5"
++    initrd="$6"
++    kernel="$7"
++    kernel_additional_args="${8:-}"
++
++    kernel_version=$(basename "${kernel}" | sed -e "s,^[^0-9]*-,,g")
++    submenu_indentation="$(printf %${submenu_level}s | tr " " "${grub_tab}")"
++
++    echo "${submenu_indentation}menuentry '$(echo "${title}" | grub_quote)' ${CLASS} \${menuentry_id_option} 'gnulinux-${dataset}-${kernel_version}' {"
++
++    if [ "${type}" != "recovery" ] ; then
++        GRUB_SAVEDEFAULT=${GRUB_SAVEDEFAULT:-}
++        default_entry="$(save_default_entry)"
++        if [ -n "${default_entry}" ]; then
++            echo "${submenu_indentation}	${default_entry}"
++        fi
++    fi
++
++    # Use ELILO's generic "efifb" when it's known to be available.
++    # FIXME: We need an interface to select vesafb in case efifb can't be used.
++    if [ "${GRUB_GFXPAYLOAD_LINUX}" = "" ]; then
++        echo "${submenu_indentation}	load_video"
++        if grep -qx "CONFIG_FB_EFI=y" "${config}" 2> /dev/null \
++            && grep -qx "CONFIG_VT_HW_CONSOLE_BINDING=y" "${config}" 2> /dev/null; then
++            echo "${submenu_indentation}	set gfxpayload=keep"
++        fi
++    else
++        if [ "${GRUB_GFXPAYLOAD_LINUX}" != "text" ]; then
++            echo "${submenu_indentation}	load_video"
++        fi
++        echo "${submenu_indentation}	set gfxpayload=\${linux_gfx_mode}"
++    fi
++
++    echo "${submenu_indentation}	insmod gzio"
++
++    echo "$(prepare_grub_to_access_device_cached "${boot_device}" "${submenu_level}")"
++
++    echo "${submenu_indentation}	echo $(gettext_printf "Loading Linux %s ..." ${kernel_version} | grub_quote)"
++
++    linux_default_args="${GRUB_CMDLINE_LINUX} ${GRUB_CMDLINE_LINUX_DEFAULT}"
++    if [ ${type} = "recovery" ]; then
++        linux_default_args="single ${GRUB_CMDLINE_LINUX}"
++    fi
++
++    # echo in echo trims end of line spaces
++    echo "${submenu_indentation}	linux	\"${kernel}\" root=ZFS=\"${dataset}\" ro $(echo ${linux_default_args} ${kernel_additional_args})"
++
++    echo "${submenu_indentation}	echo '$(gettext_printf "Loading initial ramdisk ..." | grub_quote)'"
++    echo "${submenu_indentation}	initrd	\"${initrd}\""
++    echo "${submenu_indentation}}"
++}
++
++# Generate a GRUB Menu from menu meta data
++# $1 menu metadata
++generate_grub_menu() {
++    local menu_metadata="$1"
++    local last_section=""
++    local main_dataset_name=""
++    local main_dataset=""
++    local have_zsys=""
++
++    if [ -z "${menu_metadata}" ]; then
++        return
++    fi
++
++    CLASS="--class gnu-linux --class gnu --class os"
++
++    if [ "${GRUB_DISTRIBUTOR}" = "" ] ; then
++        OS=GNU/Linux
++    else
++        OS="${GRUB_DISTRIBUTOR} GNU/Linux"
++        CLASS="--class $(echo ${GRUB_DISTRIBUTOR} | tr 'A-Z' 'a-z' | cut -d' ' -f1 | LC_ALL=C sed 's,[^[:alnum:]_],_,g') ${CLASS}"
++    fi
++
++
++    # IFS is set to TAB (ASCII 0x09)
++    echo "${menu_metadata}" |
++    {
++        at_least_one_entry=0
++        have_zsys="$(which zsysd || true)"
++        while IFS="$(printf '\t')" read -r machineid iszsys section name dataset device initrd kernel opt; do
++
++            # Disable history for non zsys system or if systems is a zsys one and zsys isn't installed.
++            # In pure zfs systems, we identified multiple issues due to the mount generator
++            # in upstream zfs which makes it incompatible. Don't show history for now.
++            if [ "${section}" = "history" ]; then
++                if [ "${iszsys}" != "yes" ] || [ "${iszsys}" = "yes" -a -z "${have_zsys}" ]; then
++                    continue
++                fi
++            fi
++
++            if [ "${last_section}" != "${section}" -a -n "${last_section}" ]; then
++                # Close previous section wrapper
++                if [ "${last_section}" != "main" ]; then
++                    echo "}"    # Add grub_tabs
++                    at_least_one_entry=0
++                fi
++            fi
++
++            case "${section}" in
++                main)
++                    title="${name}"
++                    main_dataset_name="${name}"
++                    main_dataset="${dataset}"
++
++                    zfs_linux_entry 0 "${title}" "simple" "${dataset}" "${device}" "${initrd}" "${kernel}"
++                    at_least_one_entry=1
++                ;;
++                advanced)
++                    # normal and recovery entries for a given kernel
++                    if [ "${last_section}" != "${section}" ]; then
++                        echo "submenu '$(gettext_printf "Advanced options for %s" "${main_dataset_name}" | grub_quote)' \${menuentry_id_option} 'gnulinux-advanced-${main_dataset}' {"
++                    fi
++
++                    last_booted_kernel_marker=""
++                    if [ "${opt}" = "true" ]; then
++                        last_booted_kernel_marker="* "
++                    fi
++
++                    kernel_version=$(basename "${kernel}" | sed -e "s,^[^0-9]*-,,g")
++                    title="$(gettext_printf "%s%s, with Linux %s" "${last_booted_kernel_marker}" "${name}" "${kernel_version}")"
++                    zfs_linux_entry 1 "${title}" "advanced" "${dataset}" "${device}" "${initrd}" "${kernel}"
++
++                    GRUB_DISABLE_RECOVERY=${GRUB_DISABLE_RECOVERY:-}
++                    if [ "${GRUB_DISABLE_RECOVERY}" != "true" ]; then
++                        title="$(gettext_printf "%s%s, with Linux %s (recovery mode)" "${last_booted_kernel_marker}" "${name}" "${kernel_version}")"
++                        zfs_linux_entry 1 "${title}" "recovery" "${dataset}" "${device}" "${initrd}" "${kernel}"
++                    fi
++                    at_least_one_entry=1
++                ;;
++                history)
++                    # Revert to a snapshot
++                    # revert system, revert system and user data and associated recovery entries
++                    if [ "${last_section}" != "${section}" ]; then
++                        echo "submenu '$(gettext_printf "History for %s" "${main_dataset_name}" | grub_quote)' \${menuentry_id_option} 'gnulinux-history-${main_dataset}' {"
++                    fi
++
++                    if [ "${iszsys}" = "yes" ]; then
++                        title="$(gettext_printf "Revert to %s" "${name}" | grub_quote)"
++                    else
++                        title="$(gettext_printf "Boot on %s" "${name}" | grub_quote)"
++                    fi
++                    echo "	submenu '${title}' \${menuentry_id_option} 'gnulinux-history-${dataset}' {"
++
++                    # Zsys only: let revert system without destroying snapshots
++                    if [ "${iszsys}" = "yes" ]; then
++                        title="$(gettext_printf "Revert system only")"
++                        zfs_linux_entry 2 "${title}" "simple" "${dataset}" "${device}" "${initrd}" "${kernel}"
++                        title="$(gettext_printf "Revert system and user data")"
++                        zfs_linux_entry 2 "${title}" "simple" "${dataset}" "${device}" "${initrd}" "${kernel}" "zsys-revert=userdata"
++
++                        GRUB_DISABLE_RECOVERY="${GRUB_DISABLE_RECOVERY:-}"
++                        if [ "${GRUB_DISABLE_RECOVERY}" != "true" ]; then
++                            title="$(gettext_printf "Revert system only (recovery mode)")"
++                            zfs_linux_entry 2 "${title}" "recovery" "${dataset}" "${device}" "${initrd}" "${kernel}"
++                            title="$(gettext_printf "Revert system and user data (recovery mode)")"
++                            zfs_linux_entry 2 "${title}" "recovery" "${dataset}" "${device}" "${initrd}" "${kernel}" "zsys-revert=userdata"
++                        fi
++                    # Non-zsys: boot temporarly on snapshots or rollback (destroying intermediate snapshots)
++                    else
++                        title="$(gettext_printf "One time boot")"
++                        zfs_linux_entry 2 "${title}" "simple" "${dataset}" "${device}" "${initrd}" "${kernel}"
++
++                        GRUB_DISABLE_RECOVERY="${GRUB_DISABLE_RECOVERY:-}"
++                        if [ "${GRUB_DISABLE_RECOVERY}" != "true" ]; then
++                            title="$(gettext_printf "One time boot (recovery mode)")"
++                            zfs_linux_entry 2 "${title}" "recovery" "${dataset}" "${device}" "${initrd}" "${kernel}"
++                        fi
++
++                        title="$(gettext_printf "Revert system (all intermediate snapshots will be destroyed)")"
++                        zfs_linux_entry 2 "${title}" "simple" "${dataset}" "${device}" "${initrd}" "${kernel}" "rollback=yes"
++                    fi
++
++                    echo "	}"
++                    at_least_one_entry=1
++                ;;
++                *)
++                    grub_warn "unknown section: ${section}. Ignoring entry ${name} for ${dataset}"
++                ;;
++            esac
++            last_section="${section}"
++        done
++
++        if [ "${at_least_one_entry}" -eq 1 ]; then
++            echo "}"
++        fi
++    }
++}
++
++# don't add trailing newline of variable is empty
++# $1: content to write
++# $2: destination file
++trailing_newline_if_not_empty() {
++    content="$1"
++    dest="$2"
++
++    if [ -z "${content}" ]; then
++        rm -f "${dest}"
++        touch "${dest}"
++        return
++    fi
++    echo "${content}" > "${dest}"
++}
++
++
++GRUB_LINUX_ZFS_TEST="${GRUB_LINUX_ZFS_TEST:-}"
++case "${GRUB_LINUX_ZFS_TEST}" in
++    bootlist)
++        # Import all available pools on the system and return imported list
++        imported_pools=$(import_pools)
++        boot_list="$(bootlist ${MNTDIR})"
++        trailing_newline_if_not_empty "${boot_list}" "${GRUB_LINUX_ZFS_TEST_OUTPUT}"
++        break
++    ;;
++    metamenu)
++        boot_list="$(cat ${GRUB_LINUX_ZFS_TEST_INPUT})"
++        menu_metadata="$(generate_grub_menu_metadata "${boot_list}")"
++        trailing_newline_if_not_empty "${menu_metadata}" "${GRUB_LINUX_ZFS_TEST_OUTPUT}"
++        break
++    ;;
++    grubmenu)
++        menu_metadata="$(cat ${GRUB_LINUX_ZFS_TEST_INPUT})"
++        grub_menu=$(generate_grub_menu "${menu_metadata}")
++        trailing_newline_if_not_empty "${grub_menu}" "${GRUB_LINUX_ZFS_TEST_OUTPUT}"
++        break
++    ;;
++    *)
++        # Import all available pools on the system and return imported list
++        imported_pools=$(import_pools)
++        # Generate the complete list of boot entries
++        boot_list="$(bootlist ${MNTDIR})"
++        # Create boot menu meta data from the list of boot entries
++        menu_metadata="$(generate_grub_menu_metadata "${boot_list}")"
++        # Create boot menu meta data from the list of boot entries
++        grub_menu="$(generate_grub_menu "${menu_metadata}")"
++        if [ -n "${grub_menu}" ]; then
++            # We want the trailing newline as a marker will be added
++            echo "${grub_menu}"
++        fi
++    ;;
++esac
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-gfxpayload-dynamic.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-gfxpayload-dynamic.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-gfxpayload-dynamic.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-gfxpayload-dynamic.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,95 @@
+From: Julian Andres Klode <julian.klode@canonical.com>
+Date: Tue, 30 Nov 2021 17:23:41 +0100
+Subject: Add configure option to enable gfxpayload=keep dynamically
+
+Set GRUB_GFXPAYLOAD_LINUX=keep unless it's known to be unsupported on
+the current hardware.  See
+https://blueprints.launchpad.net/ubuntu/+spec/packageselection-foundations-n-grub2-boot-framebuffer.
+
+Author: Colin Watson <cjwatson@ubuntu.com>
+Forwarded: no
+Last-Update: 2019-05-25
+
+Patch-Name: gfxpayload-dynamic.patch
+---
+ util/grub.d/10_linux_zfs.in | 46 ++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 43 insertions(+), 3 deletions(-)
+
+diff --git a/util/grub.d/10_linux_zfs.in b/util/grub.d/10_linux_zfs.in
+index 4782c8c..b961e87 100755
+--- a/util/grub.d/10_linux_zfs.in
++++ b/util/grub.d/10_linux_zfs.in
+@@ -22,6 +22,7 @@ datarootdir="@datarootdir@"
+ ubuntu_recovery="@UBUNTU_RECOVERY@"
+ quiet_boot="@QUIET_BOOT@"
+ quick_boot="@QUICK_BOOT@"
++gfxpayload_dynamic="@GFXPAYLOAD_DYNAMIC@"
+ 
+ . "${pkgdatadir}/grub-mkconfig_lib"
+ 
+@@ -732,6 +733,41 @@ generate_grub_menu_metadata() {
+     done
+ }
+ 
++# Print the configuration part common to all sections
++# Note:
++#   If 10_linux runs these part will be defined twice in grub configuration
++print_menu_prologue() {
++    # Use ELILO's generic "efifb" when it's known to be available.
++    # FIXME: We need an interface to select vesafb in case efifb can't be used.
++    GRUB_GFXPAYLOAD_LINUX="${GRUB_GFXPAYLOAD_LINUX:-}"
++    if [ "${GRUB_GFXPAYLOAD_LINUX}" != "" ] || [ "${gfxpayload_dynamic}" = 0 ]; then
++        echo "set linux_gfx_mode=${GRUB_GFXPAYLOAD_LINUX}"
++    else
++        cat << EOF
++if [ "\${recordfail}" != 1 ]; then
++  if [ -e \${prefix}/gfxblacklist.txt ]; then
++    if hwmatch \${prefix}/gfxblacklist.txt 3; then
++      if [ \${match} = 0 ]; then
++        set linux_gfx_mode=keep
++      else
++        set linux_gfx_mode=text
++      fi
++    else
++      set linux_gfx_mode=text
++    fi
++  else
++    set linux_gfx_mode=keep
++  fi
++else
++  set linux_gfx_mode=text
++fi
++EOF
++    fi
++    cat << EOF
++export linux_gfx_mode
++EOF
++}
++
+ # Cache for prepare_grub_to_access_device call
+ # $1: boot_device
+ # $2: submenu_level
+@@ -792,9 +828,11 @@ zfs_linux_entry () {
+         if [ "${GRUB_GFXPAYLOAD_LINUX}" != "text" ]; then
+             echo "${submenu_indentation}	load_video"
+         fi
+-        if [ "${ubuntu_recovery}" = 0 ] || [ "${type}" != "recovery" ]; then
+-            echo "${submenu_indentation}	set gfxpayload=\${linux_gfx_mode}"
+-        fi
++    fi
++
++    if ([ "${ubuntu_recovery}" = 0 ] || [ "${type}" != "recovery" ]) && \
++        ([ "${GRUB_GFXPAYLOAD_LINUX}" != "" ] || [ "${gfxpayload_dynamic}" = 1 ]); then
++        echo "${submenu_indentation}	set gfxpayload=\${linux_gfx_mode}"
+     fi
+ 
+     echo "${submenu_indentation}	insmod gzio"
+@@ -858,6 +896,8 @@ generate_grub_menu() {
+         GRUB_CMDLINE_LINUX_RECOVERY="${GRUB_CMDLINE_LINUX_RECOVERY} nomodeset"
+     fi
+ 
++    print_menu_prologue
++
+     # IFS is set to TAB (ASCII 0x09)
+     echo "${menu_metadata}" |
+     {
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-gfxpayload-keep-default.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-gfxpayload-keep-default.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-gfxpayload-keep-default.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-gfxpayload-keep-default.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,38 @@
+From: Didier Roche <didrocks@ubuntu.com>
+Date: Tue, 31 Mar 2020 15:09:45 +0200
+Subject: Disable gfxpayload=keep by default
+
+Setting gfxpayload=keep has been known to cause efifb to be
+inappropriately enabled.  In any case, with the current Linux kernel the
+result of this option is that early kernelspace will be unable to print
+anything to the console, so (for example) if boot fails and you end up
+dumped to an initramfs prompt, you won't be able to see anything on the
+screen.  As such it shouldn't be enabled by default in Debian, no matter
+what kernel options are enabled.
+
+gfxpayload=keep is a good idea but rather ahead of its time ...
+
+Bug-Debian: http://bugs.debian.org/567245
+Forwarded: no
+Last-Update: 2013-12-25
+
+Patch-Name: gfxpayload-keep-default.patch
+---
+ util/grub.d/10_linux_zfs.in | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/util/grub.d/10_linux_zfs.in b/util/grub.d/10_linux_zfs.in
+index de30605..4782c8c 100755
+--- a/util/grub.d/10_linux_zfs.in
++++ b/util/grub.d/10_linux_zfs.in
+@@ -788,10 +788,6 @@ zfs_linux_entry () {
+     # FIXME: We need an interface to select vesafb in case efifb can't be used.
+     if [ "${GRUB_GFXPAYLOAD_LINUX}" = "" ]; then
+         echo "${submenu_indentation}	load_video"
+-        if grep -qx "CONFIG_FB_EFI=y" "${config}" 2> /dev/null \
+-            && grep -qx "CONFIG_VT_HW_CONSOLE_BINDING=y" "${config}" 2> /dev/null; then
+-            echo "${submenu_indentation}	set gfxpayload=keep"
+-        fi
+     else
+         if [ "${GRUB_GFXPAYLOAD_LINUX}" != "text" ]; then
+             echo "${submenu_indentation}	load_video"
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,32 @@
+From: Ian Campbell <ijc@debian.org>
+Date: Sun, 30 Nov 2014 12:12:52 +0000
+Subject: Arrange to insmod xzio and lzopio when booting a kernel as a Xen
+ guest
+
+This is needed in case the Linux kernel is compiled with CONFIG_KERNEL_XZ or
+CONFIG_KERNEL_LZO rather than CONFIG_KERNEL_GZ (gzio is already loaded by
+grub.cfg today).
+
+Signed-off-by: Ian Campbell <ijc@debian.org>
+
+Bug-Debian: https://bugs.debian.org/755256
+Forwarded: http://lists.gnu.org/archive/html/grub-devel/2014-11/msg00091.html
+Last-Update: 2014-11-30
+
+Patch-Name: insmod-xzio-and-lzopio-on-xen.patch
+---
+ util/grub.d/10_linux_zfs.in | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/util/grub.d/10_linux_zfs.in b/util/grub.d/10_linux_zfs.in
+index edf2bed..99d33da 100755
+--- a/util/grub.d/10_linux_zfs.in
++++ b/util/grub.d/10_linux_zfs.in
+@@ -854,6 +854,7 @@ zfs_linux_entry () {
+     fi
+ 
+     echo "${submenu_indentation}	insmod gzio"
++    echo "${submenu_indentation}	if [ \"\${grub_platform}\" = xen ]; then insmod xzio; insmod lzopio; fi"
+ 
+     echo "$(prepare_grub_to_access_device_cached "${boot_device}" "${submenu_level}")"
+ 
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-mkconfig-recovery-title.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-mkconfig-recovery-title.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-mkconfig-recovery-title.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-mkconfig-recovery-title.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,49 @@
+From: Julian Andres Klode <julian.klode@canonical.com>
+Date: Tue, 30 Nov 2021 17:24:15 +0100
+Subject: Add GRUB_RECOVERY_TITLE option
+
+This allows the controversial "recovery mode" text to be customised.
+
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1240360
+Forwarded: no
+Last-Update: 2013-12-25
+
+Patch-Name: mkconfig-recovery-title.patch
+---
+ util/grub.d/10_linux_zfs.in | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/util/grub.d/10_linux_zfs.in b/util/grub.d/10_linux_zfs.in
+index 5bbda03..edf2bed 100755
+--- a/util/grub.d/10_linux_zfs.in
++++ b/util/grub.d/10_linux_zfs.in
+@@ -974,7 +974,7 @@ generate_grub_menu() {
+ 
+                     GRUB_DISABLE_RECOVERY=${GRUB_DISABLE_RECOVERY:-}
+                     if [ "${GRUB_DISABLE_RECOVERY}" != "true" ]; then
+-                        title="$(gettext_printf "%s%s, with Linux %s (recovery mode)" "${last_booted_kernel_marker}" "${name}" "${kernel_version}")"
++                        title="$(gettext_printf "%s%s, with Linux %s (%s)" "${last_booted_kernel_marker}" "${name}" "${kernel_version}" "$(gettext "${GRUB_RECOVERY_TITLE}")")"
+                         zfs_linux_entry 1 "${title}" "recovery" "${dataset}" "${device}" "${initrd}" "${kernel}"
+                     fi
+                     at_least_one_entry=1
+@@ -1002,9 +1002,9 @@ generate_grub_menu() {
+ 
+                         GRUB_DISABLE_RECOVERY="${GRUB_DISABLE_RECOVERY:-}"
+                         if [ "${GRUB_DISABLE_RECOVERY}" != "true" ]; then
+-                            title="$(gettext_printf "Revert system only (recovery mode)")"
++                            title="$(gettext_printf "Revert system only (%s)" "$(gettext "${GRUB_RECOVERY_TITLE}")")"
+                             zfs_linux_entry 2 "${title}" "recovery" "${dataset}" "${device}" "${initrd}" "${kernel}"
+-                            title="$(gettext_printf "Revert system and user data (recovery mode)")"
++                            title="$(gettext_printf "Revert system and user data (%s)" "$(gettext "${GRUB_RECOVERY_TITLE}")")"
+                             zfs_linux_entry 2 "${title}" "recovery" "${dataset}" "${device}" "${initrd}" "${kernel}" "zsys-revert=userdata"
+                         fi
+                     # Non-zsys: boot temporarly on snapshots or rollback (destroying intermediate snapshots)
+@@ -1014,7 +1014,7 @@ generate_grub_menu() {
+ 
+                         GRUB_DISABLE_RECOVERY="${GRUB_DISABLE_RECOVERY:-}"
+                         if [ "${GRUB_DISABLE_RECOVERY}" != "true" ]; then
+-                            title="$(gettext_printf "One time boot (recovery mode)")"
++                            title="$(gettext_printf "One time boot (%s)" "$(gettext "${GRUB_RECOVERY_TITLE}")")"
+                             zfs_linux_entry 2 "${title}" "recovery" "${dataset}" "${device}" "${initrd}" "${kernel}"
+                         fi
+ 
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-mkconfig-signed-kernel.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-mkconfig-signed-kernel.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-mkconfig-signed-kernel.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-mkconfig-signed-kernel.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,93 @@
+From: Julian Andres Klode <julian.klode@canonical.com>
+Date: Tue, 30 Nov 2021 17:02:37 +0100
+Subject: zsys: Generate configuration for signed UEFI kernels if available
+
+Forwarded: no
+Last-Update: 2013-12-25
+
+Patch-Name: mkconfig-signed-kernel.patch
+---
+ util/grub.d/10_linux_zfs.in | 35 +++++++++++++++++++++++++++++++++--
+ 1 file changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/util/grub.d/10_linux_zfs.in b/util/grub.d/10_linux_zfs.in
+index 893c73f..de30605 100755
+--- a/util/grub.d/10_linux_zfs.in
++++ b/util/grub.d/10_linux_zfs.in
+@@ -20,6 +20,8 @@ set -e
+ prefix="@prefix@"
+ datarootdir="@datarootdir@"
+ ubuntu_recovery="@UBUNTU_RECOVERY@"
++quiet_boot="@QUIET_BOOT@"
++quick_boot="@QUICK_BOOT@"
+ 
+ . "${pkgdatadir}/grub-mkconfig_lib"
+ 
+@@ -338,6 +340,16 @@ try_default_layout_bpool() {
+     validate_system_dataset "${candidate_dataset}" "boot" "${mntdir}" "${snapshot_name}"
+ }
+ 
++# Return if secure boot is enabled on that system
++is_secure_boot_enabled() {
++    if LANG=C mokutil --sb-state 2>/dev/null | grep -qi enabled; then
++        echo "true"
++        return
++    fi
++    echo "false"
++    return
++}
++
+ # Given a filesystem or snapshot dataset, returns dataset|machine id|pretty name|last used
+ # $1 is dataset we want information from
+ # $2 is the temporary mount directory to use
+@@ -417,6 +429,17 @@ get_dataset_info() {
+             continue
+         fi
+ 
++        # Filters entry if efi/non efi.
++        # Note that for now we allow kernel without .efi.signed as those are signed kernel
++        # on ubuntu, loaded by the shim.
++        case "${linux}" in
++            *.efi.signed)
++                if [ "$(is_secure_boot_enabled)" = "false" ]; then
++                    continue
++                fi
++            ;;
++        esac
++
+         linux_basename=$(basename "${linux}")
+         linux_dirname=$(dirname "${linux}")
+         version=$(echo "${linux_basename}" | sed -e "s,^[^0-9]*-,,g")
+@@ -749,6 +772,10 @@ zfs_linux_entry () {
+ 
+     echo "${submenu_indentation}menuentry '$(echo "${title}" | grub_quote)' ${CLASS} \${menuentry_id_option} 'gnulinux-${dataset}-${kernel_version}' {"
+ 
++    if [ "${quick_boot}" = 1 ]; then
++        echo "${submenu_indentation}	recordfail"
++    fi
++
+     if [ "${type}" != "recovery" ] ; then
+         GRUB_SAVEDEFAULT=${GRUB_SAVEDEFAULT:-}
+         default_entry="$(save_default_entry)"
+@@ -778,7 +805,9 @@ zfs_linux_entry () {
+ 
+     echo "$(prepare_grub_to_access_device_cached "${boot_device}" "${submenu_level}")"
+ 
+-    echo "${submenu_indentation}	echo $(gettext_printf "Loading Linux %s ..." ${kernel_version} | grub_quote)"
++    if [ "${quiet_boot}" = 0 ] || [ "${type}" != simple ]; then
++        echo "${submenu_indentation}	echo $(gettext_printf "Loading Linux %s ..." ${kernel_version} | grub_quote)"
++    fi
+ 
+     linux_default_args="${GRUB_CMDLINE_LINUX} ${GRUB_CMDLINE_LINUX_DEFAULT}"
+     if [ ${type} = "recovery" ]; then
+@@ -788,7 +817,9 @@ zfs_linux_entry () {
+     # echo in echo trims end of line spaces
+     echo "${submenu_indentation}	linux	\"${kernel}\" root=ZFS=\"${dataset}\" ro $(echo ${linux_default_args} ${kernel_additional_args})"
+ 
+-    echo "${submenu_indentation}	echo '$(gettext_printf "Loading initial ramdisk ..." | grub_quote)'"
++    if [ "${quiet_boot}" = 0 ] || [ "${type}" != simple ]; then
++        echo "${submenu_indentation}	echo '$(gettext_printf "Loading initial ramdisk ..." | grub_quote)'"
++    fi
+     echo "${submenu_indentation}	initrd	\"${initrd}\""
+     echo "${submenu_indentation}}"
+ }
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-mkconfig-ubuntu-distributor.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-mkconfig-ubuntu-distributor.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-mkconfig-ubuntu-distributor.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-mkconfig-ubuntu-distributor.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,36 @@
+From: Mario Limonciello <Mario_Limonciello@dell.com>
+Date: Mon, 13 Jan 2014 12:13:14 +0000
+Subject: Remove GNU/Linux from default distributor string for Ubuntu
+
+Ubuntu is called "Ubuntu", not "Ubuntu GNU/Linux".
+
+Author: Colin Watson <cjwatson@debian.org>
+Author: Harald Sitter <apachelogger@kubuntu.org>
+Forwarded: not-needed
+Last-Update: 2013-12-25
+
+Patch-Name: mkconfig-ubuntu-distributor.patch
+---
+ util/grub.d/10_linux_zfs.in | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/util/grub.d/10_linux_zfs.in b/util/grub.d/10_linux_zfs.in
+index 27061af..893c73f 100755
+--- a/util/grub.d/10_linux_zfs.in
++++ b/util/grub.d/10_linux_zfs.in
+@@ -811,7 +811,14 @@ generate_grub_menu() {
+     if [ "${GRUB_DISTRIBUTOR}" = "" ] ; then
+         OS=GNU/Linux
+     else
+-        OS="${GRUB_DISTRIBUTOR} GNU/Linux"
++        case ${GRUB_DISTRIBUTOR} in
++            Ubuntu|Kubuntu)
++            OS="${GRUB_DISTRIBUTOR}"
++            ;;
++            *)
++            OS="${GRUB_DISTRIBUTOR} GNU/Linux"
++            ;;
++        esac
+         CLASS="--class $(echo ${GRUB_DISTRIBUTOR} | tr 'A-Z' 'a-z' | cut -d' ' -f1 | LC_ALL=C sed 's,[^[:alnum:]_],_,g') ${CLASS}"
+     fi
+ 
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-mkconfig-ubuntu-recovery.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-mkconfig-ubuntu-recovery.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-mkconfig-ubuntu-recovery.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-mkconfig-ubuntu-recovery.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,66 @@
+From: Julian Andres Klode <julian.klode@canonical.com>
+Date: Tue, 30 Nov 2021 19:49:13 +0100
+Subject: "single" -> "recovery" when friendly-recovery is installed
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 8bit
+
+If configured with --enable-ubuntu-recovery, also set nomodeset for
+recovery mode, and disable 'set gfxpayload=keep' even if the system
+normally supports it.  See
+https://launchpad.net/ubuntu/+spec/desktop-o-xorg-tools-and-processes.
+
+Author: Stéphane Graber <stgraber@ubuntu.com>
+Forwarded: no
+Last-Update: 2013-12-25
+---
+ util/grub.d/10_linux_zfs.in | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/util/grub.d/10_linux_zfs.in b/util/grub.d/10_linux_zfs.in
+index a57757f..27061af 100755
+--- a/util/grub.d/10_linux_zfs.in
++++ b/util/grub.d/10_linux_zfs.in
+@@ -19,6 +19,7 @@ set -e
+ 
+ prefix="@prefix@"
+ datarootdir="@datarootdir@"
++ubuntu_recovery="@UBUNTU_RECOVERY@"
+ 
+ . "${pkgdatadir}/grub-mkconfig_lib"
+ 
+@@ -768,7 +769,9 @@ zfs_linux_entry () {
+         if [ "${GRUB_GFXPAYLOAD_LINUX}" != "text" ]; then
+             echo "${submenu_indentation}	load_video"
+         fi
+-        echo "${submenu_indentation}	set gfxpayload=\${linux_gfx_mode}"
++        if [ "${ubuntu_recovery}" = 0 ] || [ "${type}" != "recovery" ]; then
++            echo "${submenu_indentation}	set gfxpayload=\${linux_gfx_mode}"
++        fi
+     fi
+ 
+     echo "${submenu_indentation}	insmod gzio"
+@@ -779,7 +782,7 @@ zfs_linux_entry () {
+ 
+     linux_default_args="${GRUB_CMDLINE_LINUX} ${GRUB_CMDLINE_LINUX_DEFAULT}"
+     if [ ${type} = "recovery" ]; then
+-        linux_default_args="single ${GRUB_CMDLINE_LINUX}"
++        linux_default_args="${GRUB_CMDLINE_LINUX_RECOVERY} ${GRUB_CMDLINE_LINUX}"
+     fi
+ 
+     # echo in echo trims end of line spaces
+@@ -812,6 +815,14 @@ generate_grub_menu() {
+         CLASS="--class $(echo ${GRUB_DISTRIBUTOR} | tr 'A-Z' 'a-z' | cut -d' ' -f1 | LC_ALL=C sed 's,[^[:alnum:]_],_,g') ${CLASS}"
+     fi
+ 
++    if [ -x /lib/recovery-mode/recovery-menu ]; then
++        GRUB_CMDLINE_LINUX_RECOVERY=recovery
++    else
++        GRUB_CMDLINE_LINUX_RECOVERY=single
++    fi
++    if [ "${ubuntu_recovery}" = 1 ]; then
++        GRUB_CMDLINE_LINUX_RECOVERY="${GRUB_CMDLINE_LINUX_RECOVERY} nomodeset"
++    fi
+ 
+     # IFS is set to TAB (ASCII 0x09)
+     echo "${menu_metadata}" |
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-vt-handoff.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-vt-handoff.patch
--- 2.14~git20250718.0e36779-1/debian/patches/ubuntu-zfs-vt-handoff.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/ubuntu-zfs-vt-handoff.patch	2025-09-09 15:43:50.000000000 +0000
@@ -0,0 +1,77 @@
+From: Colin Watson <cjwatson@ubuntu.com>
+Date: Mon, 13 Jan 2014 12:13:30 +0000
+Subject: Add configure option to use vt.handoff=7
+
+This is used for non-recovery Linux entries only; it enables
+flicker-free booting if gfxpayload=keep is in use and a suitable kernel
+is present.
+
+Author: Andy Whitcroft <apw@canonical.com>
+Forwarded: not-needed
+Last-Update: 2013-12-25
+
+Patch-Name: vt-handoff.patch
+---
+ util/grub.d/10_linux_zfs.in | 28 +++++++++++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/util/grub.d/10_linux_zfs.in b/util/grub.d/10_linux_zfs.in
+index b961e87..5bbda03 100755
+--- a/util/grub.d/10_linux_zfs.in
++++ b/util/grub.d/10_linux_zfs.in
+@@ -23,6 +23,7 @@ ubuntu_recovery="@UBUNTU_RECOVERY@"
+ quiet_boot="@QUIET_BOOT@"
+ quick_boot="@QUICK_BOOT@"
+ gfxpayload_dynamic="@GFXPAYLOAD_DYNAMIC@"
++vt_handoff="@VT_HANDOFF@"
+ 
+ . "${pkgdatadir}/grub-mkconfig_lib"
+ 
+@@ -737,6 +738,23 @@ generate_grub_menu_metadata() {
+ # Note:
+ #   If 10_linux runs these part will be defined twice in grub configuration
+ print_menu_prologue() {
++    cat << 'EOF'
++function gfxmode {
++	set gfxpayload="${1}"
++EOF
++    if [ "${vt_handoff}" = 1 ]; then
++        cat << 'EOF'
++	if [ "${1}" = "keep" ]; then
++		set vt_handoff=vt.handoff=1
++	else
++		set vt_handoff=
++	fi
++EOF
++    fi
++    cat << EOF
++}
++EOF
++
+     # Use ELILO's generic "efifb" when it's known to be available.
+     # FIXME: We need an interface to select vesafb in case efifb can't be used.
+     GRUB_GFXPAYLOAD_LINUX="${GRUB_GFXPAYLOAD_LINUX:-}"
+@@ -832,7 +850,7 @@ zfs_linux_entry () {
+ 
+     if ([ "${ubuntu_recovery}" = 0 ] || [ "${type}" != "recovery" ]) && \
+         ([ "${GRUB_GFXPAYLOAD_LINUX}" != "" ] || [ "${gfxpayload_dynamic}" = 1 ]); then
+-        echo "${submenu_indentation}	set gfxpayload=\${linux_gfx_mode}"
++        echo "${submenu_indentation}	gfxmode \${linux_gfx_mode}"
+     fi
+ 
+     echo "${submenu_indentation}	insmod gzio"
+@@ -896,6 +914,14 @@ generate_grub_menu() {
+         GRUB_CMDLINE_LINUX_RECOVERY="${GRUB_CMDLINE_LINUX_RECOVERY} nomodeset"
+     fi
+ 
++    if [ "${vt_handoff}" = 1 ]; then
++        for word in ${GRUB_CMDLINE_LINUX_DEFAULT}; do
++            if [ "${word}" = splash ]; then
++                GRUB_CMDLINE_LINUX_DEFAULT="${GRUB_CMDLINE_LINUX_DEFAULT} \${vt_handoff}"
++            fi
++        done
++    fi
++
+     print_menu_prologue
+ 
+     # IFS is set to TAB (ASCII 0x09)
diff -pruN 2.14~git20250718.0e36779-1/debian/patches/upstream/util-bash-completion.d-Makefile.am-s-mkrescure-mkrescue-g.patch 2.14~git20250718.0e36779-1ubuntu4/debian/patches/upstream/util-bash-completion.d-Makefile.am-s-mkrescure-mkrescue-g.patch
--- 2.14~git20250718.0e36779-1/debian/patches/upstream/util-bash-completion.d-Makefile.am-s-mkrescure-mkrescue-g.patch	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/patches/upstream/util-bash-completion.d-Makefile.am-s-mkrescure-mkrescue-g.patch	2025-09-09 15:43:51.000000000 +0000
@@ -0,0 +1,34 @@
+From: Mate Kukri <mate.kukri@canonical.com>
+Date: Tue, 19 Aug 2025 14:12:19 +0100
+Subject: util/bash-completion.d/Makefile.am: s/mkrescure/mkrescue/g
+
+This is a typo that was stopping this bash-completion from being
+installed.
+
+Signed-off-by: Mate Kukri <mate.kukri@canonical.com>
+---
+ util/bash-completion.d/Makefile.am | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/util/bash-completion.d/Makefile.am b/util/bash-completion.d/Makefile.am
+index 33fff95..ede14af 100644
+--- a/util/bash-completion.d/Makefile.am
++++ b/util/bash-completion.d/Makefile.am
+@@ -50,7 +50,7 @@ CLEANFILES = $(bash_completion_script) \
+ 	$(grub_mkfont_script) \
+ 	$(grub_mkimage_script) \
+ 	$(grub_mkpasswd_pbkdf2_script) \
+-	$(grub_mkrescure_script) \
++	$(grub_mkrescue_script) \
+ 	$(grub_probe_script) \
+ 	$(grub_reboot_script) \
+ 	$(grub_script_check_script) \
+@@ -67,7 +67,7 @@ bashcompletion_DATA = $(bash_completion_script) \
+ 	$(grub_mkfont_script) \
+ 	$(grub_mkimage_script) \
+ 	$(grub_mkpasswd_pbkdf2_script) \
+-	$(grub_mkrescure_script) \
++	$(grub_mkrescue_script) \
+ 	$(grub_probe_script) \
+ 	$(grub_reboot_script) \
+ 	$(grub_script_check_script) \
diff -pruN 2.14~git20250718.0e36779-1/debian/po/ar.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/ar.po
--- 2.14~git20250718.0e36779-1/debian/po/ar.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/ar.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub.ar\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2010-07-16 02:38+0300\n"
 "Last-Translator: Ossama M. Khayat <okhayat@yahoo.com>\n"
 "Language-Team: Arabic <support@arabeyes.org>\n"
@@ -46,8 +46,8 @@ msgid ""
 "from your existing GRUB Legacy setup. This step can be automatically "
 "performed now."
 msgstr ""
-"لتستبدل النسخة السابقة من GRUB في نظامك، يُستحسن تعديل الملف /boot/grub/"
-"menu.lst لتحميل GRUB 2 تسلسلياً من إعداد GRUB السابق. ويمكن تنفيذ هذه الخطوة "
+"لتستبدل النسخة السابقة من GRUB في نظامك، يُستحسن تعديل الملف /boot/grub/menu."
+"lst لتحميل GRUB 2 تسلسلياً من إعداد GRUB السابق. ويمكن تنفيذ هذه الخطوة "
 "تلقائياً الآن."
 
 #. Type: boolean
@@ -80,6 +80,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 #, fuzzy
 #| msgid "GRUB failed to install to the following devices:"
 msgid "GRUB install devices:"
@@ -95,7 +96,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -126,7 +127,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -155,7 +156,7 @@ msgstr "${DEVICE} (${SIZE} م.ب.، ${MO
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr ""
 
@@ -164,12 +165,13 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "تعذر تثبيت GRUB على الأجهزة التالية:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -199,7 +201,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "تريد الاستمرار دون تثبيت GRUB؟"
 
@@ -227,7 +229,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 #, fuzzy
 #| msgid ""
 #| "If you are already running a different boot loader and want to carry on "
@@ -304,6 +306,12 @@ msgstr ""
 "بشكل عام، يجب عليك إنهاء التحويل إلى GRUB 2 إلا إن كانت سجلات الإقلاع هذه قد "
 "أنشأها تثبيت GRUB 2 لنظام تشغيل آخر."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -346,7 +354,7 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 
 #. Type: boolean
@@ -354,12 +362,12 @@ msgstr ""
 #: ../templates.in:3001
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 
 #. Type: boolean
@@ -403,6 +411,85 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} م.ب.، ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when your computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"اخترت عدم تثبيت GRUB على أية جهاز. إن استمريت، فقد لا يتم تهيئة محمّل الإقلاع "
+"بشكل صحيح، كما يستخدم حاسبك أي نظام موجود على قطاع الإقلاع مسبقاً. إن كان "
+"هناك نسخة سابقة من GRUB 2 في قطاع الإقلاع، فقد لا يستطيع تحميل الوحدات أو "
+"قراءة ملف التهيئة الحالي بشكل صحيح."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "سطر أوامر KFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/ast.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/ast.po
--- 2.14~git20250718.0e36779-1/debian/po/ast.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/ast.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2012-01-27 11:10+0100\n"
 "Last-Translator: Mikel González <mikelglez@softastur.org>\n"
 "Language-Team: Asturian <alministradores@softastur.org>\n"
@@ -71,6 +71,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB falló al instalar nos siguientes preseos:"
 
@@ -86,7 +87,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -126,7 +127,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -157,7 +158,7 @@ msgstr "${DEVICE} (${SIZE} MB; ${PATH})"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Fallu al escribir GRUB al preséu d'arranque - ¿siguir?"
 
@@ -166,12 +167,13 @@ msgstr "Fallu al escribir GRUB al presé
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Falló GRUB al instalar nos siguientes preseos:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -198,7 +200,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "¿Siguir ensin instalar GRUB?"
 
@@ -220,7 +222,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -296,6 +298,12 @@ msgstr ""
 "d'arranque fueren creaos por una instalación de GRUB 2 en dalgún otru "
 "sistema operativu."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -333,7 +341,7 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 
 #. Type: boolean
@@ -341,12 +349,12 @@ msgstr ""
 #: ../templates.in:3001
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 
 #. Type: boolean
@@ -390,6 +398,93 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Anovóse'l paquete grup-pc. Esti menú val pa esbillar en que preseos quie "
+"que'l grub-install s'execute automáticamente, si hai dalgún."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Escoyistes nun instalar GRUB en dengún preséu. De siguir, el xestor "
+"d'arranque podría nun tar configuráu dafechu, y nel siguiente aniciu del "
+"ordenador usarás lo que teníes previamente nel sector d'arranque. Si hai un "
+"versión anterior de GRUB 2 nel sector d'arranque, podría ser capaz de cargar "
+"módulos o remanar el ficheru de configuración actual."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Linia comandos kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/be.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/be.po
--- 2.14~git20250718.0e36779-1/debian/po/be.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/be.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,11 +7,11 @@ msgid ""
 msgstr ""
 "Project-Id-Version: be\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-04-27 11:22+0300\n"
 "Last-Translator: Viktar Siarheichyk <vics@eq.by>\n"
-"Language-Team: Debian l10n team for Belarusian <debian-l10n-"
-"belarusian@lists.debian.org>\n"
+"Language-Team: Debian l10n team for Belarusian <debian-l10n-belarusian@lists."
+"debian.org>\n"
 "Language: be\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=utf-8\n"
@@ -73,6 +73,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Прылады, на якія ўсталёўваць GRUB:"
 
@@ -88,7 +89,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -128,7 +129,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -159,7 +160,7 @@ msgstr "- ${DEVICE} (${SIZE} МБ; ${PAT
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Запіс GRUB на загрузкавую прыладу не ўдаўся - працягваць?"
 
@@ -168,12 +169,13 @@ msgstr "Запіс GRUB на загру
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Не атрымалася ўсталяваць GRUB на наступныя прылады:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -202,7 +204,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Працягваць, не ўсталёўваючы GRUB?"
 
@@ -224,7 +226,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -300,6 +302,12 @@ msgstr ""
 "загрузчыкі не былі створаныя ўсталёўкай GRUB 2 на нейкай іншай аперацыйнай "
 "сістэме."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -338,20 +346,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Прымусова ўсталяваць дадаткова па адрасе EFI на зменным носьбце?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Некаторыя EFI-сістэмы утрымліваюць памылкі і некарэктна працуюць з новымі "
 "пачатковымі загрузчыкамі. Калі вы прымусова ўсталюеце дадаткова па адрасе "
@@ -415,6 +434,93 @@ msgstr ""
 "запуск os-prober можа нанесці шкоду гэтым гасцявым АС, паколькі ён мантуе "
 "файлавыя сістэмы для пошуку розных рэчаў."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"x`Пакет grub-pc абнаўляецца. Гэтае меню дазваляе абраць, для якіх прыладаў "
+"трэба, калі ўвогуле трэба, аўтаматычна запускаць grub-install."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} МБ; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Вы выбралі не ўсталёўваць GRUB ні на якую прыладу. Калі Вы працягнеце далей, "
+"пачатковы запускальнік, магчыма, не будзе сканфігураваны належным чынам, і "
+"калі гэты кампутар запусціцца наступным разам, ён загрузіцца з таго, што "
+"было раней у сектары запуску. Калі там была старая версія GRUB 2, ён можа не "
+"здолець загрузіць модулі альбо не разабраць цяперашні канфігурацыйны файл."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Радок камандаў для ядра kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/bg.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/bg.po
--- 2.14~git20250718.0e36779-1/debian/po/bg.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/bg.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2017-01-20 21:19+0200\n"
 "Last-Translator: Damyan Ivanov <dmn@debian.org>\n"
 "Language-Team: Български <dict@fsa-bg.org>\n"
@@ -70,6 +70,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Инсталиране на GRUB на следните устройства:"
 
@@ -85,7 +86,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -125,7 +126,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -156,7 +157,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr ""
 "Записването на GRUB върху устройството за начално зареждане не успя. "
@@ -167,12 +168,13 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Опитът за инсталиране на GRUB на следните устройства беше неуспешен:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -202,7 +204,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Продължаване без инсталиране на GRUB?"
 
@@ -225,7 +227,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -300,6 +302,12 @@ msgstr ""
 "секторите за начално зареждане са създадени от GRUB 2 или от друга "
 "операционна система."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -337,21 +345,32 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 "Допълнително инсталиране в резервния път на EFI за преносими устройства?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Някои базирани на EFI системи съдържат грешки и не работят добре с добавени "
 "програми за начално зареждане (като GRUB). Допълнителното инсталиране на "
@@ -406,6 +425,94 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Пакетът grub-pc се обновява. Това меню позволява избиране за кои устройства "
+"(и дали изобщо) да се изпълни командата grub-install."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Избрано е GRUB да не се инсталира на никакви устройства. Ако продължите, "
+"програмата за начално зареждане може да не е настроена правилно и при "
+"следващото стартиране на компютъра ще се използва предишното съдържание на "
+"сектора за начално зареждане. Ако в него има предишна инсталация на GRUB 2 е "
+"възможно тя да не успее да използва обновените модули или конфигурационния "
+"файл."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Команден ред за kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/ca.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/ca.po
--- 2.14~git20250718.0e36779-1/debian/po/ca.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/ca.po	2025-09-08 10:56:27.000000000 +0000
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2 2.02~beta3-4\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2024-08-17 13:33+0200\n"
 "Last-Translator: Innocent De Marchi <tangram.peces@gmail.com>\n"
 "Language-Team: Catalan <debian-l10n-catalan@lists.debian.org>\n"
@@ -55,8 +55,8 @@ msgid ""
 "verify that the new GRUB 2 setup works before it is written to the MBR "
 "(Master Boot Record)."
 msgstr ""
-"És recomanable que accepteu la càrrega en cadena del GRUB 2 des del "
-"menu.lst, per a verificar que la nova configuració del GRUB 2 funciona "
+"És recomanable que accepteu la càrrega en cadena del GRUB 2 des del menu."
+"lst, per a verificar que la nova configuració del GRUB 2 funciona "
 "correctament, abans de que s'escriga al registre mestre d'arrencada (MBR)."
 
 #. Type: boolean
@@ -74,6 +74,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Dispositius d'instaŀlació del GRUB:"
 
@@ -90,7 +91,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -131,7 +132,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -162,7 +163,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Ha fallat l'escriptura del GRUB al dispositiu. Voleu continuar?"
 
@@ -171,12 +172,13 @@ msgstr "Ha fallat l'escriptura del GRUB
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "El GRUB no s'ha pogut instaŀlar als dispositius següents:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -205,7 +207,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Voleu continuar sense instaŀlar el GRUB?"
 
@@ -228,7 +230,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -304,6 +306,12 @@ msgstr ""
 "aquests registres d'arrencada els haja creat una instaŀlació del GRUB 2 des "
 "d'un altre sistema operatiu."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -341,21 +349,32 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 "Forçar la instal·lació addicional de EFI per la ruta a mitjans extraïbles?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Alguns sistemes basats en EFI tenen errors i no gestionen correctament els "
 "nous carregadors d'arrencada. Si forçau la instal·lació del GRUB en mitjans "
@@ -422,6 +441,95 @@ msgstr ""
 "pot causar maleses a aquests sistemes operatius atès que munta els sistemes "
 "de fitxers per a buscar-hi coses."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"S'està actualitzant el paquet grub-pc. Aquest menú us permet seleccionar "
+"sobre quins dispositius voleu que s'execute el grub-install automàticament, "
+"en cas de voler-ho."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Heu triat no instaŀlar el GRUB en cap dispositiu. Si continueu, és possible "
+"que el carregador no estiga configurat correctament, i quan s'arrenque "
+"l'ordinador la pròxima vegada, emprarà allò que estigués al sector "
+"d'arrencada. Si hi ha una versió anterior del GRUB2 al sector d'arrencada, "
+"és possible que no puga carregar mòduls o gestionar el fitxer de "
+"configuració actual."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Línia d'ordres de kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/cs.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/cs.po
--- 2.14~git20250718.0e36779-1/debian/po/cs.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/cs.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-04-28 12:53+0200\n"
 "Last-Translator: Miroslav Kure <kurem@debian.cz>\n"
 "Language-Team: Czech <debian-l10n-czech@lists.debian.org>\n"
@@ -70,6 +70,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Zařízení pro instalaci GRUBu:"
 
@@ -85,7 +86,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -124,7 +125,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -155,7 +156,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Zápis GRUBu na zaváděcí zařízení selhal - pokračovat?"
 
@@ -164,12 +165,13 @@ msgstr "Zápis GRUBu na zaváděcí zař
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUB se nepodařilo nainstalovat na následující zařízení:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -197,7 +199,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Pokračovat bez instalace GRUBu?"
 
@@ -219,7 +221,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -292,6 +294,12 @@ msgstr ""
 "Obvykle byste měli konverzi na GRUB 2 dokončit, s výjimkou situace, kdy tyto "
 "zaváděcí záznamy vytvořila instalace nějakého jiného operačního systému."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -306,8 +314,8 @@ msgid ""
 "`kopt' parameter in GRUB Legacy's menu.lst. Please verify that it is "
 "correct, and modify it if necessary. The command line is allowed to be empty."
 msgstr ""
-"Následující řádka s parametry pro Linux byla získána ze starého souboru "
-"menu.lst z parametru „kopt“ nebo ze souboru /etc/default/grub. Zkontrolujte "
+"Následující řádka s parametry pro Linux byla získána ze starého souboru menu."
+"lst z parametru „kopt“ nebo ze souboru /etc/default/grub. Zkontrolujte "
 "prosím, zda jsou parametry v pořádku a případně je upravte do požadované "
 "podoby. Řádka s parametry může být i prázdná."
 
@@ -330,20 +338,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Vynutit další instalaci do EFI cesty pro výměnná média?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Některé systémy používající EFI obsahují chyby a neumí správně pracovat s "
 "novými zavaděči. Vynutíte-li další instalaci GRUBu do EFI cesty pro výměnná, "
@@ -406,6 +425,93 @@ msgstr ""
 "mohou být tyto operační systémy poškozeny, protože os-prober musí při "
 "hledání dané souborové systémy připojit."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Balík grub-pc se právě aktualizuje. Tato nabídka vám umožňuje zvolit "
+"zařízení, na kterých se má automaticky spouštět grub-install."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Rozhodli jste se neinstalovat GRUB na žádné zařízení. Budete-li pokračovat, "
+"zavaděč nemusí být nastaven správně a při příštím spuštění počítače se "
+"použije cokoliv, co bylo dříve v zaváděcím sektoru. Pokud tam je dřívější "
+"verze GRUBu 2, nemusí se jí podařit načíst moduly, nebo zpracovat současný "
+"konfigurační soubor."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Parametry pro kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/cy.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/cy.po
--- 2.14~git20250718.0e36779-1/debian/po/cy.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/cy.po	2025-09-08 10:56:27.000000000 +0000
@@ -10,7 +10,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-04-25 00:08+0100\n"
 "Last-Translator: Dafydd Tomos <l10n@da.fydd.org>\n"
 "Language-Team: Welsh\n"
@@ -74,6 +74,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Dyfeisiau sefydlu GRUB:"
 
@@ -90,7 +91,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -130,7 +131,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -161,7 +162,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Methwyd ysgrifennu GRUB i'r ddyfais ymgychwyn - parhau?"
 
@@ -170,12 +171,13 @@ msgstr "Methwyd ysgrifennu GRUB i'r ddyf
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Methwyd sefydlu GRUB i'r dyfeisiau canlynol:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -203,7 +205,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Parhau heb sefydlu GRUB?"
 
@@ -226,7 +228,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -303,6 +305,12 @@ msgstr ""
 "ymgychwyn hyn wedi eu creu gan sefydliad GRUB 2 gan ryw system weithredu "
 "arall."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -340,20 +348,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Gorfodi gosodiad ychwanegol i'r llwybr cyfrwng symudadwy EFI?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Mae rhai systemau EFI yn wallus ac nid ydynt yn trin llwythwr ymgychwyn "
 "newydd yn gywir. Os ydych chi'n gorfodi gosodiad ychwanegol o GRUB i lwybr "
@@ -418,6 +437,95 @@ msgstr ""
 "prober achosi difrod i'r OSau gwadd yma wrth iddo agor systemau ffeilio i "
 "chwilio am bethau."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Mae'r pecyn grub-pc yn cael ei uwchraddio. Mae'r fwydlen yma yn eich "
+"caniatáu i ddewis pa ddyfeisiau yr hoffech redeg grub-install arno yn "
+"awtomatig, os o gwbl."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Fe ddewisoch i beidio sefydlu GRUB i unrhyw ddyfeisiau. Os ydych yn parhau, "
+"mae'n bosib na fydd y llwythwr ymgychwyn wedi ei gyflunio'n gywir, a'r tro "
+"nesa fydd y cyfrifiadur hwn yn cychwyn mi fydd yn defnyddio beth bynnag oedd "
+"yn y sector ymgychwyn o'r blaen. Os oes fersiwn cynharach o GRUB 2 yn y "
+"sector ymgychwyn, mae'n bosib na fydd yn gallu llwytho modiwlau na deall y "
+"ffeil gyfluniad presennol."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "llinell orchymyn kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/da.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/da.po
--- 2.14~git20250718.0e36779-1/debian/po/da.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/da.po	2025-09-08 10:56:27.000000000 +0000
@@ -20,7 +20,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2017-01-23 11:30+01:00\n"
 "Last-Translator: Joe Hansen <joedalton2@yahoo.dk>\n"
 "Language-Team: Danish <debian-l10n-danish@lists.debian.org>\n"
@@ -83,6 +83,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUBs installationsenheder:"
 
@@ -98,7 +99,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -138,7 +139,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -169,7 +170,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Skrivning af GRUB til opstartsenhed fejlede - vil du fortsætte?"
 
@@ -178,12 +179,13 @@ msgstr "Skrivning af GRUB til opstartsen
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Kunne ikke installere GRUB på de følgende enheder:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -211,7 +213,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Fortsæt uden at installere GRUB?"
 
@@ -234,7 +236,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -310,6 +312,12 @@ msgstr ""
 "opstartsposter blev oprettet af en GRUB 2-installation på et andet "
 "operativsystem."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -347,20 +355,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Fremtving ekstra installation til den flytbare mediesti for EFI?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Nogle EFI-baserede systemer er fejlramte og håndterer ikke nye "
 "opstartsindlæsere korrekt. Hvis du fremtvinger en ekstra installation af "
@@ -417,6 +436,94 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Pakken grub-pc bliver opgraderet. Denne menu tillader dig at vælge, hvilke "
+"enheder om nogen, du vil have at grub-install automatisk skal køres for."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Du har valgt ikke at installere GRUB på nogen enhed. Hvis du fortsætter, vil "
+"opstarteren (boot loader) måske ikke være korrekt konfigureret, og når din "
+"computer starter op næste gang, vil den bruge det tidligere indhold i din "
+"opstartssektor (boot sector). Hvis der er en tidligere version af GRUB 2 i "
+"opstartsektoren, vil den måske ikke være i stand til at indlæse moduler "
+"eller håndtere den aktuelle konfigurationsfil."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Kommandolinje for kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/de.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/de.po
--- 2.14~git20250718.0e36779-1/debian/po/de.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/de.po	2025-09-08 10:56:27.000000000 +0000
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: 2.02 2.06-13\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-04-25 19:48+0200\n"
 "Last-Translator: Helge Kreutzmann <debian@helgefjell.de>\n"
 "Language-Team: German <debian-l10n-german@lists.debian.org>\n"
@@ -73,6 +73,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Geräte für die GRUB-Installation:"
 
@@ -89,7 +90,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -122,14 +123,14 @@ msgid ""
 "use the blocklist mechanism, which makes it less reliable, and therefore is "
 "not recommended."
 msgstr ""
-"Hinweis: Sie können GRUB auch in die Boot-Blöcke von Partitionen "
-"schreiben.Hier werden auch einige geeignete Partitionen angeboten. Das "
-"zwingt GRUB allerdings dazu, den Blocklist-Mechanismus zu verwenden. Dieser "
-"ist weniger zuverlässig und wird daher nicht empfohlen."
+"Hinweis: Sie können GRUB auch in die Boot-Blöcke von Partitionen schreiben."
+"Hier werden auch einige geeignete Partitionen angeboten. Das zwingt GRUB "
+"allerdings dazu, den Blocklist-Mechanismus zu verwenden. Dieser ist weniger "
+"zuverlässig und wird daher nicht empfohlen."
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -161,7 +162,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "GRUB konnte nicht auf das Boot-Gerät geschrieben werden - fortfahren?"
 
@@ -170,12 +171,13 @@ msgstr "GRUB konnte nicht auf das Boot-G
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUB konnte nicht auf den folgenden Geräten installiert werden:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -205,7 +207,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Fortsetzen, ohne Grub zu installieren?"
 
@@ -230,7 +232,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -308,6 +310,12 @@ msgstr ""
 "denn, diese GRUB-2-Boot-Sektoren wurden von einem anderen Betriebssystem "
 "installiert."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -346,20 +354,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Zusätzliche Installation in den Pfad für EFI-Wechselmedien erzwingen?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Einige EFI-basierte Systeme haben einen Fehler und handhaben neue Bootloader "
 "nicht korrekt. Falls Sie eine zusätzliche Installation von GRUB in den Pfad  "
@@ -429,6 +448,97 @@ msgstr ""
 "Gastbetriebssysteme beschädigen, da es Dateisysteme einhängt, um nach "
 "bestimmten Sachen zu suchen."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Für das Paket grub-pc wird gerade ein Upgrade durchgeführt. In diesem Menü "
+"können Sie auswählen, ob und für welche Geräte grub-install automatisch "
+"ausgeführt werden soll."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+# (mes) Seht Ihr einen Unterschied zwischen der alten und der neuen Version?
+# Ich habe jetzt nur das fuzzy rausgenommen.
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Sie haben sich entschieden, GRUB auf kein Gerät zu installieren. Wenn Sie "
+"fortfahren, könnte der Boot-Loader nicht richtig konfiguriert sein. Beim "
+"nächsten Hochfahren dieses Computers wird der Boot-Loader benutzen, was "
+"immer sich vorher im Boot-Sektor befand. Wenn sich schon eine ältere Version "
+"von GRUB 2 im Boot-Sektor befindet, kann sie möglicherweise keine Module "
+"laden oder nicht mehr mit der aktuellen Konfigurationsdatei umgehen."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Befehlszeile für kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/dz.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/dz.po
--- 2.14~git20250718.0e36779-1/debian/po/dz.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/dz.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2001-12-31 19:57-0500\n"
 "Last-Translator: Dawa <dpemo@dit.gov.bt>\n"
 "Language-Team: Dzongkha <LL@li.org>\n"
@@ -39,9 +39,9 @@ msgid ""
 "from your existing GRUB Legacy setup. This step can be automatically "
 "performed now."
 msgstr ""
-"ཁྱོད་རའི་རིམ་ལུགས་ནང་ལུ་ GRUB གི་སྔོན་བཤུལ་ཐོན་རིམ་ཚབ་བཙུགས་འབད་ནི་གི་དོན་ལུ་ /boot/grub/"
-"menu.lst འདི་ ཁྱོད་རའི་ཡོད་བཞིན་པའི་སྔོན་བཤུལ་གཞི་སྒྲིག་ནང་ལས་ ཅེན་ལོཌི་ GRUB ༢ ལུ་ བདེ་སྒྲིག་འབད་"
-"དགོཔ་སྦེ་འོས་སྦྱོར་འབད་ནུག། གཞི་སྒྲིག་འདི་ ཡང་ཅིན་ འཕྲལ་ར་རང་བཞིན་གྱིས་ལཱ་འབད་བཏུབ།"
+"ཁྱོད་རའི་རིམ་ལུགས་ནང་ལུ་ GRUB གི་སྔོན་བཤུལ་ཐོན་རིམ་ཚབ་བཙུགས་འབད་ནི་གི་དོན་ལུ་ /boot/grub/menu."
+"lst འདི་ ཁྱོད་རའི་ཡོད་བཞིན་པའི་སྔོན་བཤུལ་གཞི་སྒྲིག་ནང་ལས་ ཅེན་ལོཌི་ GRUB ༢ ལུ་ བདེ་སྒྲིག་འབད་དགོཔ་སྦེ་"
+"འོས་སྦྱོར་འབད་ནུག། གཞི་སྒྲིག་འདི་ ཡང་ཅིན་ འཕྲལ་ར་རང་བཞིན་གྱིས་ལཱ་འབད་བཏུབ།"
 
 #. Type: boolean
 #. Description
@@ -70,6 +70,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB གཞི་བཙུགས་ ཐབས་འཕྲུལ་ཚུ :"
 
@@ -85,7 +86,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -123,7 +124,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -154,7 +155,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr " GRUB བུཊི་ ཐབས་འཕྲུལ་ལུ་འབྲི་ནི་ འཐུས་ཤོར་འབྱུང་ཡོདཔ - འཕྲོ་མཐུད་དེ་འབད་ནི་ཨིན་ན?"
 
@@ -163,12 +164,13 @@ msgstr " GRUB བུཊི་ ཐབས
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUB འདི་ འོག་གི་ཐབས་འཕྲུལ་ཚུ་ནང་གཞི་བཙུགས་འབད་མ་ཚུགས་པས:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -196,7 +198,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "GRUB གཞི་བཙུགས་མ་འབད་བར་འཕྲོ་མཐུད་ནི་ཨིན་ན?"
 
@@ -218,7 +220,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -290,6 +292,12 @@ msgstr ""
 "GRUB 2 གཞི་བཙུགས་ཀྱིས་ བཀོད་སྤྱོད་རིམ་ལུགས་ གཞན་གཅིག་གུ་ བུཊི་དྲན་ཐོ་འདི་ཚུ་ གསར་བསྐྲུན་མ་འབདཝ་"
 "ལས་ GRUB 2 ལུ་ གཞི་བསྒྱུར་འབད་ཚར་དགོ།"
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -327,7 +335,7 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 
 #. Type: boolean
@@ -335,12 +343,12 @@ msgstr ""
 #: ../templates.in:3001
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 
 #. Type: boolean
@@ -384,6 +392,93 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"grub-pc ཐུམ་སྒྲིལ་འདི་ ཡར་བསྐྱེད་འབད་ཡོདཔ། དཀར་ཆག་འདི་གིས་ རང་བཞིན་ གཡོག་བཀོལ་ grub-གཞི་"
+"བཙུགས་ གང་རུང་ཡོད་པ་ཅིན་ ཐབས་འཕྲུལ་ སེལ་འཐུ་འབད་བཅུགཔ་ཨིན།"
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"ཁྱོད་ཀྱིས་ ཐབས་འཕྲུལ་གང་རུང་ནང་ GRUB གཞི་བཙུགས་མ་འབད་ནི་སྦེ་གདམ་ཁ་བརྐྱབས་ནུག འཕྲོ་མཐུད་དེ་འབད་བ་"
+"ཅིན་ བུཊི་མངོན་གསལ་པ་འདི་ ལེགས་ཤོམ་སྦེ་རིམ་སྒྲིག་མི་འབདཝ་་འོང་། དེ་ལས་ ཁྱོད་ཀྱི་གློག་རིག་འདི་ཤུལ་ལས་"
+"འགོ་བཙུགསཔ་ད་ ཧེ་མ་ལས་བུཊི་ས་ཁོངས་ག་ཅི་ཡོད་རུང་ ལག་ལེན་འཐབ་འོང་། གལ་སྲིད་ བུཊི་ས་ཁོངས་ ནང་ ཧེ་"
+"མའི་ཐོན་རིམ་ GRUB ༢ འདི་ཡོད་པ་ཅིན་ མོ་ཌུལ་འདི་མངོན་གསལའབད་མི་ཚུགས་ནི་ ཡང་ན་ ད་ལྟོའི་རིམ་སྒྲིག་ཡིག་"
+"སྣོད་འདི་ལེགས་སྐྱོང་འཐབ་མི་ཚུགསཔ་འོང་།"
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD བརྡ་བཀོད་གྲལ་ཐིག་:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/el.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/el.po
--- 2.14~git20250718.0e36779-1/debian/po/el.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/el.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-05-12 13:50+0300\n"
 "Last-Translator: galaxico <galas@tee.gr>\n"
 "Language-Team: debian-l10n-greek@lists.debian.org\n"
@@ -55,9 +55,9 @@ msgid ""
 "verify that the new GRUB 2 setup works before it is written to the MBR "
 "(Master Boot Record)."
 msgstr ""
-"Συνιστάται η αποδοχή της αλυσιδωτής φόρτωσης του GRUB 2 από το αρχείο "
-"menu.lst και η επαλήθευση της λειτουργικότητας της νέας ρύθμισης του GRUB 2 "
-"πριν αυτό εγγραφεί στο MBR (Master Boot Record)."
+"Συνιστάται η αποδοχή της αλυσιδωτής φόρτωσης του GRUB 2 από το αρχείο menu."
+"lst και η επαλήθευση της λειτουργικότητας της νέας ρύθμισης του GRUB 2 πριν "
+"αυτό εγγραφεί στο MBR (Master Boot Record)."
 
 #. Type: boolean
 #. Description
@@ -75,6 +75,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Συσκευές εγκατάστασης του GRUB:"
 
@@ -91,7 +92,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -133,7 +134,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -165,7 +166,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Η εγκατάσταση του GRUB στην συσκευή εκκίνησης απέτυχε - Συνέχεια;"
 
@@ -174,12 +175,13 @@ msgstr "Η εγκατάσταση του
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Η εγκατάσταση του GRUB απέτυχε στις ακόλουθες συσκευές:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -208,7 +210,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Συνέχεια χωρίς εγκατάσταση του GRUB;"
 
@@ -231,7 +233,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -310,6 +312,12 @@ msgstr ""
 "αν αυτά τα αρχεία εκκίνησης έχουν δημιουργηθεί από μια εγκατάσταση του GRUB "
 "2 σε ένα άλλο λειτουργικό σύστημα."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -349,20 +357,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Να γίνει εξαναγκασμένη εγκατάσταση στην αποσπώμενη EFI συσκευή;"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Μερικά συστήματα που βασίζουνται στο EFI είναι ελλειπώς ανεπτυγμένα και δεν "
 "διαχειρίζονται τα νέα προγράμματα εκκίνησης σωστά. Αν εξαναγκάσετε το "
@@ -433,6 +452,95 @@ msgstr ""
 "os-prober μπορεί να προκαλέσει βλάβη σε αυτά τα φιλοξενούμενα ΛΣ καθώς για "
 "την αναζήτηση που εκτελεί προσαρτά τα συστήματα αρχείων."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Γίνεται αναβάθμιση του πακέτου grub-pc. Αυτό το μενού σας επιτρέπει να "
+"επιλέξετε τις συσκευές, αν θέλετε κάποιες, για τις οποίες θα εκτελεστεί "
+"αυτόματα το grub-install."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Επιλέξατε να μην εγκαταστήσετε το GRUB σε οποιαδήποτε συσκευή. Αν "
+"συνεχίσετε, το πρόγραμμα εκκίνησης πιθανόν να μην έχει ρυθμιστεί σωστά και "
+"στην επανεκκίνηση του υπολογιστή σας θα χρησιμοποιήσει οτιδήποτε υπήρχε από "
+"πριν στον τομέα εκκίνησης. Αν υπάρχει μια προηγούμενη έκδοση του GRUB 2 στον "
+"τομέα εκκίνησης, πιθανόν να μην μπορεί να φορτώσει κάποιες ενότητες αλλά "
+"ούτενα χειριστεί το τρέχον αρχείο ρυθμίσεων."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Γραμμή εντολών kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/eo.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/eo.po
--- 2.14~git20250718.0e36779-1/debian/po/eo.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/eo.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2 2.02-18\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-05-10 19:17-0300\n"
 "Last-Translator: Felipe Castro <fefcas@gmail.com>\n"
 "Language-Team: Esperanto <debian-l10n-esperanto@lists.debian.org>\n"
@@ -72,6 +72,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Aparatoj instalataj de GRUB:"
 
@@ -87,7 +88,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -126,7 +127,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -156,7 +157,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Skribado de GRUB al ekŝarga aparato malsukcesis - ĉu daŭrigi?"
 
@@ -165,12 +166,13 @@ msgstr "Skribado de GRUB al ekŝarga apa
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUB malsukcesis instali al la jenaj aparatoj:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -197,7 +199,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Ĉu daŭrigi sen instali GRUB?"
 
@@ -219,7 +221,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -294,6 +296,12 @@ msgstr ""
 "ekŝarg-registroj estu kreitaj de sistemo kun GRUB 2 instalita, en alia "
 "operaciuma sistemo."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -332,20 +340,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Ĉu perforti kroma instalo al la vojo de demetebla datumportilo EFI?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Kelkaj sistemoj surbazitaj je EFI estas problemplenaj kaj ne traktas ĝuste "
 "novajn ekŝargilojn. Se vi perfortos kroman instalon de GRUB al la vojo de "
@@ -409,6 +428,93 @@ msgstr ""
 "povas difektigi tiujn gastigitajn OS-ojn, ĉar ĝi muntas dosiersistemojn por "
 "serĉi aĵojn."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"La pako grub-pc estas ĝisdatigata. Tiu ĉi menuo ebligas al vi elekti iujn "
+"ajn aparatojn por esti aŭtomate instalotaj de grub-install."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Vi elektis ne instali GRUB al iu ajn aparato. Se vi daŭrigas, la ekŝargilo "
+"eble ne estos ĝuste agordita, kaj kiam tiu ĉi komputilo sekve ekŝaltos, ĝi "
+"uzos kion ajn estu antaŭe en la ekŝarga sektoro. Se ekzistas pli frua versio "
+"de GRUB 2 en la ekŝarga sektoro, ĝi eble ne povos ŝargi je moduloj aŭ trakti "
+"la nunan agordo-dosieron."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Ordon-linio de kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/es.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/es.po
--- 2.14~git20250718.0e36779-1/debian/po/es.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/es.po	2025-09-08 10:56:27.000000000 +0000
@@ -36,10 +36,10 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2 1.99-5\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2017-01-28 17:07+0100\n"
-"Last-Translator: Manuel \"Venturi\" Porras Peralta "
-"<venturi@openmailbox.org>\n"
+"Last-Translator: Manuel \"Venturi\" Porras Peralta <venturi@openmailbox."
+"org>\n"
 "Language-Team: Español; Castellano <debian-l10n-spanish@lists.debian.org>\n"
 "Language: es\n"
 "MIME-Version: 1.0\n"
@@ -84,8 +84,8 @@ msgid ""
 "verify that the new GRUB 2 setup works before it is written to the MBR "
 "(Master Boot Record)."
 msgstr ""
-"Se recomienda que acepte cargarlo secuencialmente desde el fichero "
-"«menu.lst» y que compruebe el buen funcionamiento del nuevo GRUB 2, antes de "
+"Se recomienda que acepte cargarlo secuencialmente desde el fichero «menu."
+"lst» y que compruebe el buen funcionamiento del nuevo GRUB 2, antes de "
 "instalarlo en el MBR («Master Boot Record»)."
 
 #. Type: boolean
@@ -104,6 +104,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Dispositivos donde puede instalar GRUB:"
 
@@ -119,7 +120,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -159,7 +160,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -190,7 +191,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr ""
 "La instalación de GRUB en el dispositivo de inicio ha fallado, ¿desea "
@@ -201,12 +202,13 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "No se pudo instalar GRUB en los siguientes dispositivos:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -236,7 +238,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "¿Desea continuar sin instalar GRUB?"
 
@@ -259,7 +261,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -335,6 +337,12 @@ msgstr ""
 "Debería terminar la conversión a GRUB 2 a menos que estos registros de "
 "inicio los crease una instalación de GRUB 2 en algún otro sistema operativo."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -373,20 +381,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "¿Desea forzar la instalación extra a la ruta del medio extraíble EFI?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Algunos sistemas basados en EFI son defectuosos y no manejan los nuevos "
 "cargadores de inicio correctamente. Si fuerza la instalación extra de GRUB "
@@ -446,6 +465,94 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Se está actualizando el paquete grub-pc. Si lo desea, este menú le permite "
+"escoger en qué dispositivos quiere ejecutar automáticamente grub-install."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Ha escogido no instalar GRUB en ningún dispositivo. Si continúa, puede que "
+"el cargador de inicio no se configure correctamente, y cuando este equipo se "
+"vuelva a iniciar se utilizará lo que hubiera anteriormente en el sector de "
+"inicio. Si hay una versión previa de GRUB 2 en el sector de inicio, puede "
+"que sea imposible cargar los módulos o manejar el fichero de configuración "
+"actual."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Línea de órdenes de kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/eu.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/eu.po
--- 2.14~git20250718.0e36779-1/debian/po/eu.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/eu.po	2025-09-08 10:56:27.000000000 +0000
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2_2.02~beta2-18\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2017-01-20 15:48+0100\n"
 "Last-Translator: Iñaki Larrañaga Murgoitio <dooteo@zundan.com>\n"
 "Language-Team: Basque <debian-l10n-basque@lists.debian.org>\n"
@@ -74,6 +74,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB instalatzeko gailuak:"
 
@@ -89,7 +90,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -129,7 +130,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -160,7 +161,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Huts egin du GRUB abioko gailuan idaztean - jarraitu?"
 
@@ -169,12 +170,13 @@ msgstr "Huts egin du GRUB abioko gailuan
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUBek huts egin du honako gailuetan instalatzean:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -202,7 +204,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Jarraitu GRUB instalatu gabe?"
 
@@ -224,7 +226,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -301,6 +303,12 @@ msgstr ""
 "sistema eragile batzuetako GRUB 2 bertsioaren instalazioan ez badira sortuak "
 "izan."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -338,20 +346,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Behartu instalazio gehigarria EFI euskarri aldagarriaren bide-izenean?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "EFIn oinarritutako sistema batzuk akastunak dira, eta ez dituzte abioko "
 "kargatzaile berriak ongi kudeatzen. EFI euskarri aldagarriaren bide-izenean "
@@ -407,6 +426,93 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"grub-pc paketea eguneratzen ari da. Menu honek zer gailuentzako automatikoki "
+"grub-install exekutatzea nahi duzun hautatzea (hautatzen baduzu) uzten dizu."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"GRUB inolako gailuetan ez instalatzea aukeratu duzu. Jarraitzen baduzu, "
+"baliteke abioko kargatzailea ongi konfiguratuta ez egotea, eta abioko "
+"sektorean aurretik zegoena erabiliko da ordenagailua hurrengo batean "
+"abiatzean. Abioko sektorean GRUB 2ren aurreko bertsio bat egonez gero, agian "
+"ezin izango du moduluak kargatu edo uneko konfigurazioko fitxategia kudeatu."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "KFreeBSD-ko komando-lerroa:"
 
@@ -416,10 +522,9 @@ msgstr ""
 #~ "is correct, and modify it if necessary. The command line is allowed to be "
 #~ "empty."
 #~ msgstr ""
-#~ "KFreeBSD-ko komando-lerro hau /etc/default/grub edo GRUB zaharraren "
-#~ "menu.lst fitxategiko 'kopt' parametrotik atera da. Egiaztatu zuzena dela, "
-#~ "eta eraldatu behar izanez gero. Komando-lerroa hutsik egotea baimenduta "
-#~ "dago."
+#~ "KFreeBSD-ko komando-lerro hau /etc/default/grub edo GRUB zaharraren menu."
+#~ "lst fitxategiko 'kopt' parametrotik atera da. Egiaztatu zuzena dela, eta "
+#~ "eraldatu behar izanez gero. Komando-lerroa hutsik egotea baimenduta dago."
 
 #~ msgid "kFreeBSD default command line:"
 #~ msgstr "KFreeBSD-ko komando-lerro lehenetsia:"
diff -pruN 2.14~git20250718.0e36779-1/debian/po/fa.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/fa.po
--- 2.14~git20250718.0e36779-1/debian/po/fa.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/fa.po	2025-09-08 10:56:27.000000000 +0000
@@ -2,7 +2,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: fa\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: \n"
 "Last-Translator: Behrad Eslamifar <behrad_es@yahoo.com>\n"
 "Language-Team: debian-l10n-persian <debian-l10n-persian@lists.debian.org>\n"
@@ -36,8 +36,8 @@ msgid ""
 "from your existing GRUB Legacy setup. This step can be automatically "
 "performed now."
 msgstr ""
-"برای جایگزینی نسخه قدیمی GRUB در سیستم شما، پیشنهاد می‌شود /boot/grub/"
-"menu.lst تنظیم گردد تا یک تصویر بوت‌ GRUB 2 از چینش قدیمی GRUB کنونی بارگذاری "
+"برای جایگزینی نسخه قدیمی GRUB در سیستم شما، پیشنهاد می‌شود /boot/grub/menu."
+"lst تنظیم گردد تا یک تصویر بوت‌ GRUB 2 از چینش قدیمی GRUB کنونی بارگذاری "
 "شود . اکنون این مرحله به صورت خودکار انجام می شود."
 
 #. Type: boolean
@@ -67,6 +67,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "دستگاه‌های نصب گراب:"
 
@@ -83,7 +84,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -122,7 +123,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -153,7 +154,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "نصب GRUB روی ابزار بوت با شکست مواجه شد - ادامه می‌دهید؟"
 
@@ -162,12 +163,13 @@ msgstr "نصب GRUB روی ابزار ب
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUB نتوانست که تجهیزات مورد نظر را نصب کند."
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -195,7 +197,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "آیا بدون نصب کردن GRUB ، ادامه می دهید ؟"
 
@@ -217,7 +219,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -291,6 +293,12 @@ msgstr ""
 "شما باید معمولاً به ارتباط GRUB2 پایان دهید، مگر آنکه این رکورد های بوت ساخته "
 "شده توسط GRUB2 مربوط به سیستم عامل های دیگر باشد."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -305,9 +313,9 @@ msgid ""
 "`kopt' parameter in GRUB Legacy's menu.lst. Please verify that it is "
 "correct, and modify it if necessary. The command line is allowed to be empty."
 msgstr ""
-"خط فرمان لینوکس ذیل از /etc/default/grub یا پارامتر های `kopt' در فایل "
-"menu.lst از گراب قدیمی استخراج شده است. لطفاً صحت آن را بررسی کنید، و در صورت "
-"لزوم آن را تغییردهید. این خط فرمان می‌تواند خالی باشد."
+"خط فرمان لینوکس ذیل از /etc/default/grub یا پارامتر های `kopt' در فایل menu."
+"lst از گراب قدیمی استخراج شده است. لطفاً صحت آن را بررسی کنید، و در صورت لزوم "
+"آن را تغییردهید. این خط فرمان می‌تواند خالی باشد."
 
 #. Type: string
 #. Description
@@ -328,7 +336,7 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 
 #. Type: boolean
@@ -336,12 +344,12 @@ msgstr ""
 #: ../templates.in:3001
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 
 #. Type: boolean
@@ -385,6 +393,94 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"بستهٔ grub-pc در حال ارتقاء است. این منو به شما اجازه می‌دهد که هر یک از "
+"دستگاه‌ها را، در صورت وجود، که مایلید grub-install به صورت خودکار برایش اجرا "
+"گردد را انتخاب کنید."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"شما نصب GRUB را برای هیچ ابزاری انتخاب نکرده‌اید. اگر ادامه دهید، ممکن است که "
+"راه‌انداز به درستی تنظیم نشده باشد، و هنگام بالا آمدن بعدی این کامپیوتر، از "
+"آن چه که قبلاً بر روی بوت سکتور بوده است استفاده می‌کند. اگر نسخهٔ قدیمی‌تری از "
+"گراب۲ بر روی بوت سکتور وجود دارد، ممکن است که قادر نباشد ماژول‌ها را بارگذاری "
+"کند و یا پیکربندی کنونی فایل را به کار بندد."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "خط فرمان kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/fi.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/fi.po
--- 2.14~git20250718.0e36779-1/debian/po/fi.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/fi.po	2025-09-08 10:56:27.000000000 +0000
@@ -4,7 +4,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2014-12-27 18:53+0200\n"
 "Last-Translator: Timo Jyrinki <timo.jyrinki@iki.fi>\n"
 "Language-Team: Finnish <debian-l10n-finnish@lists.debian.org>\n"
@@ -71,6 +71,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Laitteet joille GRUB asennetaan:"
 
@@ -86,7 +87,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -126,7 +127,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -157,7 +158,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "GRUBin kirjoittaminen käynnistyslaitteelle epäonnistui. Jatketaanko?"
 
@@ -166,12 +167,13 @@ msgstr "GRUBin kirjoittaminen käynnisty
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUBia ei voitu asentaa seuraaville laitteille:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -201,7 +203,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Jatketaanko asentamatta GRUBia?"
 
@@ -223,7 +225,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -298,6 +300,12 @@ msgstr ""
 "käynnistystietoja luotu johonkin toiseen käyttöjärjestelmään asennetulla "
 "GRUB 2:lla."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -336,20 +344,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Pakotetaanko lisäasennus irrotettavissa olevan median EFI-polkuun?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Jotkin EFI-järjestelmät sisältävät ohjelmavirheitä joidenka takia ne eivät "
 "käsittele alkulatausohjelmia oikein. Jos pakotat GRUB:n lisäasentamisen "
@@ -401,6 +420,93 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"grub-pc-pakettia päivitetään. Tästä valikosta voit valita, mille laitteille "
+"grub-install suoritetaan automaattisesti."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Päätit olla asentamatta GRUBia millekään laitteelle. Jos jatkat, "
+"alkulatausohjelman asetukset saattavat olla väärät ja kun kone käynnistetään "
+"uudelleen seuraavan kerran, se käyttää käynnistyslohkon aiempia asetuksia. "
+"Jos käynnistyslohkossa on GRUB 2:n aiempi versio, se ei välttämättä pysty "
+"lataamaan moduuleja tai käsittelemään nykyistä asetustiedostoa."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD:n komentorivi:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/fr.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/fr.po
--- 2.14~git20250718.0e36779-1/debian/po/fr.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/fr.po	2025-09-08 10:56:27.000000000 +0000
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: fr\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-04-26 19:30+0200\n"
 "Last-Translator: Baptiste Jammet <baptiste@mailoo.org>\n"
 "Language-Team: French <debian-l10n-french@lists.debian.org>\n"
@@ -74,6 +74,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Périphériques sur lesquels installer GRUB :"
 
@@ -90,7 +91,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -132,7 +133,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -164,7 +165,7 @@ msgstr "- ${DEVICE} (${SIZE} Mo; ${PATH
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr ""
 "Échec de l'installation de GRUB sur le périphérique d'amorçage. Faut-il "
@@ -175,12 +176,13 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUB n'a pas pu être installé sur les périphériques suivants :"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -210,7 +212,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Faut-il poursuivre sans installer GRUB ?"
 
@@ -233,7 +235,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -313,6 +315,12 @@ msgstr ""
 "GRUB 2 à moins que ces secteurs d'amorçage n'aient été créés par une "
 "installation de GRUB 2 d'un autre système d'exploitation."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -351,7 +359,9 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 "Faut-il forcer une installation supplémentaire sur le chemin des supports "
 "amovibles EFI ?"
@@ -359,14 +369,23 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Certains systèmes EFI ne gèrent pas correctement les nouveaux chargeurs "
 "d'amorçage. Si vous forcez l'installation de GRUB sur le chemin des supports "
@@ -435,6 +454,95 @@ msgstr ""
 "peut causer des dégâts à ces systèmes invités. En effet, les systèmes de "
 "fichiers seront montés pour être analysés."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Le paquet grub-pc est en cours de mise à jour. Ce menu permet de choisir "
+"pour quels périphériques vous souhaitez exécuter la commande grub-install "
+"automatiquement."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} Mo; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Vous avez choisi de n'installer GRUB sur aucun périphérique. Si vous "
+"poursuivez, il est possible que le chargeur d'amorçage ne soit pas configuré "
+"correctement et que la machine démarre avec ce qui était précédemment "
+"installé sur le secteur d'amorçage. Si une ancienne version de GRUB 2 s'y "
+"trouve, il est possible qu'elle ne puisse pas charger certains modules ou "
+"lire le fichier de configuration actuel."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Ligne de commande de kFreeBSD :"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/gl.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/gl.po
--- 2.14~git20250718.0e36779-1/debian/po/gl.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/gl.po	2025-09-08 10:56:27.000000000 +0000
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2_1.98+20100804-2_gl\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2012-06-13 16:13+0200\n"
 "Last-Translator: Jorge Barreiro <yortx.barry@gmail.com>\n"
 "Language-Team: Galician <proxecto@trasno.net>\n"
@@ -74,6 +74,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Dispositivos onde instalar GRUB:"
 
@@ -90,7 +91,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -130,7 +131,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -161,7 +162,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr ""
 "Produciuse un erro ao escribir GRUB no dispositivo de arranque. Quere "
@@ -172,12 +173,13 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Non se puido instalar GRUB nos seguintes dispositivos:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -207,7 +209,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Quere continuar sen instalar GRUB?"
 
@@ -229,7 +231,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -305,6 +307,12 @@ msgstr ""
 "de inicio fosen creatos por unha instalación de GRUB 2 en outro sistema "
 "operativo."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -343,7 +351,7 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 
 #. Type: boolean
@@ -351,12 +359,12 @@ msgstr ""
 #: ../templates.in:3001
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 
 #. Type: boolean
@@ -400,6 +408,94 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"O paquete «grub-pc» estase actualizando. Este menú permítelle escoller os "
+"dispositivos onde queira que se execute «grub-install» automaticamente, se "
+"quere facelo en algún."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Escolleu non instalar GRUB en ningún dispositivo. De continuar,pode que o "
+"cargador de arranque non quede adecuadamente configurado, e a próxima vez "
+"que arranque o sistema usarase o que houbese antes no sector de arranque. Se "
+"nel hai unha versión antiga de GRUB 2 pode que esta sexa incapaz de cargar "
+"os módulos ou de manexar o ficheiro de configuración actual."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Liña de comando de kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/gu.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/gu.po
--- 2.14~git20250718.0e36779-1/debian/po/gu.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/gu.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub-gu\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2012-03-04 09:56+0530\n"
 "Last-Translator: Kartik Mistry <kartik@debian.org>\n"
 "Language-Team: Gujarati <LL@li.org>\n"
@@ -67,6 +67,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB સ્થાપન ઉપકરણો:"
 
@@ -82,7 +83,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -120,7 +121,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -150,7 +151,7 @@ msgstr "- ${DEVICE} (${SIZE} એમબ
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "GRUB ને બૂટ ઉપકરણમાં લખવાનું નિષ્ફળ ગયું - ચાલુ રાખશો?"
 
@@ -159,12 +160,13 @@ msgstr "GRUB ને બૂટ ઉપક
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUB નીચેના ઉપકરણોમાં સ્થાપિત થવામાં નિષ્ફળ ગયું:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -191,7 +193,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "GRUB સ્થાપન કર્યા વગર આગળ વધશો?"
 
@@ -212,7 +214,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -283,6 +285,12 @@ msgstr ""
 "તમે સામાન્ય રીતે GRUB 2 માં રુપાંતર કરી લીધું છે સિવાય કે આ બૂટ રેકોર્ડ GRUB 2 સ્થાપન વડે "
 "કોઈ બીજી ઓપરેટિંગ સિસ્ટમમાં બનાવવામાં આવ્યા હોય."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -320,7 +328,7 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 
 #. Type: boolean
@@ -328,12 +336,12 @@ msgstr ""
 #: ../templates.in:3001
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 
 #. Type: boolean
@@ -377,6 +385,92 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"grub-pc પેકેજ સુધારાઈ રહ્યું છે. આ મેનુ તમને કયા ઉપકરણોમાં તમે grub-install આપમેળે સ્થાપિત "
+"કરવા માટે ચલાવવા માંગો છો તે પસંદગી કરવા દે છે, જો કોઈ હોય તો."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} એમબી; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"તમે GRUB ને કોઈપણ ઉપકરણમાં સ્થાપિત કરવાનું પસંદ કરેલ નથી, જો તમે ચાલુ રાખશો તો, બૂટ "
+"લોડર કદાચ યોગ્ય રીતે ગોઠવાયેલ નહી હોય, અને આ કોમ્પ્યુટર હવે ફરી શરુ થાય ત્યારે તે પહેલાંનું "
+"જે હોય તે બૂટ વિભાગ ઉપયોગ કરશે. જો તેમાં પહેલાની GRUB 2 આવૃત્તિ બૂટ સેક્ટર પર હશે તો, "
+"કદાચ તે મોડ્યુલ લાવવા અથવા હાલનાં રુપરેખાંકન ફાઈલને સંભાળવામાં અસમર્થ બનશે."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD આદેશ:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/he.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/he.po
--- 2.14~git20250718.0e36779-1/debian/po/he.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/he.po	2025-09-08 10:56:27.000000000 +0000
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub_debian_po_he\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2014-12-17 18:35+0200\n"
 "Last-Translator: Omer Zak\n"
 "Language-Team: Hebrew <kde-i18n-doc@kde.org>\n"
@@ -41,9 +41,9 @@ msgid ""
 "from your existing GRUB Legacy setup. This step can be automatically "
 "performed now."
 msgstr ""
-"כדי להחליף את גירסת GRUB הישנה במערכת שלך, מומלץ לשנות את ‎/boot/grub/"
-"menu.lst כך שיבצע הטענה משורשרת של קוד האיתחול של GRUB 2 מהגדרות GRUB הישנות "
-"שלך. ניתן לבצע פעולה זו באופן אוטומטי עכשיו."
+"כדי להחליף את גירסת GRUB הישנה במערכת שלך, מומלץ לשנות את ‎/boot/grub/menu."
+"lst כך שיבצע הטענה משורשרת של קוד האיתחול של GRUB 2 מהגדרות GRUB הישנות שלך. "
+"ניתן לבצע פעולה זו באופן אוטומטי עכשיו."
 
 #. Type: boolean
 #. Description
@@ -71,6 +71,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "התקנים להתקנת GRUB:"
 
@@ -86,7 +87,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -124,7 +125,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -153,7 +154,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "כשלון בכתיבת GRUB להתקן האתחול - להמשיך?"
 
@@ -162,12 +163,13 @@ msgstr "כשלון בכתיבת GRUB ל
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "כשלון בהתקנת GRUB בהתקנים הבאים:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -192,7 +194,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "להמשיך בלי להתקין GRUB?"
 
@@ -213,7 +215,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -284,6 +286,12 @@ msgstr ""
 "בדרך כלל עליך לסיים את ההמרה ל-GRUB 2 אלא אם רשומות אתחול אלה נוצרו על ידי "
 "התקנת GRUB 2 במערכת הפעלה אחרת."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -321,20 +329,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "לאלץ התקנה נוספת לנתיב מדיה EFI הניתן להסרה?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "כמה מערכות מבוססות EFI מכילות בגים ואינן מתמודדות נכונות עם מאתחלים חדשים. "
 "אם הינך מאלץ התקנה נוספת של GRUB לנתיב מדיה EFI הניתן להסרה, הדבר אמור "
@@ -383,6 +402,92 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"חבילת grub-pc משתדרגת כעת. תפריט זה מאפשר לך לבחור בהתקנים שברצונך ש-grub-"
+"install ירוץ עליהם אוטומטית, באם יש כאלה."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"בחרת לא להתקין GRUB באף התקן. אם תמשיך, ייתכן שמנהל האתחול לא יהיה מוגדר "
+"כיאות, ובפעם הבאה שמחשבך יאותחל, הוא יאותחל ממה שהיה קודם ב-boot sector. אם "
+"יש גירסא מוקדמת יותר של GRUB 2 ב-boot sector, ייתכן שלא יהיה ביכולתה להטעין "
+"מודולים או להתמודד עם קובץ ההגדרות הנוכחי."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "שורת הפקודה של kFreeBSD:"
 
@@ -392,9 +497,9 @@ msgstr ""
 #~ "is correct, and modify it if necessary. The command line is allowed to be "
 #~ "empty."
 #~ msgstr ""
-#~ "שורת פקודת kFreeBSD הבאה נשלפה מ-‎/etc/default/grub או מפרמטר'kopt' "
-#~ "ב-menu.lst הישן של GRUB. בבקשה לוודא ששורת פקודה זו נכונה ועדכן אותה אם "
-#~ "צריך. ניתן להשאיר שורת פקודה זו ריקה."
+#~ "שורת פקודת kFreeBSD הבאה נשלפה מ-‎/etc/default/grub או מפרמטר'kopt' ב-menu."
+#~ "lst הישן של GRUB. בבקשה לוודא ששורת פקודה זו נכונה ועדכן אותה אם צריך. "
+#~ "ניתן להשאיר שורת פקודה זו ריקה."
 
 #~ msgid "kFreeBSD default command line:"
 #~ msgstr "ברירת מחדל לשורת הפקודה של kFreeBSD:"
diff -pruN 2.14~git20250718.0e36779-1/debian/po/hr.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/hr.po
--- 2.14~git20250718.0e36779-1/debian/po/hr.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/hr.po	2025-09-08 10:56:27.000000000 +0000
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2 1.97-2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-04-25 13:07+0200\n"
 "Last-Translator: Tomislav Krznar <tomislav.krznar@gmail.com>\n"
 "Language-Team: hrvatski <lokalizacija@linux.hr>\n"
@@ -73,6 +73,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB uređaji za instalaciju:"
 
@@ -88,15 +89,15 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
 "modules or grub.cfg."
 msgstr ""
 "Automatsko pokretanje grub-install je preporučeno u većini slučajeva kako bi "
-"instalirana GRUB osnovna slika bila sinkronizirana s GRUB modulima ili "
-"grub.cfg."
+"instalirana GRUB osnovna slika bila sinkronizirana s GRUB modulima ili grub."
+"cfg."
 
 #. Type: multiselect
 #. Description
@@ -128,7 +129,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -159,7 +160,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Instalacija GRUB-a nije uspjela - želite li nastaviti?"
 
@@ -168,12 +169,13 @@ msgstr "Instalacija GRUB-a nije uspjela
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUB nije uspješno instaliran na sljedeće uređaje:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -201,7 +203,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Nastaviti bez instalacije GRUB-a?"
 
@@ -223,7 +225,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -298,6 +300,12 @@ msgstr ""
 "boot zapisi napravljeni instalacijom GRUB 2 na nekom drugom operacijskom "
 "sustavu."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -335,20 +343,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Prisilno dodatno instalirati u EFI direktorij prijenosnog medija?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Neki EFI sustavi imaju bugove i ne rade ispravno s novim boot učitavačima. "
 "Ako prisilno dodatno instalirate GRUB u EFI direktorij prijenosnog medija, "
@@ -414,6 +433,93 @@ msgstr ""
 "instalirani virtualni operacijski sustavi na LVM ili 'neobrađene' diskove, "
 "može doći do njihovog oštećenja."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Paket grub-pc se nadograđuje. Ovaj izbornik omogućava biranje uređaja za "
+"koje želite automatski pokrenuti grub-install, ako postoje."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Odabrali ste da ne instalirate GRUB ni na jedan uređaj. Ako nastavite, boot "
+"učitavač neće biti ispravno podešen, a kada se vaše računalo idući put "
+"upali, koristit će što god je prethodno bilo u boot sektoru. Ako se tamo "
+"nalazi ranija verzija GRUB 2, možda će doći do problema s učitavanjem modula "
+"ili čitanjem trenutne datoteke postavki."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD naredbeni redak:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/hu.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/hu.po
--- 2.14~git20250718.0e36779-1/debian/po/hu.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/hu.po	2025-09-08 10:56:27.000000000 +0000
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2013-05-18 15:44+0200\n"
 "Last-Translator: Dr. Nagy Elemér Károly <eknagy@omikk.bme.hu>\n"
 "Language-Team: Hungarian <debian-l10n-hungarian@lists.d.o>\n"
@@ -72,6 +72,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB telepítési eszközök:"
 
@@ -88,7 +89,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -128,7 +129,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -159,7 +160,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Nem sikerül a GRUB-ot a rendszerlemezre írni - folytassuk?"
 
@@ -168,12 +169,13 @@ msgstr "Nem sikerül a GRUB-ot a rendsze
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Nem sikerült a GRUB-ot a következő eszközökre telepíteni:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -201,7 +203,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "GRUB telepítése nélkül folytassuk:"
 
@@ -224,7 +226,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -299,6 +301,12 @@ msgstr ""
 "rendszerbetöltő rekordok egy másik operációs rendszeren futó GRUB 2 "
 "telepítéssel készültek."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -336,7 +344,7 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 
 #. Type: boolean
@@ -344,12 +352,12 @@ msgstr ""
 #: ../templates.in:3001
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 
 #. Type: boolean
@@ -393,6 +401,95 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"A grub-pc csomagot frissítjük. Ebben a menüben kiválaszthatod, hogy melyik "
+"egységekre szeretnéd automatikusan futtatni a grub-install parancsot, ha van "
+"ilyen."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Úgy döntöttél, hogy ne telepítsük a GRUB-ot egyetlen eszközre sem. Ha "
+"folytatod, lehet, hogy nem lesz jól beállítva a rendszerbetöltőd és a "
+"számítógéped következő indulásakor az fog elindulni, ami korábban a "
+"rendszerbetöltő szektorban volt. Ha ebben a GRUB 2 egy régebbi verziója van, "
+"lehet, hogy nem tudja majd betölteni a moduljait vagy nem lesz képes "
+"értelmezni a jelenlegi konfigurációs fájlt."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD parancssor:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/id.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/id.po
--- 2.14~git20250718.0e36779-1/debian/po/id.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/id.po	2025-09-08 10:56:27.000000000 +0000
@@ -8,11 +8,11 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2022-03-15 17:45+0700\n"
 "Last-Translator: Andika Triwidada <andika@gmail.com>\n"
-"Language-Team: Debian Indonesian Translation Team <debian-l10n-"
-"id@gurame.fisika.ui.ac.id>\n"
+"Language-Team: Debian Indonesian Translation Team <debian-l10n-id@gurame."
+"fisika.ui.ac.id>\n"
 "Language: id\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=utf-8\n"
@@ -74,6 +74,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Piranti pemasangan GRUB:"
 
@@ -90,7 +91,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -130,7 +131,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -161,7 +162,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Gagal menulis GRUB ke piranti boot - lanjutkan?"
 
@@ -170,12 +171,13 @@ msgstr "Gagal menulis GRUB ke piranti bo
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Gagal memasang GRUB pada piranti berikut ini:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -203,7 +205,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Lanjutkan tanpa memasang GRUB?"
 
@@ -225,7 +227,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -300,6 +302,12 @@ msgstr ""
 "Anda sebaiknya menyelesaikan konversi ke GRUB 2 kecuali jika rekam boot ini "
 "dibuat melalui pemasangan GRUB 2 pada sistem operasi lain."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -337,20 +345,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Paksakan instalasi ekstra ke path media lepasan EFI?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Beberapa sistem berbasis EFI memiliki bug dan tidak menangani bootloader "
 "baru dengan benar. Jika Anda memaksa instalasi tambahan GRUB ke path media "
@@ -408,6 +427,94 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Paket grub-pc sedang ditingkatkan. Menu ini memungkinkan Anda memilih "
+"piranti yang Anda inginkan untuk menjalankan grub-install secara otomatis, "
+"bila ada."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Anda memilih tidak memasang GRUB di piranti apapun. Jika Anda lanjutkan, "
+"pemuat boot mungkin tidak terkonfigurasi dengan benar, dan ketika komputer "
+"ini dinyalakan kembali, maka apapun yang sebelumnya ada di bootsector akan "
+"digunakan. Jika ada versi lebih lama GRUB 2 di bootsector, mungkin tidak "
+"dapat memuat modul-modul atau menangani berkas konfigurasi mutakhir."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Baris perintah kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/is.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/is.po
--- 2.14~git20250718.0e36779-1/debian/po/is.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/is.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub_debian_po_is\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2014-12-13 23:20+0000\n"
 "Last-Translator: Sveinn í Felli <sv1@fellsnet.is>\n"
 "Language-Team: Icelandic <translation-team-is@lists.sourceforge.net>\n"
@@ -73,6 +73,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB uppsetningartæki:"
 
@@ -88,7 +89,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -128,7 +129,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -159,7 +160,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Uppsetning GRUB á ræsitæki mistókst. Halda áfram?"
 
@@ -168,12 +169,13 @@ msgstr "Uppsetning GRUB á ræsitæki mi
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Uppsetning GRUB mistókst á eftirfarandi tækjum:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -201,7 +203,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Halda áfram án þess að setja upp GRUB?"
 
@@ -224,7 +226,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -298,6 +300,12 @@ msgstr ""
 "Almennt ættirðu að ljúka umbreytingu í GRUB 2 nema ef þessar ræsifærslur "
 "hafi verið útbúnar af GRUB 2 uppsetningu í einhverju öðru stýrikerfi."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -335,20 +343,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Þvinga aukauppsetningu inn á EFI-slóðina fyrir útskiptanlega miðla?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Sum EFI-kerfi eru ekki villulaus og meðhöndla nýja ræsistjóra (bootloaders) "
 "ekki rétt. Ef þú þvingar aukauppsetningu af GRUB inn á EFI-slóðina fyrir "
@@ -399,6 +418,94 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Verið er að uppfæra grub-pc pakkann. Þessi valmynd gerir þér kleift að velja "
+"af hvaða tækjum hægt er að keyra grub-install sjálfvirkt, ef þá nokkrum."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Þú valdir að setja GRUB ekki upp á neitt tæki. Ef þú heldur áfram verður "
+"ræsistjórinn ekki rétt stilltur, og þegar tölvan þín ræsist næst mun hún "
+"nota hvað það sem fyrir er núna á ræsigeiranum. Ef á ræsigeiranum er til "
+"dæmis eldri útgáfa af GRUB 2, er möguleiki á að hún ráði ekki við að hlaða "
+"inn ákveðnum kjarnaeiningum eða nái ekki að lesa stillingaskrána fyrir þetta "
+"stýrikerfi."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD skipanalína:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/it.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/it.po
--- 2.14~git20250718.0e36779-1/debian/po/it.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/it.po	2025-09-08 10:56:27.000000000 +0000
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2 2.02~beta3-4 italian debconf templates\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-04-29 21:20+0200\n"
 "Last-Translator: Luca Monducci <luca.mo@tiscali.it>\n"
 "Language-Team: Italian <debian-l10n-italian@lists.debian.org>\n"
@@ -70,6 +70,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Installare GRUB sui device:"
 
@@ -86,7 +87,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -126,7 +127,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -157,7 +158,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Scrittura di GRUB sul device di avvio non riuscita. Continuare?"
 
@@ -166,12 +167,13 @@ msgstr "Scrittura di GRUB sul device di
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "L'installazione di GRUB sui seguenti device non è riuscita:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -199,7 +201,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Continuare senza installare GRUB?"
 
@@ -222,7 +224,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -297,6 +299,12 @@ msgstr ""
 "siano stati creati da un'altra installazione di GRUB 2 su un altro sistema "
 "operativo."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -335,20 +343,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Forzare l'installazione sul percorso dei supporti removibili EFI?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Alcuni sistemi EFI hanno degli errori e non gestiscono correttamente i nuovi "
 "bootloader. Forzando un'installazione aggiuntiva di GRUB sul percorso dei "
@@ -413,6 +432,95 @@ msgstr ""
 "potrebbe danneggiare i SO ospiti dato che per fare la ricerca monta i "
 "filesystem."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"È in corso l'aggiornamento del pacchetto grub-pc. Questo menu permette di "
+"scegliere su quali device, se specificati, si vuole eseguire automaticamente "
+"grub-install."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Si è scelto di non installare GRUB su alcun device. Continuando, il boot "
+"loader potrebbe non essere configurato correttamente e al prossimo avvio del "
+"computer verrà usato il vecchio contenuto del settore di boot. Se nel "
+"settore di boot è presente una versione precedente di GRUB 2, questa "
+"potrebbe non essere in grado di caricare i moduli o di gestire l'attuale "
+"file di configurazione."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Riga di comando kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/ja.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/ja.po
--- 2.14~git20250718.0e36779-1/debian/po/ja.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/ja.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2 1.99-5\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2016-03-03 09:57+0900\n"
 "Last-Translator: Takuma Yamada <tyamada@takumayamada.com>\n"
 "Language-Team: Japanese <debian-japanese@lists.debian.org>\n"
@@ -72,6 +72,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB をインストールするデバイス:"
 
@@ -87,7 +88,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -127,7 +128,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -158,7 +159,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "起動デバイスへの GRUB の書き込みが失敗しました - 続行しますか?"
 
@@ -167,12 +168,13 @@ msgstr "起動デバイスへの GRUB 
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUB は以下のデバイスへのインストールに失敗しました:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -201,7 +203,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "GRUB をインストールせずにパッケージのインストールを続行しますか?"
 
@@ -224,7 +226,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -298,6 +300,12 @@ msgstr ""
 "他の OS 上での GRUB 2 のインストールによって作成されていたブートレコードを除"
 "き、GRUB 2 へのコンバートはほぼ完了しました。"
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -335,20 +343,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "EFI リムーバブルメディアパスに特別インストールを強制しますか?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "一部の EFI ベースのシステムにはバグがあり、正しく新しいブートローダーを扱うこ"
 "とができません。EFI リムーバブルメディアパスに GRUB の特別インストールを強制"
@@ -398,6 +417,94 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"grub-pc パッケージのアップグレード中です。このメニューでは、もしデバイスがあ"
+"れば、どのデバイスに自動的に grub-install を実行するかを選べます。"
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"どのデバイスに対しても GRUB をインストールしないことが選択されました。ブート"
+"ローダーが正しく設定されていない可能性があり、このまま続行するとこのコン"
+"ピュータの次回起動時には、以前に起動セクタにインストールされていたものを何で"
+"あろうとも利用しようとします。以前のバージョンの GRUB 2 が起動セクタにある場"
+"合は、モジュールの読み込みや現在の設定ファイルの取り扱いができなくなる可能性"
+"があります。"
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD コマンドライン:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/ka.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/ka.po
--- 2.14~git20250718.0e36779-1/debian/po/ka.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/ka.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2009-08-30 18:05+0400\n"
 "Last-Translator: Aiet Kolkhi <aietkolkhi@gmail.com>\n"
 "Language-Team: Georgian <aiet@gakartuleba.org>\n"
@@ -83,6 +83,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr ""
 
@@ -96,7 +97,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -127,7 +128,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -153,7 +154,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr ""
 
@@ -162,12 +163,13 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -190,7 +192,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr ""
 
@@ -207,7 +209,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -267,6 +269,12 @@ msgid ""
 "records were created by a GRUB 2 installation on some other operating system."
 msgstr ""
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -309,7 +317,7 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 
 #. Type: boolean
@@ -317,12 +325,12 @@ msgstr ""
 #: ../templates.in:3001
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 
 #. Type: boolean
@@ -366,6 +374,73 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD ბრძანების სტრიქონი:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/kk.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/kk.po
--- 2.14~git20250718.0e36779-1/debian/po/kk.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/kk.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: master\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-04-25 21:51+0600\n"
 "Last-Translator: Baurzhan Muftakhidinov <baurthefirst@gmail.com>\n"
 "Language-Team: Kazakh <kk_KZ@googlegroups.com>\n"
@@ -70,6 +70,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB орнатылатын құрылғылар:"
 
@@ -86,7 +87,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -125,7 +126,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -155,7 +156,7 @@ msgstr "- ${DEVICE} (${SIZE} МБ; ${PAT
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "GRUB-ты жүктелу құрылғысына жазу сәтсіз - жалғастыру керек пе?"
 
@@ -164,12 +165,13 @@ msgstr "GRUB-ты жүктелу құр
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUB келесі құрылғыларға орнату сәтсіз аяқталды:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -197,7 +199,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "GRUB орнатпай-ақ жалғастыру керек пе?"
 
@@ -219,7 +221,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -291,6 +293,12 @@ msgstr ""
 "GRUB 2 дейін жаңартуды аяқтауыңыз керек, егер осы жүктелу жазбалары басқа "
 "жүйеде орнатылған GRUB 2 көмегімен жасалмаған болса."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -328,20 +336,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "EFI ауыстырмалы тасушыға қосымша орнатуды мәжбүрлету керек пе?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Кейбір EFI негізіндегі жүйелер толығымен дұрыс жасамайды және жаңа "
 "жүктеушілерді дұрыс өңдемейді. Егер сіз қосымша түрде GRUB-ты EFI "
@@ -406,6 +425,94 @@ msgstr ""
 "іздеу кезінде файлдар жүйелерін тіркейтін соң сол қонақ ОС-ге зиян келтіруі "
 "мүмкін."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"grub-pc дестесі жаңартылуда. Бұл мәзір сізге қай құрылғылар үшін grub-"
+"install автожөнелту қалайтыныңызды көрсетуге мүмкін қылады, егер ондай "
+"құрылғылар бар болса."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} МБ; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Сіз GRUB-ты ешбір құрылғыға орнатпауды қалағансыз. Жалғастырсаңыз, жүктеуші "
+"дұрыс бапталмауы мүмкін, және компьютеріңіз келесі рет жүктелген кезде, "
+"жүктелу жазбасында оған дейін болған нәрсені қолданады. Егер ол жүктелу "
+"жазбасында GRUB 2 ертерек шыққан нұсқасы болса, ол модульдерді жүктей алмай, "
+"не ағымдағы баптаулар файлын талдай алмайтын болуы әдбен мүмкін."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD командалық жолы:"
 
@@ -415,9 +522,9 @@ msgstr ""
 #~ "is correct, and modify it if necessary. The command line is allowed to be "
 #~ "empty."
 #~ msgstr ""
-#~ "Келесі kFreeBSD командасы /etc/default/grub ішінен не GRUB Legacy "
-#~ "menu.lst ішіндегі `kopt' параметрінен алынды. Оның дұрыстығын тексеріп, "
-#~ "керек болса, өзгертіңіз. Бұл командалық жол бос болса да болады."
+#~ "Келесі kFreeBSD командасы /etc/default/grub ішінен не GRUB Legacy menu."
+#~ "lst ішіндегі `kopt' параметрінен алынды. Оның дұрыстығын тексеріп, керек "
+#~ "болса, өзгертіңіз. Бұл командалық жол бос болса да болады."
 
 #~ msgid "kFreeBSD default command line:"
 #~ msgstr "kFreeBSD бастапқы командалық жолы:"
diff -pruN 2.14~git20250718.0e36779-1/debian/po/km.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/km.po
--- 2.14~git20250718.0e36779-1/debian/po/km.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/km.po	2025-09-08 10:56:27.000000000 +0000
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub_debian_po\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2012-04-05 15:38+0700\n"
 "Last-Translator: Khoem Sokhem <khoemsokhem@khmeros.info>\n"
 "Language-Team: Khmer <support@khmeros.info>\n"
@@ -68,6 +68,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB ដំឡើង​ឧបករណ៍ ៖"
 
@@ -83,7 +84,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -121,7 +122,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -151,7 +152,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "បាន​បរាជ័យ​ក្នុង​ការ​សរសេរ​ GRUB ទៅ​​ឧបករណ៍​ចាប់ផ្ដើម បន្ត ?"
 
@@ -160,12 +161,13 @@ msgstr "បាន​បរាជ័យ
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUB បាន​បរាជ័យ​ក្នុង​ការ​ដំឡើង​ឧបករណ៍​ដូ​ចខាង​ក្រោម ៖"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -191,7 +193,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "បន្ត​ដោយ​មិន​ដំឡើង GRUB?"
 
@@ -212,7 +214,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -283,6 +285,12 @@ msgstr ""
 "ជា​ទូទៅ អ្នក​គួរ​តែ​បញ្ចប់​ការ​បម្លែង​ទៅ GRUB 2 លុះត្រា​តែ​ផ្នែក​ចាប់ផ្ដើម​ត្រូវ​បាន​បង្កើត​ដោយ​ការ​ដំឡើង "
 "GRUB 2 នៅ​លើ​ប្រព័ន្ធ​ប្រតិបត្តិការ​ផ្សេង ។"
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -320,7 +328,7 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 
 #. Type: boolean
@@ -328,12 +336,12 @@ msgstr ""
 #: ../templates.in:3001
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 
 #. Type: boolean
@@ -377,6 +385,92 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"កញ្ចប់ grub-pc កំពុង​ត្រូវ​បាន​ធ្វើ​ឲ្យ​ប្រសើរឡើង ។ ម៉ឺនុយ​នេះ​អនុញ្ញាត​ឲ្យ​អ្នក​ជ្រើស​ឧបករណ៍​ណាមួយ​ ដែល​អ្នក​"
+"ចង់​ grub-install ដំណើរការ​ដោយ​ស្វ័យ​ប្រវត្តិ ប្រសិនបើ​មាន ។"
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"អ្នក​បាន​ជ្រើសរើស​ថា​មិន​ដំឡើង​ GRUB ក្នុង​ឧបករណ៍​ណាមួយ​ទេ ។ ប្រសិនបើ​អ្នក​បន្ត ​កម្មវិធី​ចាប់ផ្ដើម​ប្រព័ន្ធ​អាច​"
+"មិន​​ត្រូវ​បាន​កំណត់​រចនាសម្ព័ន្ធ​ត្រឹមត្រូវ​ទេ ហើយ​នៅ​ពេល​កុំព្យូទ័រ​នេះ​ចាប់ផ្ដើម​ពេល​ក្រោយ វា​នឹង​ប្រើ​អ្វី​ដែល​មាន​"
+"ពីមុន​នៅ​ក្នុង​ផ្នែក​ចាប់ផ្ដើម ។ ប្រសិន​បើ​គ្មាន​កំណែ GRUB 2 ពី​មុន​នៅ​ក្នុង​ផ្នែក​ចាប់ផ្ដើម​ទេ វា​​មិន​អាច​ផ្ទុក​"
+"ម៉ូឌុល ឬ​ដោះស្រាយ​ឯកសារ​កំណត់​រចនាសម្ព័ន្ធ​បច្ចុប្បន្ន​បាន​ទេ ។"
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "ពាក្យ​បញ្ជា kFreeBSD ៖"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/ko.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/ko.po
--- 2.14~git20250718.0e36779-1/debian/po/ko.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/ko.po	2025-09-08 10:56:27.000000000 +0000
@@ -4,7 +4,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub_debian\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-04-26 18:55+0900\n"
 "Last-Translator: Changwoo Ryu <cwryu@debian.org>\n"
 "Language-Team: Korean <debian-l10n-korean@lists.debian.org>\n"
@@ -67,6 +67,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB 설치 장치:"
 
@@ -82,7 +83,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -120,7 +121,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -150,7 +151,7 @@ msgstr "- ${DEVICE} (${SIZE} MB, ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "GRUB을 부팅 장치에 쓰는데 실패했습니다. 계속 하시겠습니까?"
 
@@ -159,12 +160,13 @@ msgstr "GRUB을 부팅 장치에 쓰는
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "다음 장치에 대해 GRUB 설치가 실패했습니다:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -191,7 +193,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "GRUB을 설치하지 않고 계속하시겠습니까?"
 
@@ -213,7 +215,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -285,6 +287,12 @@ msgstr ""
 "일반적인 경우 GRUB 2 전환을 마쳐야 합니다. 예외는 부트레코드의 GRUB 2를 다른 "
 "운영체제에서 설치한 경우입니다."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -322,20 +330,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "EFI 이동식 미디어 경로에 추가로 강제 설치하시겠습니까?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "일부 EFI 기반 시스템에는 버그 때문에 새로운 부트로더를 제대로 처리하지 못합니"
 "다. GRUB을 EFI 이동식 미디어 경로에 추가로 강제 설치하면, 이러한 버그가 있더"
@@ -394,6 +413,93 @@ msgstr ""
 "치되어 있는 호스트 컴퓨터라면, os-prober를 실행하면 os-prober에서 파일 시스템"
 "을 마운트해서 검색하기 때문에 이 게스트 운영 체제가 손상될 수 있습니다."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"grub-pc 패키지를 업그레이드하는 중입니다. 이 메뉴에서 (실행할 장치가 있다면) "
+"어떤 장치에 대해 grub-install을 자동으로 실행할지 설정합니다."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB, ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"GRUB을 어떤 장치에도 설치하지 않도록 선택하셨습니다. 계속 하시면 부트로더가 "
+"제대로 설정되지 않을 수도 있고, 다음번에 컴퓨터가 시작할 때 예전에 부트 섹터"
+"에 들어 있는 부트로더를 사용합니다. GRUB 2의 예전 버전이 부트섹터에 들어 있으"
+"면 그 예전 버전은 GRUB 모듈을 읽어들이거나 현재 설정 파일을 처리하지 못할 수"
+"도 있습니다."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD 명령어:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/lt.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/lt.po
--- 2.14~git20250718.0e36779-1/debian/po/lt.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/lt.po	2025-09-08 10:56:27.000000000 +0000
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2017-01-20 09:03+0300\n"
 "Last-Translator: Rimas Kudelis <rq@akl.lt>\n"
 "Language-Team: Lithuanian <komp_lt@konferencijos.lt>\n"
@@ -73,6 +73,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Įrenginiai „GRUB“ diegimui:"
 
@@ -88,7 +89,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -128,7 +129,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -159,7 +160,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "„GRUB“ įrašyti į paleidimo įrenginį nepavyko. Ar tęsti?"
 
@@ -168,12 +169,13 @@ msgstr "„GRUB“ įrašyti į paleidim
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Nepavyko „GRUB“ įdiegti į šiuos įrenginius:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -201,7 +203,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Ar tęsti neįdiegus „GRUB“?"
 
@@ -223,7 +225,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -297,6 +299,12 @@ msgstr ""
 "Paprastai derėtų užbaigti migraciją į „GRUB 2“, nebent šiuos paleidimo "
 "įrašus sukūrė „GRUB 2“ versija, įdiegta su kokia nors kita operacine sistema."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -335,20 +343,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Papildomai priverstinai įdiegti į EFI keičiamųjų laikmenų kelią?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Kai kurios EFI veiksena veikiančios sistemos turi klaidų ir negeba "
 "korektiškai dirbti su naujomis paleidyklėmis. „GRUB“ paleidyklę papildomai "
@@ -407,6 +426,93 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Atnaujinamas „grub-pc“ paketas. Šiame meniu galite pasirinkti, ar kuriems "
+"nors įrenginiams komanda „grub-install“ turėtų būti paleidžiama automatiškai."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Galima „GRUB“ paleidyklės ir nediegti į jokį įrenginį. Tokiu atveju ji nebus "
+"tinkamai sukonfigūruota ir kitąkart paleidus šį kompiuterį, bus bandoma "
+"įvykdyti tai, kas paleidimo sektoriuje buvo iki šiol. Jeigu jame įrašyta "
+"ankstesnė „GRUB 2“ versija, tikėtina, jog jai nepavyks įkelti reikiamų "
+"modulių ar tinkamai interpretuoti konfigūracinio failo."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "„kFreeBSD“ komandos eilutė:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/lv.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/lv.po
--- 2.14~git20250718.0e36779-1/debian/po/lv.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/lv.po	2025-09-08 10:56:27.000000000 +0000
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-04-30 22:01+0300\n"
 "Last-Translator: Rūdolfs Mazurs <rudolfs.mazurs@gmail.com>\n"
 "Language-Team: Latvian <lata-l10n@googlegroups.com>\n"
@@ -72,6 +72,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB instalēšanas ierīces:"
 
@@ -87,7 +88,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -127,7 +128,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -158,7 +159,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Neizdevās ierakstīt GRUB uz palaišanas ierīces — turpināt?"
 
@@ -167,12 +168,13 @@ msgstr "Neizdevās ierakstīt GRUB uz pa
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Neizdevās uzinstalēt GRUB uz šīm ierīcēm:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -199,7 +201,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Turpināt bez GRUB instalēšanas?"
 
@@ -221,7 +223,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -295,6 +297,12 @@ msgstr ""
 "Jums vajadzētu pabeigt pāreju uz GRUB 2, izņemot, ja šos palaišanas "
 "ierakstus izveidoja GRUB 2 instalācija no kādas citas operētājsistēmas."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -332,20 +340,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Forsēt papildu instalāciju uz EFI noņemamā datu nesēja ceļa?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Dažas EFI sistēmas ir satur kļūdas un nespēj pareizi apstrādāt jaunus "
 "sistēmas ielādētājus. Ja forsēsiet GRUB instalēšanu uz EFI noņemamā datu "
@@ -411,6 +430,93 @@ msgstr ""
 "operētājsistēmu meklētājs var sabojāt tās OS, jo, lai varētu meklēt, tas "
 "montē datņu sistēmas."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Tiek uzlabota grub-pc pakotne. Šī izvēlne ļauj jums izvēlēties ierīces, "
+"kuras grub-install vajadzētu palaists (ja vajag)."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Jūs varat izvēlēties neinstalēt GRUB uz nevienas ierīces. Ja turpināsiet, "
+"palaidējs varētu nebūt pareizi konfigurēts, un kad dators tiks palaists, tas "
+"izmantos to konfigurāciju, kas jau atrodas palaišanas sektorā. Ja palaišanas "
+"sektorā jau ir vecāka GRUB 2 versija, tā varētu nespēt ielādēt moduļus vai "
+"apstrādāt esošo konfigurācijas datni."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD komandrinda:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/mr.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/mr.po
--- 2.14~git20250718.0e36779-1/debian/po/mr.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/mr.po	2025-09-08 10:56:27.000000000 +0000
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2014-12-24 20:56+0530\n"
 "Last-Translator: localuser <sampada.n@rediffmail.com>\n"
 "Language-Team: C-DAC/Sampada\n"
@@ -69,6 +69,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "ग्रब अधिष्ठापना उपकरणे:"
 
@@ -84,7 +85,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -122,7 +123,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -152,7 +153,7 @@ msgstr "- ${DEVICE} (${SIZE} एमब
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "आरंभ उपकरणावर ग्रब लिहिणे फसले - सुरू ठेवायचे?"
 
@@ -161,12 +162,13 @@ msgstr "आरंभ उपकरणा
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "खालील उपकरणांवर ग्रब अधिष्ठापित करणे असफल झाले:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -193,7 +195,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "ग्रब अधिष्ठापित न करता पुढे जायचे?"
 
@@ -214,7 +216,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -285,6 +287,12 @@ msgstr ""
 "या आरंभ नोंदी अन्य कोणत्यातरी प्रचालन प्रणालीवर ग्रब 2 अधिष्ठापनेने निर्माण केलेल्या "
 "नसल्यास तुम्ही सामान्यतः ग्रब 2 मघ्ये परिवर्तन पूर्ण केले पाहिजे."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -322,20 +330,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "ईएफआय काढण्याजोग्या मिडीया मार्गात अतिरिक्त अधिष्ठापना जबरदस्ती करायची?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "काही ईएफआय-आधारित प्रणाली दोषपूर्ण असतात व नवीन आरंभसूचकांना योग्य रीतीने हाताळत "
 "नाहीत. तुम्ही ईएफआय काढण्याजोग्या मिडीया मार्गात ग्रबची अतिरिक्त अधिष्ठापना जबरदस्ती "
@@ -385,6 +404,92 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"ग्रब-पीसी पॅकेज श्रेणिवर्धित केले जात आहे. कोणत्या उपकरणांसाठी ग्रब-इन्स्टाल स्वयंचलितपणे "
+"चालवले जावे ते या मेन्यूद्वारे तुम्ही निवडू शकता."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} एमबी; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"कोणत्याही उपकरणांवर ग्रब अधिष्ठापित न करण्याचे तुम्ही निवडले आहे. तुम्ही पुढे चालू ठेवल्यास, "
+"हा आरंभ सूचक योग्यरित्या संरचित झालेला नसू शकतो, व हा संगणक पुन्हा सुरू होईल तेव्हा बूट "
+"सेक्टरमध्ये आधी जे काही होते ते वापरेल. बूट सेक्टरमध्ये ग्रब 2 ची आधीची आवृत्ती असेल, तर "
+"कदाचित तो मोड्युल्स लोड करू शकणार नाही वा सद्य संरचना फाईल हाताळू शकणार नाही."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "केफ्रीबीएसडी आदेश ओळ:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/nb.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/nb.po
--- 2.14~git20250718.0e36779-1/debian/po/nb.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/nb.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-04-25 08:34+0200\n"
 "Last-Translator: Petter Reinholdtsen <pere@hungry.com>\n"
 "Language-Team: Norwegian Bokmål <l10n-no@lister.huftis.org>\n"
@@ -72,6 +72,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB installasjonsenheter:"
 
@@ -87,7 +88,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -127,7 +128,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -158,7 +159,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Klarte ikke skrive GRUB til oppstartsenhet - fortsette?"
 
@@ -167,12 +168,13 @@ msgstr "Klarte ikke skrive GRUB til opps
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Klarte ikke installere GRUB på følgende enheter:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -200,7 +202,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Fortsett uten å installere GRUB?"
 
@@ -223,7 +225,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -300,6 +302,12 @@ msgstr ""
 "oppstartspostene ble opprettet av en GRUB 2-installasjon på et annet "
 "operativsystem."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -337,20 +345,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Tving ekstra installasjon til EFI-stien for flyttbare media? "
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Noen EFI-baserte systemer har feil og feilhåndterer nye oppstartlastere. "
 "Hvis du tvinger en ekstra installasjon av GRUB til EFI-stien for flyttbare "
@@ -415,6 +434,94 @@ msgstr ""
 "prober forårsake skade på disse gjeste-operativsystemene når den monterer "
 "filsystemer for å lete etter ting."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Pakken grub-pc blir oppgradert. Denne menyen lar deg velge hvilke enheter du "
+"vil at grub-install skal kjøres automatisk for, hvis noen."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Du har valgt å ikke installere GRUB på noen enhet. Hvis du fortsetter, vil "
+"oppstartslasteren kanskje ikke være skikkelig satt opp, og når denne "
+"datamaskinen starter opp neste gang vil den bruke det tidligere innholdet i "
+"oppstartssektoren. Hvis det er en tidligere versjon av GRUB 2 i "
+"oppstartsektoren, vil den kanskje ikke være i stand til å laste inn moduler "
+"eller håndtere den aktuelle konfigurasjonsfilen."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Kommandolinje i kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/nl.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/nl.po
--- 2.14~git20250718.0e36779-1/debian/po/nl.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/nl.po	2025-09-08 10:56:27.000000000 +0000
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2 2.06-13\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-04-26 21:05+0200\n"
 "Last-Translator: Frans Spiesschaert <Frans.Spiesschaert@yucom.be>\n"
 "Language-Team: Debian Dutch l10n Team <debian-l10n-dutch@lists.debian.org>\n"
@@ -75,6 +75,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Apparaten waarop GRUB moet komen:"
 
@@ -91,7 +92,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -132,7 +133,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -164,7 +165,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Schrijven van GRUB naar opstartapparaat mislukt. Doorgaan?"
 
@@ -173,12 +174,13 @@ msgstr "Schrijven van GRUB naar opstarta
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Het installeren van GRUB op de volgende apparaten is mislukt: "
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -207,7 +209,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Verder gaan zonder GRUB te installeren?"
 
@@ -230,7 +232,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -308,6 +310,12 @@ msgstr ""
 "opstart-images gemaakt zijn bij het installeren van GRUB 2 met een ander "
 "besturingssysteem."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -346,21 +354,32 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 "Een extra installatie verplichten in het EFI-pad voor verwijderbare media?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Sommige op EFI gebaseerde systemen bevatten fouten en gaan niet correct om "
 "met de nieuwe opstartprogramma's. Indien u een extra installatie van GRUB in "
@@ -430,6 +449,95 @@ msgstr ""
 "gast-besturingssystemen omdat het bestandssystemen aankoppelt om naar dingen "
 "te zoeken."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Het pakket grub-pc wordt bijgewerkt. Dit menu stelt u in staat om desgewenst "
+"de apparaten te selecteren waarvoor u wilt dat grub-install automatisch "
+"wordt uitgevoerd."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"U heeft ervoor gekozen om GRUB op geen enkele schijf te installeren. Als u "
+"nu doorgaat zou het kunnen dat het opstartprogramma niet correct "
+"geconfigureerd is en dat de computer bij de volgende start de informatie "
+"gebruikt die vroeger in de opstartsector stond. Indien daar een eerdere "
+"versie van GRUB 2 staat, kan het zijn dat modules niet geladen kunnen worden "
+"of dat het huidige configuratiebestand niet verwerkt kan worden."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD-commandoregel:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/pl.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/pl.po
--- 2.14~git20250718.0e36779-1/debian/po/pl.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/pl.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2017-01-20 14:11+0100\n"
 "Last-Translator: Łukasz Dulny <BartekChom@poczta.onet.pl>\n"
 "Language-Team: Polish <debian-l10n-polish@lists.debian.org>\n"
@@ -74,6 +74,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Urządzenia do instalacji GRUB-a:"
 
@@ -90,15 +91,15 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
 "modules or grub.cfg."
 msgstr ""
 "Automatyczne uruchomienie grub-install jest wskazane w większości "
-"przypadków, aby zapobiec straceniu synchronizacji z modułami GRUB-a w "
-"grub.cfg przez jego główny obraz."
+"przypadków, aby zapobiec straceniu synchronizacji z modułami GRUB-a w grub."
+"cfg przez jego główny obraz."
 
 #. Type: multiselect
 #. Description
@@ -131,7 +132,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -162,7 +163,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr ""
 "Zapisywanie GRUB-a na urządzenia rozruchowe nie powiodło się - kontynuować?"
@@ -172,12 +173,13 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Nie powiodło się zainstalowanie GRUB-a na następujących urządzeniach:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -207,7 +209,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Kontynuować bez instalowania GRUB-a?"
 
@@ -230,7 +232,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -305,6 +307,12 @@ msgstr ""
 "Można zakończyć przejście na GRUB-a 2, chyba że te wpisy rozruchowe zostały "
 "stworzone przez GRUB-a 2 zainstalowanego w jakimś innym systemie operacyjnym."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -343,20 +351,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Wymusić dodatkową instalację do ścieżki nośników wymiennych EFI?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Niektóre oparte na EFI systemy mają błędy i nie obsługują poprawnie nowych "
 "programów rozruchowych. Jeśli wymusisz dodatkową instalację GRUB-a do "
@@ -412,6 +431,95 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Pakiet grub-pc został zaktualizowany. To menu pozwala na wybranie urządzeń, "
+"dla których powinno zostać uruchomione automatycznie polecenie grub-install, "
+"jeśli to konieczne."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Wybrano nieinstalowanie GRUB-a na żadnym urządzeniu. W przypadku "
+"kontynuowania, program rozruchowy może nie być poprawnie skonfigurowany, a "
+"kiedy komputer zostanie uruchomiony ponownie, będzie używał tego, co "
+"znajdowało się poprzednio w sektorze rozruchowym. Jeśli jest tam "
+"wcześniejsza wersja GRUB-a 2, załadowanie modułów lub obsłużenie aktualnego "
+"pliku konfiguracyjnego może być niemożliwe."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Wiersz poleceń do kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/pt.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/pt.po
--- 2.14~git20250718.0e36779-1/debian/po/pt.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/pt.po	2025-09-08 10:56:27.000000000 +0000
@@ -10,7 +10,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2 2.02-beta3-5\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2017-06-04 12:30+0000\n"
 "Last-Translator: Rui Branco - DebianPT <ruipb@debianpt.org>\n"
 "Language-Team: Portuguese <traduz@debianpt.org>\n"
@@ -75,6 +75,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "dispositivos de instalação GRUB:"
 
@@ -91,7 +92,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -130,7 +131,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -161,7 +162,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "A escrita do GRUB para o dispositivo de arranque falhou - continuar?"
 
@@ -170,12 +171,13 @@ msgstr "A escrita do GRUB para o disposi
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "A instalação do GRUB falhou nos seguintes dispositivos:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -204,7 +206,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Continuar sem instalar o GRUB?"
 
@@ -227,7 +229,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -304,6 +306,12 @@ msgstr ""
 "registos de arranque tenham sido criados por uma instalação do GRUB 2 noutro "
 "sistema operativo."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -342,20 +350,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Forçar a instalação extra para o caminho de media removível EFI? "
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Alguns sistemas baseados em EFI possuem bugs e não irão gerir os novos "
 "bootloaders correctamente. Se forçar uma instalação extra do GRUB para o "
@@ -413,6 +432,95 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"O pacote grub-pc está a ser actualizado. Este menu permite-lhe seleccionar "
+"quais os dispositivos onde gostaria que o grub-install corresse "
+"automaticamente, se algum."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Escolheu não instalar o GRUB em qualquer dispositivo. Se continuar, o gestor "
+"de arranque pode não ficar correctamente configurado, e quando o computador "
+"arrancar da próxima vez irá usar o que estiver anteriormente no sector de "
+"arranque. Se existir uma versão anterior do GRUB 2 no sector de arranque, "
+"poderá não ser capaz de carregar os módulos e gerir o ficheiro de "
+"configuração actual."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "linha de comandos kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/pt_BR.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/pt_BR.po
--- 2.14~git20250718.0e36779-1/debian/po/pt_BR.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/pt_BR.po	2025-09-08 10:56:27.000000000 +0000
@@ -8,11 +8,11 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2 2.02~beta3-4\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-04-24 21:29-0300\n"
 "Last-Translator: Adriano Rafael Gomes <adrianorg@debian.org>\n"
-"Language-Team: Brazilian Portuguese <debian-l10n-"
-"portuguese@lists.debian.org>\n"
+"Language-Team: Brazilian Portuguese <debian-l10n-portuguese@lists.debian."
+"org>\n"
 "Language: pt_BR\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -74,6 +74,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Instalar o GRUB nos dispositivos:"
 
@@ -90,7 +91,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -131,7 +132,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -163,7 +164,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "A gravação do GRUB no dispositivo de inicialização falhou - continuar?"
 
@@ -172,12 +173,13 @@ msgstr "A gravação do GRUB no disposit
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Falha ao instalar o GRUB nos seguintes dispositivos:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -206,7 +208,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Continuar sem instalar o GRUB?"
 
@@ -229,7 +231,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -307,6 +309,12 @@ msgstr ""
 "esses registros de inicialização tenham sido criados por uma instalação do "
 "GRUB 2 em algum outro sistema operacional."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -344,20 +352,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Forçar instalação extra no caminho de mídia removível EFI?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Alguns sistemas baseados em EFI contém bugs e não lidam corretamente com "
 "novos carregadores de inicialização. Se você forçar uma instalação extra do "
@@ -427,6 +446,95 @@ msgstr ""
 "esses sistemas operacionais convidados, uma vez que ele monta os sistemas de "
 "arquivos para fazer procuras."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"O pacote grub-pc está sendo atualizado. Este menu permite a você selecionar "
+"em quais dispositivos você quer que seja executado automaticamente o grub-"
+"install, se houver algum."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Você escolheu não instalar o GRUB em nenhum dispositivo. Se você continuar, "
+"o carregador de inicialização poderá não ser configurado corretamente, e na "
+"próxima vez que este computador inicializar ele usará a versão que estava "
+"anteriormente no setor de inicialização. Se houver uma versão anterior do "
+"GRUB 2 no setor de inicialização, pode ser que ele não consiga carregar "
+"módulos ou manipular corretamente o arquivo de configuração atual."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Linha de comando kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/ro.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/ro.po
--- 2.14~git20250718.0e36779-1/debian/po/ro.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/ro.po	2025-09-08 10:56:27.000000000 +0000
@@ -14,7 +14,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: ro\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-04-25 02:07+0200\n"
 "Last-Translator: Remus-Gabriel Chelu <remusgabriel.chelu@disroot.org>\n"
 "Language-Team: Romanian <debian-l10n-romanian@lists.debian.org>\n"
@@ -82,6 +82,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Dispozitive pentru a instala GRUB:"
 
@@ -98,7 +99,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -138,7 +139,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -170,7 +171,7 @@ msgstr "- ${DEVICE} (${SIZE} Mo; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Scrierea GRUB pe dispozitivul de pornire a eșuat. Se continuă?"
 
@@ -179,12 +180,13 @@ msgstr "Scrierea GRUB pe dispozitivul de
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Instalarea GRUB pe următoarele dispozitive a eșuat:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -212,7 +214,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Continuați fără să instalați GRUB?"
 
@@ -235,7 +237,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -312,6 +314,12 @@ msgstr ""
 "care acele înregistrări de pornire au fost create de o instalare GRUB 2 a "
 "altui sistem de operare."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -350,20 +358,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Se forțează o instalare suplimentară pe calea suportului amovibil EFI?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Anumite sisteme EFI au probleme și nu funcționează corect cu încărcători de "
 "sistem noi. Forțând o instalare GRUB suplimentară în calea EFI pentru "
@@ -433,6 +452,95 @@ msgstr ""
 "acelor sisteme de operare invitate, deoarece montează sistemele de fișiere "
 "pentru a căuta lucruri."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Pachetul grub-pc este în curs de înnoire. Acest meniu vă permite să alegeți "
+"pentru ce dispozitive doriți să ruleze automat «grub-install», dacă este "
+"cazul."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} Mo; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Ați ales să nu instalați GRUB pe niciun dispozitiv. Dacă veți continua, este "
+"posibil ca încărcătorul de sistem să nu fie configurat corespunzător, iar la "
+"pornirea calculatorului acesta va folosi ce se afla deja în sectorul de "
+"pornire. Dacă există o versiune mai veche de GRUB 2 în sectorul de pornire "
+"este posibil ca aceasta să nu poată încărca modulele sau să proceseze "
+"fișierul de configurare curent."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Linia de comandă kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/ru.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/ru.po
--- 2.14~git20250718.0e36779-1/debian/po/ru.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/ru.po	2025-09-08 10:56:27.000000000 +0000
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2 2.06-13\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-04-30 06:47+0300\n"
 "Last-Translator: Yuri Kozlov <yuray@komyakino.ru>\n"
 "Language-Team: Russian <debian-l10n-russian@lists.debian.org>\n"
@@ -76,6 +76,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Устройства, на которые устанавливается GRUB:"
 
@@ -91,7 +92,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -131,7 +132,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -162,7 +163,7 @@ msgstr "- ${DEVICE} (${SIZE} МБ; ${PAT
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Не удалось записать GRUB на загрузочное устройство -- продолжить?"
 
@@ -171,12 +172,13 @@ msgstr "Не удалось записа
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Не удалось установить GRUB на следующие устройства:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -204,7 +206,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Продолжить без установки GRUB?"
 
@@ -226,7 +228,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -300,6 +302,12 @@ msgstr ""
 "Обычно, вам нужно завершить переход к GRUB 2, если нет загрузочных записей, "
 "созданных установкой GRUB 2 в какой-то другой операционной системе."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -338,20 +346,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Выполнить принудительную установку в путь съёмных носителей EFI?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Некоторые системы на основе EFI содержат ошибки и неправильно работают с "
 "новыми системными загрузчиками. Если выполнить принудительную установку GRUB "
@@ -407,10 +426,97 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 "Если на компьютере установлено несколько операционных систем, то это то, что "
-"вам нужно. Однако, если компьютер является носителем гостевых "
-"ОС,установленных в LVM или на неструктурированные дисковые устройства, "
-"запуск os-prober может повредить эти гостевые ОС, так как при работе он "
-"монтирует файловые системы."
+"вам нужно. Однако, если компьютер является носителем гостевых ОС,"
+"установленных в LVM или на неструктурированные дисковые устройства, запуск "
+"os-prober может повредить эти гостевые ОС, так как при работе он монтирует "
+"файловые системы."
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Выполняется обновление пакета grub-pc. Это меню позволяет вам выбрать "
+"устройства, для которых нужно автоматически запустить grub-install."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} МБ; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Вы отказались от установки GRUB. Если продолжите, то системный загрузчик "
+"может быть неправильно настроен, и когда компьютер будет включён в следующий "
+"раз, будет использоваться то, что было раньше в загрузочном секторе. Если "
+"там была предыдущая версия GRUB 2, то она не сможет загрузить модули или "
+"обработать текущий файл настройки."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
 
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Командная строка kFreeBSD:"
diff -pruN 2.14~git20250718.0e36779-1/debian/po/si.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/si.po
--- 2.14~git20250718.0e36779-1/debian/po/si.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/si.po	2025-09-08 10:56:27.000000000 +0000
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2011-09-29 08:35+0530\n"
 "Last-Translator: Danishka Navin <danishka@gmail.com>\n"
 "Language-Team: Sinhala <info@hanthana.org>\n"
@@ -68,6 +68,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB ස්ථාපන උපකරණ:"
 
@@ -83,14 +84,14 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
 "modules or grub.cfg."
 msgstr ""
-"බොහෝ අවස්ථා වලදී grub-install ස්වයංක්‍රීයව ධාවනය කිරීම නිර්දේශිතයි. GRUB මොඩියුල හෝ "
-"grub.cfg මගින් ස්ථාපිත GRUB මූල පිළිබිඹුව සම්මුහුර්තයෙන් බැහැර යාම වලක්වයි."
+"බොහෝ අවස්ථා වලදී grub-install ස්වයංක්‍රීයව ධාවනය කිරීම නිර්දේශිතයි. GRUB මොඩියුල හෝ grub."
+"cfg මගින් ස්ථාපිත GRUB මූල පිළිබිඹුව සම්මුහුර්තයෙන් බැහැර යාම වලක්වයි."
 
 #. Type: multiselect
 #. Description
@@ -121,7 +122,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -151,7 +152,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "GRUB ආරම්භක උපකරණය ලිවීම අසාර්ථකයි - ඉදිරියට?"
 
@@ -160,12 +161,13 @@ msgstr "GRUB ආරම්භක උප
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUB පහත උපකරණ ස්ථාපනයෙහි අසාර්ථක විය:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -190,7 +192,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "GRUB ස්ථාපනයෙන් තොරව ඉදිරියට යන්නද?"
 
@@ -211,7 +213,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -281,6 +283,12 @@ msgstr ""
 "GRUB 2 ස්ථාපනය මගින් වෙනත් මෙහෙයුම් පද්ධතියක් මත මෙම ආරම්භක වාර්ථා නිර්මාණය කර නොමැති නම්, "
 "ඔබ සාමාන්‍යෙන් GRUB 2 වෙත හැරවීම අවසන් කල යුතුයි."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -318,7 +326,7 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 
 #. Type: boolean
@@ -326,12 +334,12 @@ msgstr ""
 #: ../templates.in:3001
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 
 #. Type: boolean
@@ -375,6 +383,92 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"grub-pc පැකේජය යාවත් වෙමින්. මෙම මෙනුව ඔබට grub-install ස්වයංක්‍රීයව ධාවනය විය යුත්තේ "
+"කුමන උපකරණ මත දැයි තේරීමට ඉඩදෙයි."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"ඔබ කිසිඳු උපකරණයකට GRUB ස්ථාපනය නොකිරීමට තෝරා ඇත. ඔබ ඉදිරියට යයි නම් ආරම්භක පූරකය නිසිලෙස "
+"නොසැකසෙනු ඇත. ඊලඟ වතාවේ පරිගණකය ආරම්භ වන විට එය ආරම්භක කොටසේ පැවති ඕනෑම දෙයක් භාවිත "
+"කරයි. ආරම්භක කොටසේ GRUB 2 පැරණි සංස්කරණයක් පවතී නම්. එය මොඩියුල හැසිරවීමේ හා වත්මන් සැකසුම් "
+"ගොනුව භාවිතයේ අසමත් විය හැක."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD විධාන රේඛාව:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/sk.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/sk.po
--- 2.14~git20250718.0e36779-1/debian/po/sk.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/sk.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2 1.99-5\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2011-07-19 07:49+0200\n"
 "Last-Translator: Slavko <linux@slavino.sk>\n"
 "Language-Team: Slovak <nomail>\n"
@@ -72,6 +72,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Zariadenia na inštaláciu GRUB:"
 
@@ -87,7 +88,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -127,7 +128,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -158,7 +159,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Zápis GRUBu do zavádzacieho zariadenia zlyhal – pokračovať?"
 
@@ -167,12 +168,13 @@ msgstr "Zápis GRUBu do zavádzacieho za
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Inštalácia GRUB zlyhala na týchto zariadeniach:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -200,7 +202,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Pokračovať bez inštalácie GRUB?"
 
@@ -222,7 +224,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -297,6 +299,12 @@ msgstr ""
 "Mali by ste dokončiť konverziu na GRUB 2, ibaže boli tieto zavádzacie "
 "záznamy vytvorené inštaláciou GRUB 2 iného operačného systému."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -334,7 +342,7 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 
 #. Type: boolean
@@ -342,12 +350,12 @@ msgstr ""
 #: ../templates.in:3001
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 
 #. Type: boolean
@@ -391,6 +399,93 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Balík grub-pc je aktualizovaný. Toto menu vám umožňuje vybrať si, pre ktoré "
+"zariadenia bude automaticky spustený grub-install, ak nejaké vyberiete."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Zvolili ste si neinštalovať GRUB na žiadne zariadenie, ak budete pokračovať, "
+"zavádzač nemusí byť správne nastavený a pri ďalšom štarte tohoto počítača "
+"bude použité to, čo bolo v zavádzacom sektore predtým. Ak je v zavádzacom "
+"sektore predchádzajúca verzia GRUB 2, nemusí sa jej podariť načítať moduly "
+"alebo spracovať aktuálny konfiguračný súbor."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Príkazový riadok kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/sl.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/sl.po
--- 2.14~git20250718.0e36779-1/debian/po/sl.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/sl.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2017-01-20 08:53+0100\n"
 "Last-Translator: Vanja Cvelbar <cvelbar@gmail.com>\n"
 "Language-Team: Slovenian <sl@li.org>\n"
@@ -72,6 +72,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Namestitvene naprave za GRUB:"
 
@@ -87,7 +88,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -125,7 +126,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -155,7 +156,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Napaka pri pisanju na zagonsko napravo za GRUB. Želite nadaljevati?"
 
@@ -164,12 +165,13 @@ msgstr "Napaka pri pisanju na zagonsko n
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Napaka pri nameščanju GRUBa na sledeče naprave:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -198,7 +200,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Želite nadaljevati, ne da bi namestili GRUB?"
 
@@ -220,7 +222,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -297,6 +299,12 @@ msgstr ""
 "zagonski zapisi ustvarjeni pri nameščanju GRUB 2 na drugem operacijskem "
 "sistemu."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -334,20 +342,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Prisilna dodatna namestitev v pot EFI na odstranljivem mediju?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Nekateri sistemi na osnovi EFI imajo napake in ne morejo pravilno "
 "uporabljati novih zagonskih nalagalnikov. Če prisilno dodatno namestite GRUB "
@@ -403,6 +422,93 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Nadgrajevanje paketa grub-pc. Ta meni vam omogoči izbiro naprav za katere "
+"želite samodejno zagnati grub-install."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Izbrali ste, da ne boste namestili GRUBa na nobeno napravo. V primeru, da "
+"nadaljujete zagonski nalagalnik ne bo pravilno nastavljen. Računalnik bo ob "
+"naslednjem zagonu uporabil karkoli je bilo prej nameščeno na zagonskem "
+"sektorju. V primeru, da se tam nahaja starejša različica GRUB 2 mogoče ta ne "
+"bo uspela naložiti modulov ali brati sedanje nastavitvene datoteke."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Ukazna vrstica kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/sq.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/sq.po
--- 2.14~git20250718.0e36779-1/debian/po/sq.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/sq.po	2025-09-08 10:56:27.000000000 +0000
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2017-09-04 18:50+0200\n"
 "Last-Translator: Silva Arapi <silva.arapi@gmail.com>\n"
 "Language-Team: Albanian <debian-l10n-albanian@lists.debian.org>\n"
@@ -74,6 +74,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Paisjet GRUB install:"
 
@@ -89,7 +90,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -129,7 +130,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -160,7 +161,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Shkrimi i GRUP për të ndezur paisjen dvshtoi - do të vazhdoni?"
 
@@ -169,12 +170,13 @@ msgstr "Shkrimi i GRUP për të ndezur p
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUB nuk arriti të instaloj paisjet në vijim:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -202,7 +204,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Do të vazhdosh pa e instaluar GRUB?"
 
@@ -222,7 +224,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -299,6 +301,12 @@ msgstr ""
 "kur këto rekorde të ndezjes janë krijuar nga instalimi i GRUB 2 në ndonjë "
 "sistem shfrytëzimi tjetër. "
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -337,7 +345,7 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 
 #. Type: boolean
@@ -345,12 +353,12 @@ msgstr ""
 #: ../templates.in:3001
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 
 #. Type: boolean
@@ -394,6 +402,91 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Paketa po përmirësohet. Kjo menu të lejon të zgjedhësh se cilat paisje do të "
+"doje që grub-install ti ekzekutoj automatikisht, nëse ka ndonjë të till."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Ti zgjodhe të mos e instalosh GRUB në asnjë paisje. Nëse vazhdon, ngarkuesi "
+"i ndezjes mund të mos konfigurohet siç duhet dhe kur ky kompjuter të filloj "
+"herën tjetër, do të përdor çfardo ishte më parë në sektorin e ndezjes."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Linja komanduese kFreeBSD"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/sr.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/sr.po
--- 2.14~git20250718.0e36779-1/debian/po/sr.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/sr.po	2025-09-08 10:56:27.000000000 +0000
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2 1.98+2010804-2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2012-10-23 23:33+0100\n"
 "Last-Translator: Karolina Kalic <karolina@resenje.org>\n"
 "Language-Team: Serbian\n"
@@ -73,6 +73,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Уређаји за инсталирање GRUB-а:"
 
@@ -88,7 +89,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -127,7 +128,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -157,7 +158,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Инсталација GRUB-а није успела - наставити?"
 
@@ -166,12 +167,13 @@ msgstr "Инсталација GRUB-а 
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Инсталација GRUB-а није успела на следећим уређајима:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -199,7 +201,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Наставити без инсталирања GRUB-а?"
 
@@ -221,7 +223,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -296,6 +298,12 @@ msgstr ""
 "Требали бисте да забршите конверзију на GRUB 2, осим ако су ови покретачки "
 "подаци креирани од GRUB 2 инсталације на неком другом оперативном систему."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -333,7 +341,7 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 
 #. Type: boolean
@@ -341,12 +349,12 @@ msgstr ""
 #: ../templates.in:3001
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 
 #. Type: boolean
@@ -390,6 +398,93 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Пакет grub-pc се апгрејдује. Овај мени вам дозвољава да изаберете за које "
+"уређаје ће grub-install аутоматски да се покрене."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB, ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Одабрали сте да не инсталирате GRUB ни на један уређај. Ако наставите, бут "
+"учитавач можда неће бити исправно подешен, акада се овај рачунар следећи пут "
+"упали, користиће се шта год да је претходно било у бут сектору. Ако се тамо "
+"налази ранијаверзија GRUB 2, можда ће доћи до проблема сa учитавањем модула "
+"или читањем тренутне датотеке поставки."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD командна линија:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/sr@latin.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/sr@latin.po
--- 2.14~git20250718.0e36779-1/debian/po/sr@latin.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/sr@latin.po	2025-09-08 10:56:27.000000000 +0000
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2 1.98+2010804-2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2012-10-23 23:33+0100\n"
 "Last-Translator: Karolina Kalic <karolina@resenje.org>\n"
 "Language-Team: Serbian\n"
@@ -73,6 +73,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Uređaji za instaliranje GRUB-a:"
 
@@ -88,7 +89,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -127,7 +128,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -157,7 +158,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Instalacija GRUB-a nije uspela - nastaviti?"
 
@@ -166,12 +167,13 @@ msgstr "Instalacija GRUB-a nije uspela -
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Instalacija GRUB-a nije uspela na sledećim uređajima:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -199,7 +201,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Nastaviti bez instaliranja GRUB-a?"
 
@@ -221,7 +223,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -296,6 +298,12 @@ msgstr ""
 "Trebali biste da zabršite konverziju na GRUB 2, osim ako su ovi pokretački "
 "podaci kreirani od GRUB 2 instalacije na nekom drugom operativnom sistemu."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -333,7 +341,7 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 
 #. Type: boolean
@@ -341,12 +349,12 @@ msgstr ""
 #: ../templates.in:3001
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 
 #. Type: boolean
@@ -390,6 +398,93 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Paket grub-pc se apgrejduje. Ovaj meni vam dozvoljava da izaberete za koje "
+"uređaje će grub-install automatski da se pokrene."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB, ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Odabrali ste da ne instalirate GRUB ni na jedan uređaj. Ako nastavite, but "
+"učitavač možda neće biti ispravno podešen, akada se ovaj računar sledeći put "
+"upali, koristiće se šta god da je prethodno bilo u but sektoru. Ako se tamo "
+"nalazi ranijaverzija GRUB 2, možda će doći do problema sa učitavanjem modula "
+"ili čitanjem trenutne datoteke postavki."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD komandna linija:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/sv.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/sv.po
--- 2.14~git20250718.0e36779-1/debian/po/sv.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/sv.po	2025-09-08 10:56:27.000000000 +0000
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2_sv\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-04-25 15:27+0200\n"
 "Last-Translator: Luna Jernberg <droidbittin@gmail.com>\n"
 "Language-Team: Swedish <debian-l10n-swedish@lists.debian.org>\n"
@@ -76,6 +76,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB installationsenheter:"
 
@@ -91,7 +92,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -131,7 +132,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -162,7 +163,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Skriva GRUB till uppstartsenhet misslyckades - fortsätta?"
 
@@ -171,12 +172,13 @@ msgstr "Skriva GRUB till uppstartsenhet
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUB kunde inte installeras på följande enheter:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -204,7 +206,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Fortsätt utan att installera GRUB?"
 
@@ -227,7 +229,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -302,6 +304,12 @@ msgstr ""
 "Det generella rådet är att avsluta konverteringen till GRUB 2 om dessa filer "
 "inte skapats av en GRUB 2-installation på ett annat operativsystem."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -339,20 +347,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Forcera installation till flyttbar EFI-media?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Vissa EFI-baserade system beter sig felaktigt och kan inte hantera nyare "
 "uppstartshanterare korrekt. Om Grub-installationen forceras in i en flyttbar "
@@ -417,6 +436,94 @@ msgstr ""
 "gästoperativsystem eftersom det monterar filsystem för att leta reda på "
 "saker."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Paketet grub-pc uppdateras. Denna meny ger dig möjlighet att välja vilka, om "
+"några, enheter som grub-install ska köras automatiskt för."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Du valde att inte installera GRUB på några enheter. Om du fortsätter kommer "
+"uppstartshanteraren kanske inte att få korrekta inställningar och när ditt "
+"system startar nästa gång kommer det att använda vad som tidigare fanns i "
+"boot-sektorn. Om en tidigare version av GRUB 2 används i boot-sektorn finns "
+"risk att vissa moduler inte kan laddas och hantera de aktuella "
+"inställningsfilerna."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD kommandorad:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/ta.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/ta.po
--- 2.14~git20250718.0e36779-1/debian/po/ta.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/ta.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: ta\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2012-02-16 10:15+0530\n"
 "Last-Translator: Dr.T.Vasudevan <agnihot3@gmail.com>\n"
 "Language-Team: Tamil <Ubuntu-l10n-tam@lists.ubuntu.com>\n"
@@ -70,6 +70,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "க்ரப் நிறுவல் சாதனங்கள்: "
 
@@ -85,7 +86,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -125,7 +126,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -155,7 +156,7 @@ msgstr "- ${DEVICE} (${SIZE} எம்
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "பூட் சாதனத்துக்கு க்ரப் ஐ எழுதுவது தோவியடைந்தது - தொடரலாமா?"
 
@@ -164,12 +165,13 @@ msgstr "பூட் சாதனத்
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "பின் வரும் சாதனங்களில் க்ரப் நிறுவுதல் தோல்வியடைந்தது:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -196,7 +198,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "க்ரப் ஐ நிறுவாமல் தொடரலாமா?"
 
@@ -217,7 +219,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -289,6 +291,12 @@ msgstr ""
 "இந்த பூட் பதிவுகள் வேறு ஒரு இயங்கு தளத்தை நிறுவும் போது க்ரப் 2 ஆல் "
 "உருவாக்கப்பட்டிருந்தால் ஒழிய  நீங்கள் பொதுவாக க்ரப் 2 மாற்றத்தை முடிக்க வேண்டும்."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -326,7 +334,7 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 
 #. Type: boolean
@@ -334,12 +342,12 @@ msgstr ""
 #: ../templates.in:3001
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 
 #. Type: boolean
@@ -383,6 +391,92 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"க்ரப்-பிசி பொதி மேம்படுத்தப்படுகிறது. இந்த மெனு க்ரப் நிறுவல் தானியங்கியாக இயங்க "
+"சாதனங்கள் ஏதும் இருந்தால் அதை தேர்ந்தெடுக்க இது அனுமதிக்கிறது."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} எம்பி (MB); ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"நீங்கள் எந்த சாதனத்திலும் க்ரப் ஐ நிறுவாமல் இருக்க தேர்ந்தெடுத்து உள்ளீர்கள். நீங்கள் தொடர்ந்தால் "
+"பூட் ஏற்றி சரியாக வடிவமைக்கப்படாமல் போகலாம். அதனால் கணினி மீண்டும் துவங்கும்போது முன்பு "
+"பூட் தொகுதியில் என்ன இருந்ததோ அதையே பயன்படுத்தும். அங்கே க்ரப் 2 இன் முந்தைய பதிப்பு "
+"இருப்பின் மாட்யூல்களை ஏற்றுதலும் நடப்பு வடிவமைப்பு கோப்பை கையாளுவதும் இயலாமல் போகலாம்."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "கேப்ரீபிஎஸ்டி கட்டளை வரி:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/templates.pot 2.14~git20250718.0e36779-1ubuntu4/debian/po/templates.pot
--- 2.14~git20250718.0e36779-1/debian/po/templates.pot	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/templates.pot	2025-09-08 10:56:27.000000000 +0000
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -61,6 +61,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr ""
 
@@ -74,7 +75,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -105,7 +106,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -131,7 +132,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr ""
 
@@ -140,12 +141,13 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -168,7 +170,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr ""
 
@@ -185,7 +187,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -245,6 +247,12 @@ msgid ""
 "records were created by a GRUB 2 installation on some other operating system."
 msgstr ""
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -277,7 +285,7 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 
 #. Type: boolean
@@ -285,12 +293,12 @@ msgstr ""
 #: ../templates.in:3001
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 
 #. Type: boolean
@@ -333,3 +341,70 @@ msgid ""
 "installed via LVM or raw disk devices, running os-prober can cause damage to "
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
diff -pruN 2.14~git20250718.0e36779-1/debian/po/th.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/th.po
--- 2.14~git20250718.0e36779-1/debian/po/th.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/th.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2017-01-20 14:46+0700\n"
 "Last-Translator: Theppitak Karoonboonyanan <thep@debian.org>\n"
 "Language-Team: Thai <thai-l10n@googlegroups.com>\n"
@@ -67,6 +67,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "อุปกรณ์ที่จะติดตั้ง GRUB:"
 
@@ -82,7 +83,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -120,7 +121,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -150,7 +151,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "เขียน GRUB ลงในอุปกรณ์บูตไม่สำเร็จ - ดำเนินการต่อไปหรือไม่?"
 
@@ -159,12 +160,13 @@ msgstr "เขียน GRUB ลงใ
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "ติดตั้ง GRUB ลงในอุปกรณ์ต่อไปนี้ไม่สำเร็จ:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -190,7 +192,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "จะดำเนินการต่อไปโดยไม่ติดตั้ง GRUB หรือไม่?"
 
@@ -211,7 +213,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -282,6 +284,12 @@ msgstr ""
 "โดยทั่วไปแล้ว คุณควรจะจบขั้นตอนสุดท้ายของการแปลงไปเป็น GRUB 2 นี้ "
 "นอกเสียจากว่าบูตเรคอร์ดเหล่านี้จะถูกสร้างโดย GRUB 2 ที่ติดตั้งในระบบปฏิบัติการอื่น"
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -317,20 +325,31 @@ msgstr "พารามิเตอร
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "จะบังคับติดตั้งส่วนพิเศษเพิ่มเติมลงในพาธของสื่อถอดเสียบของ EFI หรือไม่?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "ระบบที่อิง EFI บางระบบมีข้อบกพร่อง และไม่ได้จัดการบูตโหลดเดอร์ตัวใหม่ๆ อย่างถูกต้อง "
 "ถ้าคุณบังคับติดตั้งส่วนพิเศษเพิ่มเติมของ GRUB ลงในพาธของสื่อถอดเสียบของ EFI "
@@ -385,6 +404,92 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"กำลังจะปรับรุ่นแพกเกจ grub-pc ขึ้น เมนูนี้จะช่วยคุณเลือกอุปกรณ์ที่คุณต้องการให้เรียก grub-"
+"install โดยอัตโนมัติเพื่อติดตั้ง GRUB ถ้ามีอุปกรณ์ดังกล่าว"
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"คุณได้เลือกที่จะไม่ติดตั้ง GRUB ลงในอุปกรณ์ใดเลย ถ้าดำเนินการต่อไป "
+"บูตโหลดเดอร์อาจอยู่ในสภาพที่ไม่ได้ตั้งค่าอย่างสมบูรณ์ และเมื่อเปิดเครื่องครั้งต่อไป "
+"ก็จะใช้สิ่งที่อยู่ในบูตเซกเตอร์ก่อนหน้านี้ และถ้าในบูตเซกเตอร์มี GRUB 2 รุ่นเก่าอยู่ "
+"ก็อาจจะไม่สามารถโหลดมอดูลหรือใช้แฟ้มค่าตั้งปัจจุบันได้"
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "พารามิเตอร์สำหรับบูต kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/tr.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/tr.po
--- 2.14~git20250718.0e36779-1/debian/po/tr.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/tr.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2023-04-30 15:12+0300\n"
 "Last-Translator: Atila KOÇ <koc@artielektronik.com.tr>\n"
 "Language-Team: Debian L10n Turkish <debian-l10n-turkish@lists.debian.org>\n"
@@ -73,6 +73,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB kurulacak aygıtlar:"
 
@@ -88,7 +89,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -128,7 +129,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -159,7 +160,7 @@ msgstr "${DEVICE} (${SIZE} MB; ${PATH})"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr ""
 "GRUB'u önyükleme aygıtına yazma işlemi başarısız oldu, devam edilsin mi?"
@@ -169,12 +170,13 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Aşağıdaki aygıtlara GRUB kurulumu yapılamadı:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -203,7 +205,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "GRUB kurulmadan devam edilsin mi?"
 
@@ -225,7 +227,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -301,6 +303,12 @@ msgstr ""
 "tarafından oluşturulmamışsa,\n"
 " GRUB 2 kurulumunu tamamlamanız gerekmektedir."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -339,20 +347,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "EFI taşınabilir ortam yoluna ek bir kurulum zorlansın mı?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Bazı EFI tabanlı sistemler hatalı olduklarından yeni önyükleyicileri olması "
 "gerektiği gibi yönetmezler. EFI taşınabilir ortam yoluna ek bir GRUB "
@@ -420,6 +439,93 @@ msgstr ""
 "prober bir şeylere bakmak için dosya sistemlerini bağladığı için onu "
 "çalıştımak bu konuk işletim sistemlerine zarar verebilir."
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"grub-pc paketi yükseltiliyor. Bu menü grub-install komutunun, eğer varsalar, "
+"hangi aygıtlar için otomatikman çalıştırılacağını seçmenize olanak tanır."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"GRUB'u hiçbir aygıta kurmamayı seçtiniz. Devam ederseniz önyükleyici düzgün "
+"yapılandırılmayabilir ve bu bilgisayar bir sonraki açılışında önyükleme "
+"sektöründe daha önceden bulunan kayıtları kullanır. Eğer önyükleme "
+"sektöründe GRUB 2'nin eski bir sürümü varsa, güncel yapılandırma dosyasını "
+"kullanamayabilir veya modülleri yükleyemeyebilir."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD komut satırı:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/ug.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/ug.po
--- 2.14~git20250718.0e36779-1/debian/po/ug.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/ug.po	2025-09-08 10:56:27.000000000 +0000
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub_debian\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2017-01-26 21:24-0500\n"
 "Last-Translator: Abduqadir Abliz <sahran.ug@gmail.com>\n"
 "Language-Team: Uyghur Computer Science Association <UKIJ@yahoogroups.com>\n"
@@ -72,6 +72,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB ئورنىتىش ئۈسكۈنىسى:"
 
@@ -87,7 +88,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -128,7 +129,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -159,7 +160,7 @@ msgstr "- ${DEVICE} (${SIZE} MB, ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "GRUB نى قوزغىتىش ئۈسكۈنىسىگە يازالمىدى - داۋاملاشتۇرامدۇ؟"
 
@@ -168,12 +169,13 @@ msgstr "GRUB نى قوزغىتىش ئۈ
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUB نى تۆۋەندىكى ئۈسكۈنىگە ئورنىتالمىدى:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -201,7 +203,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "GRUB نى ئورناتماي داۋاملاشتۇرامدۇ؟"
 
@@ -224,7 +226,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -300,6 +302,12 @@ msgstr ""
 "خاتىرىسى باشقا مەشغۇلات سىستېمىسىغا ئورنىتىلغان GRUB 2 قۇرغان بولسا بۇ باشقا "
 "گەپ."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -337,21 +345,32 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 "مەزكۇر EFI كۆچمە ۋاسىتە يولىنى مەجبۇرىي ھالدا نورمىدىن ئارتۇق ئورنىتامدۇ؟"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "بىر قىسىم EFI ئاساسىدىكى سىستېمىلاردا مەسىلە بار ئۇنىڭ ئۈستىگە يېڭى "
 "يېتەكلەشنى يۈكلەش پىروگراممىسىنى توغرا بىر تەرەپ قىلالمايدۇ. ئەگەر GRUB نى "
@@ -410,6 +429,94 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"grub-pc بوغچىسى يېڭىلاندى. بۇ تىزىملىك سىزنىڭ قايسى ئۈسكۈنىدە grub-install "
+"نى ئۆزلۈكىدىن ئىجرا قىلىشنى تاللىشىڭىزغا يول قويىدۇ، ئەگەر بار بولسا."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB, ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"سىز ھېچقانداق ئۈسكۈنىگە GRUB ئورنىتىشنى تاللىمىدىڭىز. ئەگەر "
+"داۋاملاشتۇرسىڭىز، قوزغىتىش يېتەكلىگۈچنى توغرا سەپلىيەلمەسلىكىڭىز مۇمكىن، "
+"كومپيۇتېرىڭىز كېيىنكى قېتىم قوزغالغاندا ئۇ يېتەكلەش سېكتورىدىكى ئىلگىرىكى "
+"مەزمۇننى ئىشلىتىدۇ. ئەگەر يېتەكلەش سېكتورىدا ئىلگىرىكى نەشرىدىكى GRUB 2 "
+"بولسا ئۇنىڭ بۆلەكلىرىنى ياكى نۆۋەتتىكى سەپلىمە ھۆججەتنى يۈكلىگىلى بولماسلىقى "
+"مۇمكىن."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD بۇيرۇق قۇرى:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/uk.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/uk.po
--- 2.14~git20250718.0e36779-1/debian/po/uk.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/uk.po	2025-09-08 10:56:27.000000000 +0000
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2017-01-23 16:36+0200\n"
 "Last-Translator: Yatsenko Alexandr <yatsenko.alexandr@gmail.com>\n"
 "Language-Team: Ukrainian <translation@linux.org.ua>\n"
@@ -72,6 +72,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Дискові пристрої для встановлення GRUB:"
 
@@ -87,7 +88,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -127,7 +128,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -158,7 +159,7 @@ msgstr "- ${DEVICE} (${SIZE} МБ; ${PAT
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Не вдалося записати GRUB до завантажувального пристрою. Продовжити?"
 
@@ -167,12 +168,13 @@ msgstr "Не вдалося записа
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "Не вдалося встановити GRUB до наступних дискових пристроїв:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -201,7 +203,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Продовжити без встановлення GRUB?"
 
@@ -223,7 +225,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -297,6 +299,12 @@ msgstr ""
 "Ви маєте повністю завершити перехід на GRUB 2, якщо ці завантажувальні "
 "записи було створено GRUB 2 іншої операційної системи."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -335,21 +343,32 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 "Здійснити примусове встановлення до EFI, розташованого на змінному носії?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Деякі EFI-системи мають вади, що не дають їм коректно працювати із новими "
 "завантажувачами. Якщо ви виконаєте примусове встановлення GRUB на змінний "
@@ -404,6 +423,93 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Пакунок grub-pc було оновлено. Це меню дозволить вам обрати дискові пристрої "
+"з яких grub-install буде автоматично запускатися."
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} МБ; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Ви обрали не встановлювати GRUB на жоден пристрій. Якщо так продовжувати, "
+"завантажувач може бути не до кінця налаштований і при наступному запуску "
+"комп'ютера буде використано те, що є наразі у завантажувальному секторі. "
+"Якщо там виявиться попередня версія GRUB 2, вона, можливо, не зможе "
+"завантажити модулі чи опрацювати поточний конфігураційний файл."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Рядок параметрів ядра kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/vi.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/vi.po
--- 2.14~git20250718.0e36779-1/debian/po/vi.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/vi.po	2025-09-08 10:56:27.000000000 +0000
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2017-01-21 08:26+0700\n"
 "Last-Translator: Trần Ngọc Quân <vnwildman@gmail.com>\n"
 "Language-Team: Vietnamese <debian-l10n-vietnamese@lists.debian.org>\n"
@@ -73,6 +73,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "Những thiết bị cài đặt GRUB:"
 
@@ -88,7 +89,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -128,7 +129,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -161,7 +162,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "Việc ghi GRUB vào thiết bị khởi động bị lỗi - tiếp tục không?"
 
@@ -170,12 +171,13 @@ msgstr "Việc ghi GRUB vào thiết b
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUB gặp lỗi khi cài đặt vào những thiết bị sau đây:"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -202,7 +204,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "Tiếp tục lại mà không cài đặt GRUB?"
 
@@ -224,7 +226,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -298,6 +300,12 @@ msgstr ""
 "Nói chung bạn nên kết thúc chuyển đổi sang GRUB2 nếu các mục ghi khởi động "
 "này không được tạo bởi một bản cài đặt GRUB2 trên một hệ điều hành khác."
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -335,20 +343,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "Buộc cài đặt thêm cho đường dẫn thiết bị di động đa phương tiện EFI?"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "Một số hệ thống dựa trên EFI có lỗi và không thể xử lý bootloader mới một "
 "cách chính xác. Nếu bạn buộc cài đặt GRUB thêm vào đường dẫn thiết bị di "
@@ -404,6 +423,94 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"Gói grub-pc sắp được cập nhật. Trình đơn này cho bạn chọn thiết bị nào, nếu "
+"có, mà bạn muốn grub-install tự động chạy trên đó."
+
+# Variable: don't translate; Biến: đừng dịch
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"Bạn đã chọn không cài đặt GRUB vào thiết bị nào. Nếu tiếp tục thì bộ nạp "
+"khởi động có thể bị cấu hình sai, và khi máy tính khởi động lại nó sẽ sử "
+"dụng dữ liệu bất kỳ trước đây có trong rãnh ghi khởi động. Nếu rãnh ghi khởi "
+"động chứa một phiên bản GRUB 2 cũ, nó có thể không nạp được mô-đun hoặc "
+"không xử lý được tập tin cấu hình hiện thời."
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "Dòng lệnh kFreeBSD:"
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/zh_CN.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/zh_CN.po
--- 2.14~git20250718.0e36779-1/debian/po/zh_CN.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/zh_CN.po	2025-09-08 10:56:27.000000000 +0000
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2-po-debconf master\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2011-05-28 17:29+0800\n"
 "Last-Translator: YunQiang Su <wzssyqa@gmail.com>\n"
 "Language-Team: Chinese (simplified) <i18n-zh@googlegroups.com>\n"
@@ -68,6 +68,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB 安装设备："
 
@@ -83,7 +84,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -120,7 +121,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -149,7 +150,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "将 GRUB 写入引导设备失败 - 要继续吗？"
 
@@ -158,12 +159,13 @@ msgstr "将 GRUB 写入引导设备失
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "GRUB 安装到如下设备时失败。"
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -188,7 +190,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "不安装 GRUB 并且继续？"
 
@@ -208,7 +210,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -277,6 +279,12 @@ msgstr ""
 "您通常应该完成到 GRUB 2 的转换，除非这些引导记录是由安装到其它操作系统上的 "
 "GRUB 2 创建的。"
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -311,7 +319,7 @@ msgstr "如下字符串将被用于默
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr ""
 
 #. Type: boolean
@@ -319,12 +327,12 @@ msgstr ""
 #: ../templates.in:3001
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 
 #. Type: boolean
@@ -368,6 +376,91 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"grub-pc 包已经升级。此菜单允许您选择在哪个设备上自动运行 grub-install，如果有"
+"的话。"
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"您没有选择向任何设备安装 GRUB。如果继续，引导器可能不能正确配置，当您的计算机"
+"下次启动时，它将使用引导扇区中先前的内容。如果引导扇区中有早期版本的 GRUB 2，"
+"其可能不能加载模块或者处理当前配置文件。"
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD 参数："
 
diff -pruN 2.14~git20250718.0e36779-1/debian/po/zh_TW.po 2.14~git20250718.0e36779-1ubuntu4/debian/po/zh_TW.po
--- 2.14~git20250718.0e36779-1/debian/po/zh_TW.po	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/po/zh_TW.po	2025-09-08 10:56:27.000000000 +0000
@@ -5,11 +5,11 @@ msgid ""
 msgstr ""
 "Project-Id-Version: grub2\n"
 "Report-Msgid-Bugs-To: grub2@packages.debian.org\n"
-"POT-Creation-Date: 2025-08-12 14:28+0000\n"
+"POT-Creation-Date: 2025-08-12 15:28+0100\n"
 "PO-Revision-Date: 2014-12-17 17:08-0800\n"
 "Last-Translator: Vincent Chen <vinmun@gmail.com>\n"
-"Language-Team: Debian-user in Chinese [Big5] <debian-chinese-"
-"big5@lists.debian.org>\n"
+"Language-Team: Debian-user in Chinese [Big5] <debian-chinese-big5@lists."
+"debian.org>\n"
 "Language: zh_TW\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -65,6 +65,7 @@ msgstr ""
 #. Type: multiselect
 #. Description
 #: ../grub-pc.templates.in:3001 ../grub-pc.templates.in:4001
+#: ../templates.in:7001
 msgid "GRUB install devices:"
 msgstr "GRUB 安裝裝置："
 
@@ -80,7 +81,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:3001
+#: ../grub-pc.templates.in:3001 ../templates.in:6001
 msgid ""
 "Running grub-install automatically is recommended in most situations, to "
 "prevent the installed GRUB core image from getting out of sync with GRUB "
@@ -117,7 +118,7 @@ msgstr ""
 
 #. Type: multiselect
 #. Description
-#: ../grub-pc.templates.in:4001
+#: ../grub-pc.templates.in:4001 ../templates.in:7001
 msgid ""
 "The GRUB boot loader was previously installed to a disk that is no longer "
 "present, or whose unique identifier has changed for some reason. It is "
@@ -146,7 +147,7 @@ msgstr "- ${DEVICE} (${SIZE} MB; ${PATH}
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid "Writing GRUB to boot device failed - continue?"
 msgstr "將 GRUB 寫入開機裝置失敗了。是否繼續？"
 
@@ -155,12 +156,13 @@ msgstr "將 GRUB 寫入開機裝置失
 #. Type: boolean
 #. Description
 #: ../grub-pc.templates.in:7001 ../grub-pc.templates.in:8001
+#: ../templates.in:9001
 msgid "GRUB failed to install to the following devices:"
 msgstr "在將 GRUB 安裝至以下裝置時失敗了："
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:7001
+#: ../grub-pc.templates.in:7001 ../templates.in:9001
 msgid ""
 "Do you want to continue anyway? If you do, your computer may not start up "
 "properly."
@@ -185,7 +187,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid "Continue without installing GRUB?"
 msgstr "是否不安裝 GRUB 並繼續？"
 
@@ -205,7 +207,7 @@ msgstr ""
 
 #. Type: boolean
 #. Description
-#: ../grub-pc.templates.in:9001
+#: ../grub-pc.templates.in:9001 ../templates.in:10001
 msgid ""
 "If you are already using a different boot loader and want to carry on doing "
 "so, or if this is a special environment where you do not need a boot loader, "
@@ -275,6 +277,12 @@ msgstr ""
 "您應當逐漸得結束 GRUB 2 的轉換過程，除非這些開機記錄是由其它的作業系統所安裝"
 "的 GRUB 2 建立的。"
 
+#. Type: boolean
+#. Description
+#: ../grub-pc.templates.in:15001 ../templates.in:11001
+msgid "Choose installation target based on the device containing /boot?"
+msgstr ""
+
 #. Type: string
 #. Description
 #: ../templates.in:1001
@@ -311,20 +319,31 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
-msgid "Force extra installation to the EFI removable media path?"
+#, fuzzy
+#| msgid "Force extra installation to the EFI removable media path?"
+msgid "Skip extra installation to the EFI removable media path?"
 msgstr "強制額外的安裝到 EFI 可移動媒體的路徑？"
 
 #. Type: boolean
 #. Description
 #: ../templates.in:3001
+#, fuzzy
+#| msgid ""
+#| "Some EFI-based systems are buggy and do not handle new bootloaders "
+#| "correctly. If you force an extra installation of GRUB to the EFI "
+#| "removable media path, this should ensure that this system will boot "
+#| "Debian correctly despite such a problem. However, it may remove the "
+#| "ability to boot any other operating systems that also depend on this "
+#| "path. If so, you will need to make sure that GRUB is configured "
+#| "successfully to be able to boot any other OS installations correctly."
 msgid ""
 "Some EFI-based systems are buggy and do not handle new bootloaders "
-"correctly. If you force an extra installation of GRUB to the EFI removable "
-"media path, this should ensure that this system will boot Debian correctly "
-"despite such a problem. However, it may remove the ability to boot any other "
-"operating systems that also depend on this path. If so, you will need to "
-"make sure that GRUB is configured successfully to be able to boot any other "
-"OS installations correctly."
+"correctly. If you do not make an extra installation of GRUB to the EFI "
+"removable media path, this may prevent your system from booting Debian "
+"correctly in case it is affected by this problem. However, it may remove the "
+"ability to boot any other operating systems that also depend on this path. "
+"If so, you will need to make sure that GRUB is configured successfully to be "
+"able to boot any other OS installations correctly."
 msgstr ""
 "一些基於 EFI 的系統是不穩定的，無法正確處理新的引導程序。如果強制額外安裝 "
 "GRUB 到可移動 EFI 媒體路徑，應該可以確保這個系統將正常啟動 Debian。但是，它可"
@@ -372,6 +391,91 @@ msgid ""
 "those guest OSes as it mounts filesystems to look for things."
 msgstr ""
 
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+msgid "GRUB EFI system partitions:"
+msgstr ""
+
+#. Type: multiselect
+#. Description
+#: ../templates.in:6001
+#, fuzzy
+#| msgid ""
+#| "The grub-pc package is being upgraded. This menu allows you to select "
+#| "which devices you'd like grub-install to be automatically run for, if any."
+msgid ""
+"The grub-efi package is being upgraded. This menu allows you to select which "
+"EFI system partions you'd like grub-install to be automatically run for, if "
+"any."
+msgstr ""
+"grub-pc 套件正在升級。這個選單讓您選擇 grub-install 要在哪一個裝置上自動執"
+"行，如果有的話。"
+
+#. Type: text
+#. Description
+#: ../templates.in:8001
+#, fuzzy
+#| msgid "${DEVICE} (${SIZE} MB; ${MODEL})"
+msgid "${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}"
+msgstr "${DEVICE} (${SIZE} MB; ${MODEL})"
+
+#. Type: boolean
+#. Description
+#: ../templates.in:10001
+#, fuzzy
+#| msgid ""
+#| "You chose not to install GRUB to any devices. If you continue, the boot "
+#| "loader may not be properly configured, and when this computer next starts "
+#| "up it will use whatever was previously in the boot sector. If there is an "
+#| "earlier version of GRUB 2 in the boot sector, it may be unable to load "
+#| "modules or handle the current configuration file."
+msgid ""
+"You chose not to install GRUB to any devices. If you continue, the boot "
+"loader may not be properly configured, and when this computer next starts up "
+"it will use whatever was previously configured. If there is an earlier "
+"version of GRUB 2 in the EFI system partition, it may be unable to load "
+"modules or handle the current configuration file."
+msgstr ""
+"您決定了不將 GRUB 安裝至任何裝置。如果您繼續，開機程式可能未經適當得設定，且"
+"當您電腦下次開機時，它會使用原本就位於開機磁區上的東西，而這可能會導至模組無"
+"法載入，或是無法處理目前所使用的設定檔。"
+
+#. Type: title
+#. Description
+#: ../templates.in:12001
+msgid "unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid "Cannot upgrade Secure Boot enforcement policy due to unsigned kernels"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"Your system has UEFI Secure Boot enabled in firmware, and the following "
+"kernels present on your system are unsigned:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid " ${unsigned_versions}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates.in:13001
+msgid ""
+"These kernels cannot be verified under Secure Boot.  To ensure your system "
+"remains bootable, GRUB will not be upgraded on your disk until these kernels "
+"are removed or replaced with signed kernels."
+msgstr ""
+
 #~ msgid "kFreeBSD command line:"
 #~ msgstr "kFreeBSD 命令列："
 
@@ -381,9 +485,9 @@ msgstr ""
 #~ "is correct, and modify it if necessary. The command line is allowed to be "
 #~ "empty."
 #~ msgstr ""
-#~ "以下的 kFreeBSD 命令列是由 /etc/default/grub，或是由 GRUB Legacy 的 "
-#~ "menu.lst 中的 `kopt' 參數所擷取出來的。請確認它是否正確，若有必要請加以修"
-#~ "改。此命令列可以留空。"
+#~ "以下的 kFreeBSD 命令列是由 /etc/default/grub，或是由 GRUB Legacy 的 menu."
+#~ "lst 中的 `kopt' 參數所擷取出來的。請確認它是否正確，若有必要請加以修改。此"
+#~ "命令列可以留空。"
 
 #~ msgid "kFreeBSD default command line:"
 #~ msgstr "kFreeBSD 預設命令列："
diff -pruN 2.14~git20250718.0e36779-1/debian/postinst.in 2.14~git20250718.0e36779-1ubuntu4/debian/postinst.in
--- 2.14~git20250718.0e36779-1/debian/postinst.in	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/postinst.in	2025-09-09 12:53:05.000000000 +0000
@@ -201,6 +201,22 @@ get_mountpoint()
   echo "${boot_mountpoint:-/}"
 }
 
+# Parse /proc/mounts and find out the mount for the given device.
+# The device must be a real device in /dev, not a symlink to one.
+get_mounted_device()
+{
+  mountpoint="$1"
+  cat /proc/mounts | while read -r line; do
+    set -f
+    set -- $line
+    set +f
+    if [ "$2" = "$mountpoint" ]; then
+      echo "$1"
+      break
+    fi
+  done
+}
+
 config_item()
 {
   for x in /etc/default/grub /etc/default/grub.d/*.cfg; do
@@ -222,6 +238,36 @@ running_in_container()
   type systemd-detect-virt >/dev/null 2>&1 && systemd-detect-virt --quiet --container
 }
 
+get_cloud_style_installation()
+{
+  db_get $1/cloud_style_installation
+  $RET
+}
+
+no_extra_removable_arg()
+{
+    if grub-install --help | grep -q no-extra-removable; then
+	    removable=""
+	    no_removable="--no-extra-removable"
+    elif grub-install --help | grep -q force-extra-removable; then
+	    removable="--force-extra-removable"
+	    no_removable=""
+    else
+	    removable=""
+	    no_removable=""
+    fi
+
+    # Ignore this setting in xenial and bionic, see https://launchpad.net/bugs/1930742
+    local codename="$(cat /etc/os-release | sed -n 's/VERSION_CODENAME=//p')"
+    db_get grub2/no_efi_extra_removable
+    if [ "$RET" = true ] && [ "$codename" != xenial ] && [ "$codename" != bionic ]; then
+        echo "$no_removable"
+    else
+        echo "$removable"
+    fi
+}
+
+
 no_nvram_arg() {
     db_get grub2/update_nvram
     if [ "$RET" = false ]; then
@@ -237,6 +283,18 @@ run_grub_install()
     fi
 }
 
+run_grub_multi_install()
+{
+    tool=/usr/lib/grub/grub-multi-install
+    if [ ! -x $tool ]; then
+	    tool=grub-install
+    fi
+    if ! $tool $@ ; then
+        echo "Failed: grub-install $@" >&2
+        echo "WARNING: Bootloader is not properly installed, system may not be bootable" >&2
+    fi
+}
+
 case "$1" in
   configure)
     . /usr/share/debconf/confmodule
@@ -338,6 +396,9 @@ case "$1" in
         if running_in_container; then
           # Skip grub-install in containers.
           :
+        elif get_cloud_style_installation "grub-pc"; then
+          basedev=$(grub-probe -t device /boot/ | sed -Ee 's/[0-9]+$//' -e 's/([0-9])p$/\1/')
+          grub-install --target=i386-pc "$basedev"
         elif test -e /boot/grub/core.img || \
              test -e /boot/grub/@FIRST_CPU_PLATFORM@/core.img; then
           question=grub-pc/install_devices
@@ -474,16 +535,16 @@ case "$1" in
                   db_fset grub-pc/install_devices_empty seen false
                 fi
               else
-                db_get grub-pc/install_devices_empty
-                if [ "$RET" = true ]; then
-                  break
-                else
-                  echo "You must correct your GRUB install devices before proceeding:" >&2
-                  echo >&2
-                  echo "  DEBIAN_FRONTEND=dialog dpkg --configure grub-pc" >&2
-                  echo "  dpkg --configure -a" >&2
-                  exit 1 # noninteractive
-                fi
+                # UBUNTU: Here we know that noniteractive frontend is used and
+                #  install_devices are empty and install_devices_empty is false.
+                #  This is hit in images where initial configuration was
+                #  avoided due to 'running_in_container', but further
+                #  noninteractive upgrades/reinstallations are made.
+                #  We don't want to error out in such cases, instead continue
+                #  for now, but still prompt on the next interactive run.
+                #  (Prompoting might never have to happen e.g. if a
+                #   service configures install_devices on first boot).
+                break
               fi
             else
               break
@@ -515,12 +576,23 @@ case "$1" in
           grub-efi-loong64) target=loongarch64-efi ;;
         esac
         if [ "$bootloader_id" ] && [ -e "/boot/grub/$target/core.efi" ]; then
-          db_get grub2/force_efi_extra_removable
-          if [ "$RET" = true ]; then
-            FORCE_EXTRA_REMOVABLE="--force-extra-removable"
+          if dpkg --compare-versions "$2" lt-nl 2.02-1~; then
+            # Try to not break people upgrading by suddenly installing things
+            # to /EFI/BOOT without knowing if it might break.
+            db_get grub2/force_efi_extra_removable || true
+            if [ "$RET" = false ]; then
+              db_set grub2/no_efi_extra_removable true
+              db_fset grub2/no_efi_extra_removable seen true
+            fi
+            db_reset grub2/force_efi_extra_removable || true
+            if [ -e "/boot/efi/EFI/${bootloader_id}/fbx64.efi" ]; then
+              rm -f "/boot/efi/EFI/${bootloader_id}/fbx64.efi";
+            fi
           fi
+
+          NO_EXTRA_REMOVABLE="$(no_extra_removable_arg)"
           NO_NVRAM="$(no_nvram_arg)"
-          run_grub_install --target="$target" "$FORCE_EXTRA_REMOVABLE" "$NO_NVRAM"
+          run_grub_multi_install --target="$target" "$NO_EXTRA_REMOVABLE" "$NO_NVRAM"
         fi
 
         # /boot/grub/ has more chances of being accessible by GRUB
diff -pruN 2.14~git20250718.0e36779-1/debian/rules 2.14~git20250718.0e36779-1ubuntu4/debian/rules
--- 2.14~git20250718.0e36779-1/debian/rules	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/rules	2025-09-08 10:56:27.000000000 +0000
@@ -10,12 +10,20 @@ DEB_HOST_ARCH ?= $(shell dpkg-architectu
 DEB_HOST_ARCH_OS ?= $(shell dpkg-architecture -qDEB_HOST_ARCH_OS 2>/dev/null)
 DEB_HOST_ARCH_CPU ?= $(shell dpkg-architecture -qDEB_HOST_ARCH_CPU 2>/dev/null)
 
+# FIXME: maybe re-enable this for userspace binaries later,
+# but we need to make GRUB buildable
+export ELF_PACKAGE_METADATA=
+
 export DEB_BUILD_MAINT_OPTIONS = optimize=-lto
 
 HOST_CPPFLAGS := $(shell dpkg-buildflags --get CPPFLAGS)
 # -O3 (default on Ubuntu ppc64el) introduces various -Werror failures, and
 # isn't worth it here.
+ifneq (,$(filter s390x,$(DEB_HOST_ARCH_CPU)))
+HOST_CFLAGS := -Wall -Wno-error=unused-result $(shell dpkg-buildflags --get CFLAGS | perl -pe 's/-O[23]\b/-O1/')
+else
 HOST_CFLAGS := -Wall -Wno-error=unused-result $(shell dpkg-buildflags --get CFLAGS | perl -pe 's/-O3\b/-O2/')
+endif
 HOST_LDFLAGS := $(shell dpkg-buildflags --get LDFLAGS)
 
 include /usr/share/dpkg/pkg-info.mk
@@ -103,7 +111,7 @@ FLICKER_FREE_BOOT := no
 endif
 
 ifeq ($(FLICKER_FREE_BOOT),yes)
-DEFAULT_HIDDEN_TIMEOUT := 0
+DEFAULT_TIMEOUT := 0
 DEFAULT_HIDDEN_TIMEOUT_BOOL := true
 confflags += \
 	--enable-quiet-boot \
@@ -113,7 +121,6 @@ confflags += \
 substvars += \
 	-Vgfxpayload-depends="grub-gfxpayload-lists [any-i386 any-amd64]"
 else
-DEFAULT_HIDDEN_TIMEOUT :=
 DEFAULT_HIDDEN_TIMEOUT_BOOL := false
 endif
 
@@ -131,12 +138,71 @@ debian/stamps/build-grub-efi-loong64 ins
 debian/stamps/build-grub-efi-riscv64 install/grub-efi-riscv64: export SB_PLATFORM := riscv64-efi
 debian/stamps/build-grub-efi-riscv64 install/grub-efi-riscv64: export SB_EFI_NAME := riscv64
 SB_PACKAGE :=
+ONLY_BUILD :=
 ifeq (yes,$(shell dpkg-vendor --derives-from Ubuntu && echo yes))
+generate-grub2-unsigned:
+	rm -f debian/files
+	sed '1s/^grub2 /grub2-unsigned /' -i debian/changelog
+	sed '1s/ grub2$$/ grub2-unsigned/' -i debian/control
+	cp debian/changelog debian/changelog.unsigned
+	grep-dctrl -r -F Source grub2 debian/control | sed '1s/ grub2$$/ grub2-unsigned/' > debian/control.unsigned
+	grep-dctrl -r -F Package '^grub-efi-a.*64$$' debian/control >> debian/control.unsigned
+	grep-dctrl -r -F Package '^grub-efi-a.*64.*-bin$$' debian/control >> debian/control.unsigned
+	grep-dctrl -r -F Package '^grub-efi-a.*64.*-dbg$$' debian/control >> debian/control.unsigned
+	grep-dctrl -r -F Package '^grub-efi-a.*64.*-unsigned$$' debian/control >> debian/control.unsigned
+	cp ../grub2_$(DEB_VERSION_UPSTREAM).orig.tar.xz ../grub2-unsigned_$(DEB_VERSION_UPSTREAM).orig.tar.xz
+	dch --append -c debian/changelog.unsigned 'Source package generated from src:grub2 using make -f ./debian/rules generate-grub2-unsigned'
+	rm -f debian/files
+	dpkg-buildpackage -S -d -nc -sa -uc -us \
+	--source-option=-I --source-option=-Idebian/control.unsigned --source-option=-Idebian/changelog.unsigned \
+	--source-option=-c$(CURDIR)/debian/control.unsigned --changes-option=-c$(CURDIR)/debian/control.unsigned --buildinfo-option=-c$(CURDIR)/debian/control.unsigned \
+	--source-option=-l$(CURDIR)/debian/changelog.unsigned --changes-option=-l$(CURDIR)/debian/changelog.unsigned  --buildinfo-option=-l$(CURDIR)/debian/changelog.unsigned $(DPKG_BUILDPACKAGE_OPTIONS)
+	rm debian/changelog.unsigned debian/control.unsigned
+	rm -f debian/files
+	sed '1s/^grub2-unsigned /grub2 /' -i debian/changelog
+	sed '1s/ grub2-unsigned$$/ grub2/' -i debian/control
+
+# Submit this build of grub for raw-uefi signing?
+ifeq ($(DEB_SOURCE),grub2)
+SB_SUBMIT := no
+COMPRESSION :=
+else
+SB_SUBMIT := yes
+COMPRESSION := -Zxz
+endif
 ifeq ($(DEB_HOST_ARCH),amd64)
 SB_PACKAGE := grub-efi-amd64
+override_dh_builddeb: SB_PLATFORM := x86_64-efi
+ifeq ($(SB_SUBMIT),yes)
+# on amd64, src:grub2-unsigned builds efi-amd64 (-bin, -dbg, and -unsigned)
+ONLY_BUILD := -pgrub-efi-$(DEB_HOST_ARCH) -pgrub-efi-$(DEB_HOST_ARCH)-bin -pgrub-efi-$(DEB_HOST_ARCH)-dbg -pgrub-efi-$(DEB_HOST_ARCH)-unsigned
+else
+# on amd64, src:grub2 does not build efi-amd64 (-bin, -dbg, and -unsigned)
+ONLY_BUILD := -Ngrub-efi-$(DEB_HOST_ARCH) -Ngrub-efi-$(DEB_HOST_ARCH)-bin -Ngrub-efi-$(DEB_HOST_ARCH)-dbg -Ngrub-efi-$(DEB_HOST_ARCH)-unsigned
 endif
-ifeq ($(DEB_HOST_ARCH),arm64)
+else ifeq ($(DEB_HOST_ARCH),arm64)
 SB_PACKAGE := grub-efi-arm64
+override_dh_builddeb: SB_PLATFORM := arm64-efi
+ifeq ($(SB_SUBMIT),yes)
+# on amd64, src:grub2-unsigned builds efi-arm64 (-bin, -dbg, and -unsigned)
+ONLY_BUILD := -pgrub-efi-$(DEB_HOST_ARCH) -pgrub-efi-$(DEB_HOST_ARCH)-bin -pgrub-efi-$(DEB_HOST_ARCH)-dbg -pgrub-efi-$(DEB_HOST_ARCH)-unsigned
+else
+# on arm64, src:grub2 does not build efi-arm64 (-bin, -dbg, and -unsigned)
+ONLY_BUILD := -Ngrub-efi-$(DEB_HOST_ARCH) -Ngrub-efi-$(DEB_HOST_ARCH)-bin -Ngrub-efi-$(DEB_HOST_ARCH)-dbg -Ngrub-efi-$(DEB_HOST_ARCH)-unsigned
+endif
+else ifeq ($(DEB_HOST_ARCH),i386)
+ifeq ($(SB_SUBMIT),yes)
+# on i386, src:grub2-unsigned builds efi-amd64 (-bin, -dbg, and -unsigned)
+ONLY_BUILD := -pgrub-efi-amd64 -pgrub-efi-amd64-bin -pgrub-efi-amd64-dbg -pgrub-efi-amd64-unsigned
+else
+# on i386, src:grub2 only builds common packages
+ONLY_BUILD := -pgrub2-common
+endif
+else
+ifeq ($(SB_SUBMIT),yes)
+# on all other arches src:grub2-unsigned FTBFS
+ONLY_BUILD := -pnone
+endif
 endif
 endif
 
@@ -192,6 +258,9 @@ debian/stamps/configure-grub2-common: de
 	touch $@
 
 debian/stamps/build-grub2-common: debian/stamps/build-grub-$(COMMON_PLATFORM)
+ifeq ($(with_check), yes)
+	pytest -q debian/test_grub_sort_version.py
+endif
 	touch $@
 
 debian/stamps/configure-grub-none debian/stamps/configure-grub-pc debian/stamps/configure-grub-ieee1275 debian/stamps/configure-grub-coreboot debian/stamps/configure-grub-emu debian/stamps/configure-grub-uboot:
@@ -300,12 +369,28 @@ debian/stamps/build-grub-pc: debian/stam
 ifeq ($(with_check), yes)
 	LC_MESSAGES=C.UTF-8 LC_CTYPE=C.UTF-8 PATH="$$PATH:/sbin:/usr/sbin" VERBOSE=1 dh_auto_test --max-parallel=1
 endif
+	mkdir -p debian/tmp-$(package)
+	obj/$(package)/grub-mkimage \
+		--directory obj/$(package)/grub-core \
+		--prefix "/boot/grub" \
+		--output debian/tmp-$(package)/eltorito.img \
+		--format "i386-pc-eltorito" \
+		--compression "auto" \
+		biosdisk iso9660
 	touch $@
 
 debian/stamps/build-grub-ieee1275: debian/stamps/configure-grub-ieee1275
 	dh_auto_build
 ifneq (,$(filter powerpc ppc64 ppc64el,$(DEB_HOST_ARCH_CPU)))
 	$(CC) $(HOST_CFLAGS) debian/prep-bootdev.c -o debian/prep-bootdev -lparted
+	mkdir -p debian/tmp-$(package)
+	obj/$(package)/grub-mkimage \
+		--directory obj/$(package)/grub-core \
+		--prefix '()/boot/grub' \
+		--output debian/tmp-$(package)/eltorito.elf \
+		--format "powerpc-ieee1275" \
+		--compression "auto" \
+		linux minicmd normal reboot iso9660
 endif
 	touch $@
 
@@ -538,14 +623,15 @@ ifneq (,$(filter grub2-common,$(BUILD_PA
 		-e "s/@DEFAULT_CMDLINE@/$(DEFAULT_CMDLINE)/g" \
 		-e "s/@DEFAULT_TIMEOUT@/$(DEFAULT_TIMEOUT)/g" \
 		debian/grub2-common/usr/share/grub/default/grub
-ifneq (,$(DEFAULT_HIDDEN_TIMEOUT))
-	perl -pi -e 's/^GRUB_TIMEOUT=.*/GRUB_HIDDEN_TIMEOUT=0\nGRUB_HIDDEN_TIMEOUT_QUIET=true\n$$&/' \
+ifneq (false,$(DEFAULT_HIDDEN_TIMEOUT_BOOL))
+	perl -pi -e 's/^GRUB_TIMEOUT=.*/GRUB_TIMEOUT_STYLE=hidden\n$$&/' \
 		debian/grub2-common/usr/share/grub/default/grub
 endif
 endif
 
 override_dh_installdocs:
 	dh_installdocs $(patsubst %,-p%,$(filter grub2-common grub-rescue-pc grub-firmware-qemu grub-xen-host,$(BUILD_PACKAGES))) -A AUTHORS NEWS README THANKS TODO
+	dh_installdocs $(patsubst %,-p%,$(filter grub-efi-%-unsigned,$(BUILD_PACKAGES)))
 	dh_installdocs $(patsubst %,-p%,$(filter grub-efi-%-signed-template,$(BUILD_PACKAGES)))
 	dh_installdocs -pgrub-efi-amd64 -pgrub-efi-amd64-bin -pgrub-efi-amd64-dbg --link-doc=grub-efi-amd64-bin
 	dh_installdocs -pgrub-efi-arm64 -pgrub-efi-arm64-bin -pgrub-efi-arm64-dbg --link-doc=grub-efi-arm64-bin
@@ -555,23 +641,38 @@ override_dh_bugfiles:
 	dh_bugfiles $(patsubst %,-N%,$(filter grub-efi-%-signed-template,$(BUILD_PACKAGES))) -A
 
 override_dh_strip:
-	dh_strip -X/usr/lib/grub-xen/grub-x86_64-xen.bin -X/usr/lib/grub-xen/grub-i386-xen_pvh.bin -X/usr/lib/grub-xen/grub-i386-xen.bin -X.exec -X.image
+	dh_strip \
+		-X/usr/lib/grub-xen/grub-x86_64-xen.bin \
+		-X/usr/lib/grub-xen/grub-i386-xen_pvh.bin \
+		-X/usr/lib/grub-xen/grub-i386-xen.bin \
+		-X/usr/lib/grub/i386-pc/eltorito.img \
+		-X/usr/lib/grub/powerpc-ieee1275/eltorito.elf \
+		-X.exec -X.image
 
 override_dh_shlibdeps:
 	dh_shlibdeps -X.module
 
 override_dh_gencontrol:
-	dh_gencontrol -- -V"efi:Vendor=$(SB_EFI_VENDOR)" -VBuilt-Using="$(BUILT_USING)" $(substvars)
+	dh_gencontrol $(ONLY_BUILD) -- -V"efi:Vendor=$(SB_EFI_VENDOR)" -VBuilt-Using="$(BUILT_USING)" $(substvars)
 
 TARNAME := grub2_$(deb_version)_$(DEB_HOST_ARCH).tar.gz
 
 override_dh_builddeb:
-	dh_builddeb
+	dh_builddeb $(ONLY_BUILD) -- $(COMPRESSION)
 ifneq (,$(SB_PACKAGE))
 	echo $(deb_version) > obj/monolithic/$(SB_PACKAGE)/version
-	tar -c -f ../$(TARNAME) -a -C obj/monolithic/$(SB_PACKAGE) -v .
+ifeq (yes,$(shell dpkg-vendor --derives-from Ubuntu && echo yes))
+	if [ -d obj/monolithic/$(SB_PACKAGE)/$(deb_version) ]; then \
+		rm -rf obj/monolithic/$(SB_PACKAGE)/$(deb_version); \
+	fi
+	mkdir -v obj/monolithic/$(SB_PACKAGE)/$(deb_version)
+	ln -v obj/monolithic/$(SB_PACKAGE)/* obj/monolithic/$(SB_PACKAGE)/$(deb_version) || :
+endif
+	tar -c -f ../$(TARNAME) -a -C obj/monolithic/$(SB_PACKAGE) -v $(deb_version)
+ifeq ($(SB_SUBMIT),yes)
 	dpkg-distaddfile $(TARNAME) raw-uefi -
 endif
+endif
 
 override_dh_auto_clean:
 	-rm -rf debian/grub-extras-enabled debian/stamps obj grub-core/lib/minilzo/*.c grub-core/lib/minilzo/*.h
diff -pruN 2.14~git20250718.0e36779-1/debian/sbat.ubuntu.csv.in 2.14~git20250718.0e36779-1ubuntu4/debian/sbat.ubuntu.csv.in
--- 2.14~git20250718.0e36779-1/debian/sbat.ubuntu.csv.in	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/sbat.ubuntu.csv.in	2025-09-08 10:56:27.000000000 +0000
@@ -0,0 +1,5 @@
+sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
+grub,5,Free Software Foundation,grub,@UPSTREAM_VERSION@,https://www.gnu.org/software/grub/
+grub.ubuntu,2,Ubuntu,grub2,@DEB_VERSION@,https://www.ubuntu.com/
+grub.ubuntu26,1,Ubuntu,grub2,@DEB_VERSION@,https://www.ubuntu.com/
+grub.peimage,2,Canonical,grub2,@DEB_VERSION@,https://salsa.debian.org/grub-team/grub/-/blob/master/debian/patches/secure-boot/efi-use-peimage-shim.patch
diff -pruN 2.14~git20250718.0e36779-1/debian/templates.in 2.14~git20250718.0e36779-1ubuntu4/debian/templates.in
--- 2.14~git20250718.0e36779-1/debian/templates.in	2025-08-12 10:51:55.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/templates.in	2025-09-08 10:56:27.000000000 +0000
@@ -12,17 +12,17 @@ _Description: Linux default command line
  The following string will be used as Linux parameters for the default menu
  entry but not for the recovery mode.
 
-Template: grub2/force_efi_extra_removable
+Template: grub2/no_efi_extra_removable
 Type: boolean
 Default: false
-_Description: Force extra installation to the EFI removable media path?
+_Description: Skip extra installation to the EFI removable media path?
  Some EFI-based systems are buggy and do not handle new bootloaders correctly.
- If you force an extra installation of GRUB to the EFI removable media path,
- this should ensure that this system will boot Debian correctly despite such a
- problem. However, it may remove the ability to boot any other operating
- systems that also depend on this path. If so, you will need to make sure that
- GRUB is configured successfully to be able to boot any other OS installations
- correctly.
+ If you do not make an extra installation of GRUB to the EFI removable media
+ path, this may prevent your system from booting Debian correctly in case it is
+ affected by this problem. However, it may remove the ability to boot any other
+ operating systems that also depend on this path. If so, you will need to make
+ sure that GRUB is configured successfully to be able to boot any other OS
+ installations correctly.
 
 Template: grub2/update_nvram
 Type: boolean
@@ -47,3 +47,78 @@ _Description: Run os-prober automaticall
  guest OSes installed via LVM or raw disk devices, running os-prober
  can cause damage to those guest OSes as it mounts filesystems to look
  for things.
+
+Template: grub-efi/install_devices
+Type: multiselect
+Choices-C: ${RAW_CHOICES}
+Choices: ${CHOICES}
+_Description: GRUB EFI system partitions:
+ The grub-efi package is being upgraded. This menu allows you to select which
+ EFI system partions you'd like grub-install to be automatically run for, if any.
+ .
+ Running grub-install automatically is recommended in most situations, to
+ prevent the installed GRUB core image from getting out of sync with GRUB
+ modules or grub.cfg.
+
+Template: grub-efi/install_devices_disks_changed
+Type: multiselect
+Choices-C: ${RAW_CHOICES}
+Choices: ${CHOICES}
+_Description: GRUB install devices:
+ The GRUB boot loader was previously installed to a disk that is no longer
+ present, or whose unique identifier has changed for some reason. It is
+ important to make sure that the installed GRUB core image stays in sync
+ with GRUB modules and grub.cfg. Please check again to make sure that GRUB
+ is written to the appropriate boot devices.
+
+Template: grub-efi/partition_description
+Type: text
+_Description: ${DEVICE} (${SIZE} MB; ${PATH}) on ${DISK_SIZE} MB ${DISK_MODEL}
+
+Template: grub-efi/install_devices_failed
+Type: boolean
+Default: false
+#flag:translate!:3
+_Description: Writing GRUB to boot device failed - continue?
+ GRUB failed to install to the following devices:
+ .
+ ${FAILED_DEVICES}
+ .
+ Do you want to continue anyway? If you do, your computer may not start up
+ properly.
+
+Template: grub-efi/install_devices_empty
+Type: boolean
+Default: false
+_Description: Continue without installing GRUB?
+ You chose not to install GRUB to any devices. If you continue, the boot
+ loader may not be properly configured, and when this computer next starts
+ up it will use whatever was previously configured. If there is an
+ earlier version of GRUB 2 in the EFI system partition, it may be unable to load
+ modules or handle the current configuration file.
+ .
+ If you are already using a different boot loader and want to carry on
+ doing so, or if this is a special environment where you do not need a boot
+ loader, then you should continue anyway. Otherwise, you should install
+ GRUB somewhere.
+
+Template: grub-efi/cloud_style_installation
+Type: boolean
+Default: false
+_Description: Choose installation target based on the device containing /boot?
+
+Template: grub2/unsigned_kernels_title
+Type: title
+_Description: unsigned kernels
+
+Template: grub2/unsigned_kernels
+Type: note
+_Description: Cannot upgrade Secure Boot enforcement policy due to unsigned kernels
+ Your system has UEFI Secure Boot enabled in firmware, and the following kernels
+ present on your system are unsigned:
+ .
+  ${unsigned_versions}
+ .
+ These kernels cannot be verified under Secure Boot.  To ensure your system
+ remains bootable, GRUB will not be upgraded on your disk until these kernels are
+ removed or replaced with signed kernels.
diff -pruN 2.14~git20250718.0e36779-1/debian/test_grub_sort_version.py 2.14~git20250718.0e36779-1ubuntu4/debian/test_grub_sort_version.py
--- 2.14~git20250718.0e36779-1/debian/test_grub_sort_version.py	1970-01-01 00:00:00.000000000 +0000
+++ 2.14~git20250718.0e36779-1ubuntu4/debian/test_grub_sort_version.py	2025-08-19 13:14:06.000000000 +0000
@@ -0,0 +1,72 @@
+import os
+import pytest
+import subprocess
+
+GRUB_SORT_VERSION = "debian/grub-sort-version"
+
+def assert_grub_sort_version(input, output, flavour_order=""):
+  env = os.environ.copy()
+  env["LC_ALL"] = "C"
+  env["GRUB_FLAVOUR_ORDER"] = flavour_order
+  # Assert the output is as expected
+  result = subprocess.run([GRUB_SORT_VERSION], env=env,
+                          input=input, encoding="utf-8", capture_output=True)
+  assert result.returncode == 0
+  print(result.stdout)
+  assert result.stdout == output
+  # Then do the same in reverse mode too
+  result = subprocess.run([GRUB_SORT_VERSION, "-r"], env=env,
+                          input=input, encoding="utf-8", capture_output=True)
+  assert result.returncode == 0
+  assert result.stdout == "\n".join(output.rstrip().split("\n")[::-1]) + "\n"
+
+def test_empty_line():
+  INPUT = """/boot/vmlinuz-6.5.0-10-generic 2
+/boot/vmlinuz-6.5.0-9-generic 2
+ 2
+"""
+
+  OUTPUT = """ 2
+/boot/vmlinuz-6.5.0-9-generic 2
+/boot/vmlinuz-6.5.0-10-generic 2
+"""
+
+  assert_grub_sort_version(INPUT, OUTPUT)
+
+def test_custom_kernels():
+  INPUT = """/boot/vmlinuz-6.6.0 2
+/boot/vmlinuz-6.5.0-10-generic 2
+/boot/vmlinuz-6.5.0-9-generic 2
+/boot/vmlinuz-6.5.9 2
+/boot/vmlinuz-6.5.8 2
+"""
+
+  OUTPUT = """/boot/vmlinuz-6.5.0-9-generic 2
+/boot/vmlinuz-6.5.0-10-generic 2
+/boot/vmlinuz-6.5.8 2
+/boot/vmlinuz-6.5.9 2
+/boot/vmlinuz-6.6.0 2
+"""
+
+  assert_grub_sort_version(INPUT, OUTPUT)
+
+def test_flavour_order():
+  INPUT = """/boot/vmlinuz-6.5.0-10-generic 2
+/boot/vmlinuz-6.5.0-9-generic 2
+/boot/vmlinuz-6.5.0-9-aaa 2
+/boot/vmlinuz-6.5.0-9-aaa 1
+/boot/vmlinuz-6.5.8 2
+/boot/vmlinuz-6.5.9 2
+/boot/vmlinuz-6.6.0 2
+"""
+
+  OUTPUT = """/boot/vmlinuz-6.5.8 2
+/boot/vmlinuz-6.5.9 2
+/boot/vmlinuz-6.6.0 2
+/boot/vmlinuz-6.5.0-9-aaa 1
+/boot/vmlinuz-6.5.0-9-aaa 2
+/boot/vmlinuz-6.5.0-9-generic 2
+/boot/vmlinuz-6.5.0-10-generic 2
+"""
+
+  assert_grub_sort_version(INPUT, OUTPUT, flavour_order="generic aaa")
