Comment 3 for bug 1603642

The default is to disable secureboot. However, this requires a password to be set. These defaults seem contradictory when used with DEBIAN_FRONTEND=noninteractive. We use noninteractive mode (along with some other options-- I'll be investigating further tomorrow) to install systems, and the package gets stuck in an infinite loop. From the output of apt-extracttemplates:

Template: shim/disable_secureboot
Type: boolean
Default: true
Description: Disable UEFI Secure Boot?
 If Secure Boot remains enabled on your system, your system may still boot but
 any hardware that requires third-party drivers to work correctly may not be
 usable.

Template: shim/enable_secureboot
Type: boolean
Default: false
Description: Enable UEFI Secure Boot?
 If Secure Boot is enabled on your system, your system may still boot but
 any hardware that requires third-party drivers to work correctly may not be
 usable.

Template: shim/secureboot_key
Type: string
Description: Enter a password for Secure Boot. It will be asked again after a reboot.

Template: shim/secureboot_key_again
Type: string
Description: Enter the same password again to verify you have typed it correctly.