Comment 8 for bug 1920008

In xenial chroot, without proposed, installed grub-efi-amd64-signed

# dpkg-query -W | grep grub
grub-common 2.02~beta2-36ubuntu3.29
grub-efi-amd64 2.02~beta2-36ubuntu3.29
grub-efi-amd64-bin 2.02~beta2-36ubuntu3.29
grub-efi-amd64-signed 1.66.29+2.02~beta2-36ubuntu3.29
grub2-common 2.02~beta2-36ubuntu3.29

Enable -proposed, and try to install grub-efi-amd64-signed, alone (no full-upgrade)

# apt install grub-efi-amd64-signed
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following additional packages will be installed:
  grub-common grub-efi-amd64 grub-efi-amd64-bin grub2-common
Suggested packages:
  multiboot-doc grub-emu xorriso desktop-base console-setup
Recommended packages:
  os-prober secureboot-db
The following packages will be upgraded:
  grub-common grub-efi-amd64 grub-efi-amd64-bin grub-efi-amd64-signed grub2-common
5 upgraded, 0 newly installed, 0 to remove and 82 not upgraded.
Need to get 3473 kB of archives.
After this operation, 6041 kB of additional disk space will be used.
Do you want to continue? [Y/n]

The new grub2-common is pulled in. Horay.

Test that grub utils work with one grub

$ grub-mkimage --verbose -O x86_64-efi -o foo
...
lots of text

The image is successfully created.