From 44b32045ce9fea4396b7b14950a552e9aeb65c51 Mon Sep 17 00:00:00 2001
From: zj <1052308357@qq.com>
Date: Thu, 12 Feb 2026 02:32:57 +0800
Subject: [PATCH] 8

---
 AGENTS.md                          |  28 +++++-
 __pycache__/backend.cpython-39.pyc | Bin 52841 -> 55350 bytes
 backend.py                         | 138 +++++++++++++++++++++++++++--
 3 files changed, 153 insertions(+), 13 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index e22fe2b..05bc938 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -110,11 +110,29 @@ options root=/dev/mapper/cl-root ro crashkernel=auto rd.lvm.lv=cl/root rhgb quie
 检测到缺少 EFI 模块时，自动安装相应的包：
 | 发行版 | 包名 |
 |--------|------|
-| CentOS/RHEL/Rocky/Alma/Fedora | `grub2-efi-x64`, `grub2-efi-x64-modules` |
-| Debian/Ubuntu | `grub-efi-amd64` |
-| Arch/Manjaro | `grub` (已包含 EFI 支持) |
+| CentOS/RHEL/Rocky/Alma/Fedora | `grub2-efi-x64`, `grub2-efi-x64-modules`, `shim-x64` |
+| Debian/Ubuntu | `grub-efi-amd64`, `shim-signed` |
+| Arch/Manjaro | `grub`, `efibootmgr` |
 
-### 7. GRUB 修复 (`backend.py:chroot_and_repair_grub`)
+### 7. 手动 EFI 安装 (`backend.py:_manual_install_efi_files`)
+
+**NEW v2.4**: 当 `grub2-install` 因 Secure Boot 不支持时，使用手动方式安装 EFI 文件
+
+#### 问题场景
+某些系统（特别是 CentOS/RHEL 8）的 `grub2-install` 会报错：
+```
+this utility cannot be used for EFI platforms because it does not support UEFI Secure Boot.
+```
+
+这是因为标准 `grub2-install` 不支持 Secure Boot，需要使用 `shim` 链式加载。
+
+#### 手动安装方法
+当 `grub2-install` 失败时，自动尝试：
+1. **查找现有 EFI 文件** - 从 `/boot/efi/EFI/<distro>/` 复制已有的 `grubx64.efi` 或 `shimx64.efi`
+2. **使用 shim 链式加载** - 复制 `shimx64.efi` 并配置它加载 `grubx64.efi`
+3. **使用 grub-mkimage 生成** - 从模块生成新的 EFI 文件
+
+### 8. GRUB 修复 (`backend.py:chroot_and_repair_grub`)
 
 #### BIOS 模式
 - `grub-install --target=i386-pc --recheck --force /dev/sdX`
@@ -123,11 +141,13 @@ options root=/dev/mapper/cl-root ro crashkernel=auto rd.lvm.lv=cl/root rhgb quie
 #### UEFI 模式 (参考 Calamares 实现)
 - 自动检测系统架构 (x86_64/i386/arm64/loongarch64)
 - **NEW**: 自动检测并安装 UEFI GRUB 模块
+- **NEW**: 当 grub2-install 因 Secure Boot 失败时，自动使用手动 EFI 安装
 - 获取正确的 EFI 参数 (target, grub_file, boot_file)
 - **多重安装策略**（自动回退）：
   1. 标准安装（带 NVRAM）
   2. Live 环境/可移动模式（`--removable`）
   3. 无 NVRAM 模式（`--no-nvram`）
+  4. **NEW**: 手动 EFI 文件复制（针对 Secure Boot 限制）
 - **NEW**: EFI Fallback 安装（复制到 `/EFI/Boot/bootx64.efi`）
 - **NEW**: 支持自定义 EFI 启动项名称
 
diff --git a/__pycache__/backend.cpython-39.pyc b/__pycache__/backend.cpython-39.pyc
index 2345c4b3fbaeda74dc75fcc21f5252d8ee2c08cb..367ec55a12b33cf0c3b3cf86a54e9acb08b22246 100644
GIT binary patch
delta 12242
zcma(%3wV^(m2>}jWFC2ucfxBDf@BDJ@Cq1t1w!O45<r;(amf7%lgx|z{{tla<A_0C
zB1W#@11JeqTkMvH!>R?fwu+_N+IG9O-P!KyS^~Isb+=pFU3_%Ux&KTuiMqSw<NWt=
z&bjB_bM86!+&do}H$H#PnCZ#Lup8jtXKx<#nzuZXIf|@3UzttFqp?}!K|+r3E7JGK
zQNGPMgFMF17>icX$L0KiKPT-tZlM7h+--K>Dq5YgO?Jxpo26m{4IMYpt(5IHx$8yW
zV9$o*MygO1dTygn@Gp!bquY+#=ytjT_{;*_LCodHCE7{50CP69+hqsv#kQSPgSI(e
z!i~^-p?xlWQjF-NQ5fkyx(oQulN;#$9a4{(t&-={?ruU1@ZGI{qx1o}yxVZha6(FS
z?2*%Y7xbmJ?3E{^U{rJ))=Tb2_d;N@Pi{PBp!?;8KyMQC<GT&+Cb_A{#Qp&N2jr#{
z&JPNVi9m05-|k-IUhH1tUb9rb9VA->$Oq{|^w4gDyr|L8O}Zr^<-@c`v@K3)dxRbq
zZA+4E0XtB0c`4FR(rj=Y<395r$j#U~%V|<r0ZL{FZrV3_T07(btqygvB3^7ANs9P%
ztCl|zF)EX20++e?8`e@%#cx>uw6O@g$`Fi0P>x_cf?E(w01!8}$!gpjV%~ttkX_ui
za7U{gQoX@|%gCw`uLhefAtrD3?$E~&lDT-jeKMKOefArZrz4&i4VePr3~ZPQz-?3H
zkcWBHAR9vafMXn~=cgTO#tza7A#X#<fvLlEMyD6^SJUV6aC&y_Ag-9pa9kjbJAA>m
zmhB!E@CMofe0IhX{@3*EltIM&hZFMZj1n@J|1f<H-<y$LKRAq7yy4h5j17mO@}_Xx
z4yY;;0E5Kl@n2@FNEuA5^Kf!L2li}3>>HU5$uS?ul6u>ky`%)|acjt<sxk{Gde0)n
zaq(YgSCZwNj95e##FmWsrbKG_2f2H)S7Ps-2v#9z=Fz<Uq>kJ2Lq&Dium*rDH*RVV
zdIM}Ww#?&?<j*T<fTBBRfyd{Q=}H!Cl@(<nW1ywE{KNdIj;YWcH!3P~*?DzAu>_18
z3rZcSiU}38TPboUY(eb(f+C3&@=uFuNj{%c{BiDGIFy)<Mc(06R0YPZE-7@}gYC$j
z&EYFc3bI?Vn96orNh1lwE|vU%low#113@~13<QM;auMVq$l>1{HKRBHMOZeUN8KD`
z{&<?-)4IhQkYUJ=MipD<Krh&&pJ$CO7&3#}(Tj-6J4e5@OpKI?42ScFwiPZD!x2~z
zK?uQC04|C7vCI&p&Y)*Z9SQRvkNI~?8+3*1_?^xI{;RRE?1435TaacRKkA%5M4)$^
zb4X__zw{$QR>e%?nn@HFIBxa@x64e|o>;nJjJ(LL9WjkQIl$&&RZQB-Mqzmac99mh
zL)p}_&BI#2zP2zQHkznM^~CMaE(biDz!ca}eMn$<zb$Ved-=@q3&8NS@g_4^*RF|s
z9S4zf4+73}D;1ZhA022sgr&z2JdWTA1WzJ3#?MyXF={6kH2`s9znP8#tyd~5);CwW
z*e+f&>6P;T4?F(Zq;KSZB_j7#jmnvf?Cpx`VXCs-3sauQpR97;HMn?dQ3zB;+#C*t
zV1;qDS%+v)LO!p`8nJ9qWDjfI5;wQ8U^pa<*Hy&!A?|(z2M|2SM^qP)LwsWOIOo8k
zv)$O$2Ow_pp+PRhdMo!=-<_ReG1&NR{_E;@$+u&FTeHlVg>$+oIV%{)t~#DQwE#l;
zgsFR?_1GYc!qlz=185o^sxX`?`!)ix#k;XI4}d#sN%I{m8s*j?l@r?=yU>VSjzQyK
z8?p5P1SvDZD$X)aXq<$EWuy-=^qJGv<~|PyE-7vUC$D-jY=AT9n>LY<v;3#iCt7qp
z^UtQ=zT_}sng-Wcw^JdCg}s1-4PCc*+GeFi?F79HwMj6^hwA3$U(^S7_=Dkq+7bfy
zrm_Y6U+NyR97kR!xH`ji>wuXxt$^(+)GG!wu}fbbaLC-=nK6~T6tmCt5{J$Y@xRIM
zy>(3f08@4n8+#G#;^%LDQ0!J=KkPI%qV=$65j=z7y9nkX5Hi@lYSO}3*!K_#Z6$7N
z^#rIFcIlT_0lSMJe79^;8LSiw2KlA>2J5TP?lQAW+;rPi*s(KjyNi%Byl2+lW^@U0
zE0ed$Oo5#~un*#CUPY{;zCbCvg88YJ#nbL+7PjL`(^u_>z=!<^!E3yI_Ou}$?DXuV
z<Zb@R>?Rm`)||hfvzXTSZq6CNcAND<#B!eH;}@Q^)IoC?)VZ*PUtKtpyun8|tpXTo
z`V+YvlW%8uoc-;h3%b=W#}Vfu@BoM#LE&+e>h;UI&Es_9R==l12ALH-#GsADA^xav
zc+w~L6QmbW_X?IU3bKI-3#X}T=xyxS1|V+nDXUfH4GA5(3fa%G=NAZmiQw-L2xAgf
z`WjXT7wG#?b=!0kZS_;#!i7`V$Xk|_Sbm1+KjqOS&U_)%TUbx=4E(~9e<jyrCznn$
z6FK(xE2m53Ft<0)vhM=KE~#t+IER(ZrH&7g?hgq5$hGFmvVX(kM*!kxi0vJnahu2I
z_karu?_eKe-=FwTnkyXtj>Z2#@Sps%=JL|>Py{WfaKk?2!vx2VdBf_Eu8jff(U(uS
zoh^unR>r&tFe0)05zIq?MnAYE;<n{$maSgAZ1IYP`o`#h?zq{j%6>&?*_9=hHJ%j&
z+m?N@N0CL~a`W0X=~+I+PHPPYK(#7()TL`?mv4eLx7FwEkX!toP~6xdcd{38(9{L}
zn>D}A{~Q{@XE`XGOIT3%F$-cx*Z!77^=TrJnDw8r^cMtTamB*?5v!jd_!EMGH4NuK
zwg2D)*U$7_@7dG;#CQ77?7#7?2jF;w-WlA_7w~aALU5M%v<VSY1%tkLP7D9HyJzGW
z2%sBvqe2?+sCDbQjj)R^u3wYzsImMF&7|CoR2Jaq_XKVltC~B(zYZ6aAKbXqbW@t-
z<Uib)XM>nhi!9H_{%hkVl0RT4x>e}Y<-vP)-Yo(RN}?-N=vVm9VTwncLxkKCR=vKs
zxiuK-oT6)5?9>Jv3w@z0H!&YR-!su79Q|(2JZ0l?*SH<w5W2V)*dmJC;SE5{_W7_T
zjxKB?|GwvzvA;*m3?`>`r)u^K&m}T4c5%~XQgH-FG!J?>-A3PsRuS%9_M|Z1rcGlH
zB3~;w4gFk%!=x&Pr_0O9Snif9$>G=@`CW<Jh;82DAhufpF+36g?_FQWAMw_~iTsLp
zy5$TqkhrnEIvM?Dw2vW|`P%kVq>KM|`z#XWbsbgFI>2+~GqKQPaiPT;JF!$cu<j$V
z)PNktdJ2WC#j4N+?wOQXUV&=d1dFGN9TztSTh(})qPF-U{Ods{bHJ>c4Qw<rAA_I(
zK_LR6nhnSo-IO~Gvc48r8+HqJ3T0X0w5SGyKE-Xq&ycm6?%O-k1(;xm!Y88nVt8o@
z10M*_zwwPG0se{a;b@zII!=+VgEXCHv`Gn=Nwc7=!|da>h+VVy+BBf;lOhhyq5PMc
zMn`A_68fAIMoiUdF3l75{1e8_QnNv|(gIr8YtkHjfF&*rq6S(NNmr$IBQzUmF|f)I
zHM5r9M|ueB>MBz0y$&s1%jkpj99Wbf>$?nrX(of3-a|Tf5JM!B7`jT-3_4QFOx_pV
zWmspRqavC2W(Mr~x7JW=&<Gv9%>aC#Q8P7Ln;}ZaoFat=%~5EeW2uvtK4e^PjATX3
zk?g?zfLtb!KSE?Wj+VDcfH$7rl8UD@q7%NBPd)Id06r2cN#ME$aNC9tnhA?G5f|-*
zgiEGn^+-yinnf!U3pz>5PWC0%$qMTvv5l&QRtX%qzySPeQLbr*HGm6^TD~m!AsNqS
zhUSo)e0ylGL*E@}B1WFJbwbptZ1MW5cGOMl%4}odO;ungRUSWux<m9R-nIZ7R{n~H
zWQWd8!Jz7IW2bF;L=s+FM700iRfFmb;Zk5S;p3MMUVE(fTI|S;z0dX^;0LzeIx$=f
z9sTF_=nnhprKhjH_@HxP(_$xh^Li&s2U=!EVBv3Wtsa#I#T6_YAb9B<_<)7$E{o;z
zJXThy0lU*uiYK-rv70YvMH3x5nP{oT=3D@PJP=iYrw!Zf{9*RH4Z=I9z%ON+i~Wy&
zS9c5|;0oV?afam~aXtbOaOYv0a2Du5Tq6eeC7Z~vD5J=3-mg@^g;J(kUS5o3B?xe*
z>%L$kmQwxfT6F^CIrpmNW6TyZ?C&p@^mNHYvPrg-$6rxb=1v1<antRq*35TV^r5Hn
z((q)<0^r(e<_&X-r1vG>u8obFRnji?8a1<Kg3V~@azfptS*VGcAHof2rWVaIxXHve
zv~=DFn-KKTH41z{nwB=$51Y^$NxL_V+Q1Y=3AbUJA!4QWM#F}th)uKhS_j6oMK!6<
z*av1Zw3#}-vNc_A-FhGe+dwnEf(NuFc_aoi&`f=w!8Gjy^iiW`r&)axiU9ID;D5Si
z1xXiyW5SiOfg?i4GzC^7Tgyn!6g*!>uf5M8{KaN1BjO0;(43UEDbNP)YU`99(p8~B
ziCsttVgYfbNT%xOP1n++TBh)G88lZ*2UnUWJes&0)f}+TlS^fR*+`KrLFCXtU{Fm4
z&DR`)CJV&UX(a0CFbX<k??@dIX+RK3Ifa~+Q)(tH=#Ij?Q;{Osv@kM)7SUqO&}NL}
zXgRb5+-x=-g|3v2X-fm|IifeK&roQH<f_?PZi*kxi{wWNv^*I8P-5+}g|j*YqL%57
z4Bb>953FXKR)A|6#fG~KXf6Ov%?9xDmL93|cPR!|{(l=7wSw0hAO06GZ@UxzUEBX)
z|AE9wP`H$9NB3U6^!&#!?dyM;JJI7!sS?g3>hn4KkM&-C@uIU?ZVfZpIUhWo^XiKa
zU3>KGwS&8^J@)+7mw#~m(eHfx(*EDycfVkM{n&+Thn~KA>5#Jq-C_;6#~N^3HM8`C
z?VK8C|5Fe3?|Z)gh3Bpv-+%qd-9scecx~TNouv~zZKmJ(0e_|crHA_u^xk;+<-?);
z=(Wes_V+w<ZC_9Sfs<mqa3M_VYi1O-Lf`dcXRh_`1(*2_R93TJ0SuP_=-+p&|I)>p
z>wRZ#oOwzJ0hs+SAE|fhu2*!YwD&)C{>Fvq)Ai03P2e{0km|NDnQnoD%`jj82K2EJ
z0J=mVsm5c*Wo)ZNFO~(Ra4vvr`(NqbcP?f6^-ee_LF5sEC5#N-Kh6`&<wSQ??~JmC
zk$hNRGZ2B;^N{KBXLY{U51oVcP2mnPrvKcD8)uIs)>lL}e}~r(2Y=`FM^D0<R##Vd
zZNW>EmbQ@U6a~LRgNk#rM|DERI>i~?u~~77+};_0TTPG8iAr{gB+dz$&t`AiX0K0n
z>bFygPYc`xgu`B%Qbi;-5O%vVbfZg1!_LA)x}>T*Zc0_5E{ASM0wWw94_#kBft2a8
zak$tR^}?e8;7aONqfa#jGokP=wF`xVzQbdIK4D=|kv^pmCy^kCiLf{<6L}9vQ|?H`
zd0E`Mh)^l=(81W)fXE_piklh?kdWJpGwW2GOdT;q4QvJ$X99?4gJHFRZTaD8LB<2I
z+Ya}Nc>98fV~m#ZbR`&Ot$LEGKuQ$eglO5gn0NpW`(#BBigQhij_h`bZoMMzB@!*b
zJPO?5$`<UcMIXwYC6G~)U|0=>;cTDa%Zflow<DobkvQoo7S3{b07qGiAwv#?J-(J?
zGNn%sM10=_&l&dtjv;EzmNJc*L?W3a2mWW0B9qBzB?a(TWCUo;BY8#>F-ca@n+b=3
zOk#x={HBvU$pX~yHQE6;9eOg2CMZkr2UNuLnaOPV)RcyG`1?HFk_X2I;38S1Y~YZ_
z=EAJtknlTSQ7jaG!{|V-qVMigyrJ`q1rLR6I{&28OCIJeUDaQCGa<CU4KcriVDM1%
z9#+M<NtlW-5VVN66>f|43*({ok~};m4J5@r*llPe(KNh_@XAWujD=3!F08n1g_+C}
zT1uFS*p~B!4A^WHx<zBcs|~j!VO;{N0<i>ep?rBmlm?kHJ`XN8Ln8Xr&iltN1a3pp
zuMt~3N=xDuPHsVA;6h=k_O1nP+A6z`!|D7=cU3ZL{j~cDSj!{3KN?wuQdv6S9ZL3z
z!!8>EE#Z8SfKPrPe?GIKRJiF`jXvbSnYPPORW*>OivupJMHKyH3*M%gO@=x@$x3+E
zo;I?SZ{Ne<rtn|)P~zZs>@6rZLO0-bxb0xm0k7H`@&;Kw(nR*|oN+r8*e)1(1zfH?
z4PQ7vH=!W7bg5@mtS$zy&H{xcyk_6_`b9{)c#wf47_bIxS&m@nVheJ&PX6A$4gZIQ
zp)C4cuiz(aO*k20X5HA^006GJ6x8&fc?k;?$9MEZ@iZpGV^*sSFK}Uh(l31hJ!z~7
zWo+cH?JswT*@}aD5&z@<TgU}od|+<ANacs^{w3UhpnS+Z?ePPn$<wim2Z{-4j{W_E
zpQaI+|AM12_#bs9je$Qp*YO4lEf&0v|I?#~$gjBX$au1hA3oAbH2&u!Tc;id47Yii
zxLf=H%3bCa4a*nKW@RYpE@-$(%DNnD7p`hve8-BG#f`IBEr0T8`DnbP=`uQNoNP0c
z7+@Q^EbxW^A&s5m|9JFHlFh3glgYO@e{5%E26D>+&{bFyR#?p@Z=eRZ%#<pBhaL>U
zydWJnbmj6#TJrev$6fFQvHkHeWE?;G`0mN8q3bmHT0O_@vwUzH*c$YQ=8R8+p_as!
zK0!!ySd7_%l6nz{%T1xyL60J$l5jP`5bi*cpFw0{1475|VO6AK4OkKvIH$3M#t}Df
zXK(?^@S@5!4x^FLz`o#bKk2F$y8aXqb%i7AMg(^vSOvgs7d{7q6omT}{qxDk>MS>r
z@_XEWY-j#_Bv^nT#nSob$BLxQmRRBOGUB`kI#;`FA{xe%jtGvF9c&_!eZkkAm|iaI
zZ~?GwML&@IHysKN_>UdR`q*<Po+3sQYmBWsIYWw?6eq1$3$>zd0@;d*IpONyHavE#
zMVdj&(Q>sswYb|H8KaGX-XiLV6sq}jmN=<fRf*2Vl2!<PjhY!D(9aR{B}sbC(hZ5a
zCPD8?%>?j<YM^rkT~?iHqVs42Ep0PF%22AMLHB*YV!r4u?Jb}SME(aQjbKU5(@JS0
z|Gcj_`Z@@*P|w-~HVmNLKmh~gAXt;;Or~Qvv~oi$0&chKt%7G^k6Fp1iy(<B>LZad
zpjoVyC26RIF41e^vMQf0O^jhyDqs>8HmzPwYqtV1TvTb6K4WUFcVwR-rDa*4G|;<T
zv-FPSKR;D!W-!ea{F76q>qgN#AQLjPQwgl`+5|}FDnxCxRsq7f0C%M}0n)iUH5b5D
zC(I}gOt!qoy!BM#0xY-3(g|0U5xAce7hugi_^okKrj_?tlxdJ<twtJH`!#}gExoHv
zicF+;M=G_6kki&jCMBiRCiRY?>-q>tQ6<_&2sl=&f;Iw^U#3lpz+t|}vUMN)U#3;U
z2#4uf;AEt3up<lmJ5W>>{RUmXQe2a5pd0Be;yP_iq&iX!#$;h{(DiL3QWLO4^4y|T
zLP9yD3{$>`dSHQT1}+F8`=gt<=c(LiE2RVc#zvgLFHM;V8k7gM4jSC7*Ag0R6Vp#9
zO{*N3Vy!+!trn(cg`65OMq^DZ`xdd_Ui}iYYnAHMYH9ndZt3AEkqO#_-qJopWU@B7
zw~TfG!4weCr%eG3`E>$FTXRg1w!%w+ApnoxAm;15=IQ(_Yo{qiQvuMFGaASQB?YzG
zqz!`IT9q=eHXFMe)D{x*Tj<u*c~GW}0I8d_ynsX%qy(i+6>~t-RPlO-t`j)zS}x#(
z0S7O0rX^-QRm}PV2p+vVF~GLOcYETyBk}D_e7o=)P!kNM0RtPW00v3=ohgI<b8=9s
z={5^^Nxl(*cdx!us>Mx3z7GiZiH=<$wT+EQGSKfZQii!dA&&SF8nlZap~3foMEf56
z(!G%T?~A?l%!d*jtzJ02E*VD)o_&S9!+-tkT=E;9|J|Qh^mHk9^}A0<(Jn_yx*u)=
zzo|#H#2Ih!0wDETU?9Kznq(Z3%Wx^M5}BB|fk;iGL|&yQXyH;!*mN#mLecZBSmaD0
zAt(8fvrm$Fy!PBEa*i)Q_ds?X5HgJ6;`qnP`TOT8EK#hV<=N*8;W4D*{7g8`dCory
zPnUl_Um%h5v5X6QNOU|z5eRQ0S}sQd5gGB>fPqU%yncw#IxPBLLF8sc!4RcK)lO^^
z7o^j$O$2BWf<;&!jI<&Sdk{H_X@$t@7@n2&7s>`G#nT|;QoLPy0FI}@5iQ_>=jDNT
zkMCRXV*}T8JyG-^wH^|Y?<TCaBA^H`K*ptDN8AWMEMY$b47W|3ruqHPmzC)W8$68o
zyxU~>@y#|i1&LBp3;xFQGHK<LUKsBX(R>4rv5~KTp`k!z4fwk=Jy$So4*PtphsR#1
zaI_$o-(%Nqe(i+`<WrvcV(pNV-{KcXT4ulrNBIM9fAK#u@`x3#Yb}tE*(ED?fB%of
z7h8VuL#gftFj>t|%kYx+JLLF}2;vC-0l{w(paFbf#FDsSc%27cc9#DW)=vTm<8QR^
zn&ja9aHj-Td*g-JjUV6z(PjSJ%j?J+vGiA#lCL~e;~9vd!r=wm6KIq5L({vWLGj6Q
zNPkoo`o?oKToCzHCd>Mr_?t+Lr!H59t}9$Zw+%EAWG#NBja@?ov5s#URzO!8{^ZUd
zQsYF?f3&j^5q^pQRi~f2DzGGg3rg|)a6o_APvmM!rvf~l;^nWlk*%?Vug)c=cL0yS
z`}l2D^H4AA5PVgV;f9VctkAgx@Vjbx)@!49^N$Mk-&pC|=HVYrnmcSih{+3MUxA#3
zi4UAclfTvw=e?^ac|U*eM<rkW!JYlJQt~mM^jZ~RG52d_WblawHuc`u2VOBRz1~R1
z9lq>@9HI1b*=n(U2lp55;p7!R8h6SORJUA|VAuj?CKFlwZE1iyZ2Ymy)j0}K!&zS3
z#fY7>AoiQfKY{CjNyyg7&-}RFvJ<&!{G%T?-z^+~IA9Bj#AX#I>H*nY))Z#HM9S|W
z*f3N|q3{#|`4d;hN>w&~@k%{WW1n0ZOQs!6&H*0t(NnVv$%a9zV5rN@Ht0lM!lTck
zH|N)E!=aFOGEx28uOVy`g#7z&F02@!VcV0`!$#SnBj57Ym<?i^8dt2qgc$QN_)G_?
z<j2w^TANmj)~00hGWHFWLs->wSi<e4|3pJ<DN~y-xQPY%lW(n`z7@NQ5KKhi0T9n>
zY4HRCL3nS5-+d`9EvyQ=#v#B&fYtNbpB6^-l-C3o4?eaWoBtVs&`tnL!g+_WBviQ<
zOX8<&&tvH#f|n4yir{So*AaY<z<^65-pIuZ`e67F(L_XqHNxEsPd^wsd`Pzy0p^_y
zO^&Gu#vs=z2tokd>G0OAz;6SCOod0tJ)#rQM)46pn^4h?#X*x1B^Thtt+VutxjAO2
fDVhA9pFL;u8UAV|mcOR^c<$SkB*^E!J@J14ZYt|d

delta 10011
zcmai434D~*wVyj%CYfxIl`Tv{Aen?LK*A=F5J=bqBm`sx#!0>}VaROU?;9ZD3qiu7
z0us22`eaFz;!;K0(ORWeX!ThYq4lBleXmc{3erkNyS(;U+xO17-(+SI^*#CJKX*Cz
z+<VVC_ndR@=a0@Bes|1}>`F>X(7}ICzj465q499?Xfo>u#i@iG3C$w=31RFP`e(@f
zY>QzUd4QcUWOs`h@Xsd3!(T?LeuPf&9Wx4kA+X!%n8Ev^J?oDdgv|nlo|(eY@HiX`
zBL{JikHrf?Vasll<2LAtj$d|6FKiXI!T4Fwo*-Ibwr*_f5IUi8_BV*P3ktN)5gvpd
zm_q1+1?&*IfpL{sE$nR9_nPQ*ajtMz4<S1E-4*`r5%YU=kLZr;!}Z-_TwhIpY|9?8
zK%?m9B!xY?b$Z7<$9!P2SDg2VPS_{T2L?voJHAKfs1<8_jr1Mpzgw)0VSNv$D1z}O
zN1bDVW1(Y_W3gBV3o8ZMdxibNf!#WB!F*j0>Cy8=9u)55Z3}suU28lf^zz0<1BAW=
z7=Bn>jDrNysIx!B_L^>z&X8n&l1wQ84O4`#5}I8t?V?X84Rp{fXqXCrQZj&r7-Rm?
zEVkUDWZ0pD79m79&_ed1C6`QO`uIO@Kn^q)ArE03LO#NHgb4tup-q%kQ-HdCGDUW3
zeC@UtF(AABKD&XIAYCaon*&sAb#EIq(W-<=q=M~DxG|{$>G*8O6b9nD=`;XGyd(x(
z)Fu1rps^>d<E%5F|4E`6yiyzcAn`V4Nlcv)<;0gf6Zyn!4yvlf<8O1ieXV{s)FeHC
zPETjCm5KFZqoes=hmK}HO&rZuBv!EzNvWk#S}u~Iv^Y~d&LmRmrxLrIxVY@b*`6EE
zK5+fP?_GQ4!Ft$blm!>^P!{Z$Nh4WvQWdi&r^YOe3;!Fmx5L@44h55~dh1-6TibLY
z+n>64B-T|+z$MEf^+{UK0;DNqw^EDAQZ{PXLQ)eFhMmxpGG<8Mo4Oo(S0JoJXkZVg
z-$N?dxQsw{B{r-Au&1fUO@6nJ&cc=|_Wg`%Qq68=WRp3}lsRR>WN20m5|~8-U4|s}
z2;bnmAv4z+qab!~<|a!EP}&Kt34NWJtv6>vtuv3gvh&!i5%DCQ)s47y$7*E8H)a;M
zxg}YmRnVdu{Q=RZ8mZ_KR1?hY4p1jj;$rA*0J}jYt*RAl(b?>leWE1MX6%byLhs1=
z#2b2d<SQgU1N*E9i3mvuxE?wjAq`;|`|;>$#LK=Ioi&fIA+5G<k#latyoJsca~tL^
zt6f#w&={VZdSHZVX$b_Kaz{XfQvs&!4XcDNp^z;evye#aqnvd1_?Q=#@&(`l{>HS>
zR&O^_FZTHm{0IR6yPnTOH)BKW#-7TV%8rc5V1LQ^jky&%gHu_REtCCWY$!D%Puhl~
zs@Pdu<siL$VVgs?h01b2CuC(PXIvxcMlGo(kAEvzIJW^V<ROeUA~!r}s=*`rxRNwk
zSm-G1T8CZ4>99)8&MhwL1S{Q0+p*CoxMY`_0PUjB)$9?4A&Sz2`TjBAN%pda@$<lZ
zkB&E*z(yY_+GpL5oDU%!VI{><2CqL5X*`IfqwH*P7Q0xybaW?Hw*#mo;j2Vkz&fe8
za9v}uo$h266Mvfjt;2E9g9r~HJj^mn?wI#ogpNeF<n#pFB_}se)Vk=C?Zap}&YB>}
zE-Fh~-LUg2_FRdrBr3xuWR4n9O~F6_1dT$cn|Om1@VI3<kCD=}aumHio9@HjyAkd|
zxEH`-5yUM{pUW$1CA2$wkj*b0XNxF+_8@g1fNJ!(eIlKY^=7uO^!C&k`@zQ3>{jVj
zayoRmY^h-a?)NLbt&kqUu1c&Cdk_;2o9)`&d#@dMX{L=nz~)Zb+l{`OFCLtR<oBW7
zxCDs{fS$%aZb7@SgontHvbb@1{d}>-FNn41K<OOp;@h-FEr+hh*4+q$cg-cC5<w*a
zZZ?U7&Ot-P>a^!!kX^6FgDzw@hAVJ4=PHT_Im5137NtatBA5+?Hny`egH=qmFFuUJ
zj8Qdc7R}dXra!`k43?@I*DCR|KE!&#cpslymGPps3ai&2^vTWuxKo+du)j||Xnq8F
z9b@-Rv(JdErLG>1Hn#vip^?7y%?Sr>^owaz$hlDdbT_eT{E+@QduT>ZMuaInfsH2-
zcCxo-?C0m2n;3lp8|NWBiSRvyrw~v@nlj?QZPVP8=+j7qmZZkFxO{>e&a?OpDPVUt
z<PgqgnS!LK-_PEiIoI+EwA)SeC6;sB6gb-rx2+-M8TQnyeI@9`RSOljh*Scf5IHJp
zoLk~j)C8m*9JXP0W-1rbc^F17ApDH&o?S7>wf%hd67n`nnNtTdt)BB&^dj~1uMU3(
zs2wJaCzswCR#kfvI<MBQA+ND%bq#>`*8Q2h8tPs^38c|~T=<-3=u2@TZn1YlNi~34
zRio_oikg|@qE(C6)h-HdDrvz9EkT7?CPVh7ZQ&Qt!b2Q=9ZS^+5r4p)sHTUvu_Fke
znmtlCk9nvmdltQfJ(m%FiSR1~E)5>?eumZa2wW~dhLR&*GsG6JpxH5Z40y;K@huz0
zmUbsBSdDKDdOVt^zKFx$0#Gd&QUfk_YH>ye#%1~@LX7udmlpq?To1jtq{2jm(B~^E
z_2e+iZ=98|69_x?c?GnRZEDQ5{vOADhVUgj+E|=-6N`TUP)*d|(%zxQyF6YOxT)Ya
z`Z@OfiT$>*(0U7tUm*OEWv<H4Jqty99F5_IeaMG$j-RtTRs}R|MQlhDFZV=kNQkyZ
zHzHsJqjw=hOh0-s)c9phOIIygx~RTZJ06>WP&K(_5kfm!fjxzbT}|<Wg^M21C5c>o
z4z{={F{K@;<68VaP`wOZS8SS{?}9dm#p7-lonBW!HMENz^aW@eB+!3tdN<>1WUp7P
z0^~r{uX&o9(Am}Rlj+(vaS-42U$FFF2wb>aFkfQz&j^1)&}7KY-##Y49O~d~{sBJ@
zYXB}4t~S1uK?@*jXAl1$Bs6Gdh1B3iSFG(Zz-hg*uF0%<nNZpKMv}i4dNJc^@w$9p
z8A=*Ez>f}H3Ol`FNp7cpqAfTKsIQ&5=f-1uYzrEiYHZgI?14a2hBKTE4R<z^jEG@q
zW}xkl-E-&m+j+3Tg=re(3gvEdh^A4=s#)3?l-(ZH)Z!0xOx6w~Kf2Y(09~LxExbLp
z&Q)aQ{=J7CaOII^_N*(%ybkHsvww3<82d349Z6Jl`yi&n8NqWDdjztZ&yf+KE6uNw
z!uyf2DeAv8+xrN4;j$oU<|p+Z?1E4?c0cm9z}eGI9ZoZd?*wrf8N+0;m>drEiC6XH
z)6mY1Rzjw;1MVis=|6T?nxDZzgpJu$8rBM1xhaRd$^x4nB^@lSeHPilR<xINSK{m$
zl*@1ofiYZsIanHtzz@X;EL9^%E-EhTCaiKXqy5M1>~*NBMv#ciPmgNwx5#RoBs;wj
z-L){195J8@h@i-PG(tK;1_GBlmo&O0M;v+^kO$4j&SqBbNgw3WmwWb&Du6C9F-?rP
z1c(sMAPj^E`=w_LX<#YdL*0T^NNm%8CnmKK0soT2e<{b}yAqUyzIcVS>H76uR>dlP
zA;$@+3V~;WVaE;l03Zw((s(`nxS>_ws1q`}5@r1+L!VL637Ie|iPua@Vt+U3C3Hh)
zww%ysRT7n?ez@Sv79k7StkL-@j5;~7mvpQnx~^oR>l`U33E4{Wz>C8g-CCV6qAPhv
zvM)jVE!UOn6e5h=q65D7%E?N6n@$+@D9O?()-0VcS{Nhb95k#mbft8ex>9|+x`B8s
zCw>Qs1)GrDrU$}2VO%U>m{I<BGMWi|#&bUZ4AV~dPTFLUPXWs3xW07>h(}53)k}qP
ziclC9o?S`hozNE+l%=2a>S>K^7K%6xJb?gxF)vR90gr$ukrKAc{}~y_e1SQnlRXpI
z7q6K-m;tNWTu__bMuW{Ip#Kt=SD0Es{|PqnWV{v)xQFD?<o|Y)I(BLEibQHet1|%v
z$FmdbvzS1Kk2XWKo`RCl9j3w$*qi1C;EH&J=B?e1^XX$;UK|in^oqe0fa{Mucm3#D
zaC6u0e(*;B6Es2N#EFWKau@)NkN9ku#)9qfEJ^x}7Re;w6LawRi9~Or9aVmE`DsS)
zPKV>*Gz82hwZO)YFArJ6q6dc-0+E`a1$ex#YGt^!K;p*l4h{?3D32qV?0}q~pM@;5
z5qO%xPwsl0A=VRKkqgKH_O+Zp+Gr*N|H4mHe>Ep2>Ww6oq_R1|6=~%-yAgwc-K;ID
zjP(a6>1%YMf*l_ltnVW4R}uPI`mQr()GM9DezD6<?qidCO20M8bEyQ8@^OTy1g>J0
z3yFKSyReFag9OJXXqU98;Hsemu5sMOl;MsiBTPZ40C1$D%(}tjc(=lpk0(!Y806ie
zq?)kM!DXacn*DwmyB&#=KS*1&^gx1Ju~ut!dqkcJI?PhA8R;x&%-jQF`rxo?%5ZYR
z7&+s@S?%r&{Z%7dw|jTeOjuRKC$c~6&VrQJwCAcBGTCeUkHwFJ?qEI)Vx{{>rCz`5
z(QBs;mX?;%aO`;gz{4QY<p)1cv*Yf}?eLx?dbrKg6t?2NaWl}yX|Xm*#Bw{WB_)xV
z$jz8eL=w$@JM|@vw1ho<-)?w5nskUlf_>_cP=@B;nHmh>t)ay2gPX3)+bU6TkB}^u
zv^x^K?bzB9aQmSiVAFfIPn!jubSEsK9$t@5!7m(_T3ivzDAxS2x)9(q6BHJ)-}i2v
zIUC2$i89c026QU6)F2F&Dj$AR8~(`Q_5Y8J;aaro6X(aREqWSvVQ)16<ctyqwWxt{
z8|0@IPo^42#em1vBEq{`&<hEEB(}xT+i;CD*p4IlR=!()_A=QsM<$REyK<x|gU3>S
z7%_rsH|Hu=$nu9=@zrd0t2diW3kBH-LKcP&-T(JEBC!3(j)8A2JZ>9EB<hb>Szkj=
zT<VqVq2u?FcUZxR@nkMrcA|xBXFoWxIp;7?I7~}<wtfT3ou+zt5}QqJT+*!iWICiL
zO(*lmU_R7ou$9@Uh)khd*J*~Exkt3oXW7w{D@iiDaZ)6YviiR5W-AU)Vwd~Il0<f^
zuf}!;=z|#mzuR{Z+~}wGpS*r|uMH1LX-jJx&1Eb5cTZXbqn;$+sZ%v!mIu=47QZ(z
z=LIuNuqb4Hl#uRk$r@vB1>9Fe{RhvRxMSf;pN|Xu9`1<io9mOi818ASv4dwzm}gQn
z1l6>a!p(tx1ZDd;)UZKE|H1Bg%s!Lr^(!RQl#8rqAk-l&0B|I5r=q!m7+tfQk4-iI
zH;#Oo6`tB&HVp?%M;L6?Y8n+Kcxo4&%^nHf-MFXvn<@0psXSt90{T_<cy4s+fWv`%
zM>~%Xu*US$m1b^+HEj9mF(f_YJ$;H84D{<z`V-UiUMMK0UO<TAGcj_@S&B{>uB0jH
zin#}(siKE(Di*~E*eC0R+mJ>{k&VJEVK$^C#w=Y|t`Y~m(}BYr-kaN(DOB|%9h4M;
zB{^Nm6{?SXe?+$;X9#n(JcAPhd#O*bc4hhUWxY_N*ap%loLK5pvVqw=t(CLPg4T<|
ze8}~(`$<<GjHy-f2F3_xp-!t|h6gh(h|KXJY{5it-YLgzvcO=-P84&$A-2|+-LH#j
zS=g_S^e$4&T5p@NYn)*2%2&qC*RB6y*LY4bOc@WEkck$71QxTueLr{Y2w@3tafCUH
zR|+7(EabJ3N+B%V4zx>^0!UAnDR#j6<0f1x2qM4NwAm5PGShlZ9q&Vy3CTClGMBS$
zPuRMFphy8S=_VweD{vSnW+flqAT+k=yNZNWUByZfEOBPn#DPsH6Z=L9P5lHGQlc%J
z<7lM>+DNaN8kLD%5G8ueo2%i^s1)~_rNu%6a54z1A&WFa>YA>k2;FOh+j%;=R&WRt
zc;1@RRoYdm<N(PI=p$Waz69AM+@Tb=83vbO*XxA!Apf#{o@(;Nn}rQZ@qh|(3Z)E^
zU8itog!|Yo8*+!FUN5-1qc#HiZq{mHeYbFiVHGRIksX(7J66hJr*ZT=uZ_eSSA@V-
zAZqu7&IWmmQZBUi=nqZqDo_gga{6^$laxt)V}&-LpDZsh3mcWmpfk5NU=3U?j5?zZ
z?$<is@JYJfI7unj5&my2U__U39Y2ZD<tEVO`0jS4d|>Bb@Ntp~W*SdZL7|?oY`n2s
z5`4-q*uX!Pbe~@E<492F6uup_>3{-HltL5GSZJP-1~i+2#t1YOVF6450a&O9^sox~
zc0+-NCz8Uya`-nG{@sGVJ~_;wf;0GVfC2n&jhXc5z@)-9&7h%wfNuw<>(qn>?c0HG
zlMV_B@95&Ies6$*_FWfx`8wfuM|e5>YcSMzhU@&pGSvBpWuXV|9J@o8p8ZS@+0#ou
zTssgLM}&S#-evEHs>pjR`?)vFx#(xNhdzDoVSUK<<19i>u<0-UOHL&;2k{G%4gUN1
z7_-4=qw7caeRA$c@M!)l`{Kntsg>xlF);F!isrFBFBRtOz&a0i$x!;_<yStv|A}jd
zU;gCWDHvDA-g;>|Nnplv_roLG!{;*f<ZS5d%X>*TrgnClcCBBEEO;m?z_ms1_B@si
z33sm}@j|4-0HB4jZP>;y8<?E)2MhiJspZkp(8dEF=A5+kE*yf{j~WNJ2Fcy2g*Y`1
z5+3|I5sj$$5(BT{_DU_iS&hT-2Eres=o&2Dj<6O1<Bh8Kx2p#DI6^P7qVp5;GNH|3
z#ZNBoEh0p*EwmI#V-j?>?Ys!DHy@lIZ{<;P9WHJ?OTI8Sb1oLQBJjl8h;N<r5ECyH
zT2~>LkFl$VJ#?Xfe8tXRC?E9f@b?R&%x^&EAbr3_|LjXP>gQh)S19S#&-7D2g<-4s
zClYw{`48lwBK$kT`v|{AKwbaNfF+)B|D2V+Zp;4-)=vNg(*dp@d+PduT{m8S`PNSk
z+;|~$<CT4&_E#BweJyz{bn*2i<XcnGkB|py5*|@qzBW;Nr}=<4NFGrPXxG0sB*W~}
zVWwW0ilTOLd;^;?f3YWNIzgd1;z8nm>V&WF^coUy$-SwohpssM*6a<)Dv`8rOY4!~
zErg2*Jbx*`5{E)4sTo0^_V^sW%19j&@R-Oxd83WAhL*lrMc`DOU7gPQ-YP1=!$a#4
zzAZOj4jp?f(76a0cb2ou7e}+Si&@%tLB7nbtn%W-sv(xnch6I|dB~X?ZzQpUw`87e
z^VI3Lxb#n0-^G!sL$|`-yqHV2vYQu6NLy&++j+zqd4+%jyx>yg^=<p5`6QQ}zhr~7
z`lCyEt9arVJvw+i2kyIQ&@u1vnziB*hKMkE;N21bUkjhWENso?(%~Cn^uP-(KQlF<
z2QR-tk|9}ab>qd;+eWFLwf$=5z{B9<ziRB}N1W%Zd|?}LI-aCPmT0$V65%|5iTzI_
zGz?xW*Zh!mj?}Jokfw$&#{By0r|=s1Jg7|qp|g&6Du_FD=AE&mV*kKa;X%3<%b|gW
zsQFOT`R4;Vr^^|+Qd8EBOToDZ?t#yJ$G}^BAfs1m3nOEwXJGV@S-#MSuU^SnjSkvw
zsISNSCf;=5XA+FEo9lSBZWXWA4Ky#I4qN~?yB}Z)51{rPfgd_!o5$Zwea!Lhy6ymW
zWg*xR?gUU%oKBa|=ZA+>_+BYFopd60<snoca7}R^&J~9yq@C+(D5*w}vWIft|DV{y
z73swi_vA8`xYqYVsayLh`#d(jh;R<!6@<4Dt|NSnz~6pHpse_7aWt6l*uvujj{wmS
z;zHt9gf;}UPwGY(gZw5T_^}9&A<a$+zI*$r44?Y;U<dc)qu6`z6%;ygNYt`;sSs#X
g%Pe?U4tm5nCa6hfHvZQ?ByRTMuZxMu65lWSUkQQ~w*UYD

diff --git a/backend.py b/backend.py
index 5ab4f82..988870d 100644
--- a/backend.py
+++ b/backend.py
@@ -1176,16 +1176,17 @@ def check_and_install_efi_modules(mount_point: str, distro_type: str, is_uefi: b
     chroot_cmd_prefix = ["sudo", "chroot", mount_point]
     
     # 根据发行版选择正确的 EFI 包
+    # 注意：CentOS/RHEL 8+ 需要 shim 包来支持 UEFI Secure Boot
     efi_packages_map = {
-        "centos": ["grub2-efi-x64", "grub2-efi-x64-modules"],
-        "rhel": ["grub2-efi-x64", "grub2-efi-x64-modules"],
-        "fedora": ["grub2-efi-x64", "grub2-efi-x64-modules"],
-        "rocky": ["grub2-efi-x64", "grub2-efi-x64-modules"],
-        "almalinux": ["grub2-efi-x64", "grub2-efi-x64-modules"],
-        "debian": ["grub-efi-amd64"],
-        "ubuntu": ["grub-efi-amd64"],
-        "arch": ["grub"],  # Arch 的 grub 包包含 EFI 支持
-        "manjaro": ["grub"],
+        "centos": ["grub2-efi-x64", "grub2-efi-x64-modules", "shim-x64"],
+        "rhel": ["grub2-efi-x64", "grub2-efi-x64-modules", "shim-x64"],
+        "fedora": ["grub2-efi-x64", "grub2-efi-x64-modules", "shim-x64"],
+        "rocky": ["grub2-efi-x64", "grub2-efi-x64-modules", "shim-x64"],
+        "almalinux": ["grub2-efi-x64", "grub2-efi-x64-modules", "shim-x64"],
+        "debian": ["grub-efi-amd64", "shim-signed"],
+        "ubuntu": ["grub-efi-amd64", "shim-signed"],
+        "arch": ["grub", "efibootmgr"],  # Arch 的 grub 包包含 EFI 支持
+        "manjaro": ["grub", "efibootmgr"],
     }
     
     efi_packages = efi_packages_map.get(distro_type, [])
@@ -1194,6 +1195,8 @@ def check_and_install_efi_modules(mount_point: str, distro_type: str, is_uefi: b
         log_warning(f"未知的发行版 '{distro_type}'，无法自动安装 EFI 模块")
         return False, f"无法确定 {distro_type} 的 EFI 包名"
     
+    log_info(f"将安装以下 EFI 包: {', '.join(efi_packages)}")
+    
     # 安装 EFI 包前，先确保网络连接（复制 DNS 配置）
     resolv_source = "/etc/resolv.conf"
     resolv_target = os.path.join(mount_point, "etc/resolv.conf")
@@ -1244,6 +1247,113 @@ def check_and_install_efi_modules(mount_point: str, distro_type: str, is_uefi: b
         return False, "UEFI 模块安装失败"
 
 
+def _manual_install_efi_files(mount_point: str, efi_target: str, efi_grub_file: str,
+                               efi_boot_file: str, bootloader_id: str = "GRUB") -> bool:
+    """
+    手动安装 EFI 文件（当 grub2-install 因为 Secure Boot 不支持时使用）。
+    直接从 /boot/efi/EFI/<distro>/ 复制已有的 EFI 文件，或使用 shim 链式加载。
+    
+    返回: 是否成功
+    """
+    log_step("手动安装 EFI 文件", f"目标: {efi_grub_file}")
+    
+    efi_firmware_dir = os.path.join(mount_point, "boot/efi/EFI")
+    
+    # 创建目标目录
+    target_dir = os.path.join(efi_firmware_dir, bootloader_id)
+    try:
+        os.makedirs(target_dir, exist_ok=True)
+        log_info(f"创建/确认 EFI 目录: {target_dir}")
+    except Exception as e:
+        log_error(f"创建 EFI 目录失败: {e}")
+        return False
+    
+    # 查找源 EFI 文件
+    # 可能的源路径：
+    source_paths = []
+    
+    # 1. 从 /boot/efi/EFI/centos 或 /boot/efi/EFI/redhat 复制
+    for subdir in ["centos", "redhat", "fedora", "rocky", "almalinux", "boot"]:
+        source_paths.append(os.path.join(efi_firmware_dir, subdir, efi_grub_file))
+        source_paths.append(os.path.join(efi_firmware_dir, subdir, "shimx64.efi"))
+        source_paths.append(os.path.join(efi_firmware_dir, subdir, "shim.efi"))
+    
+    # 2. 从 /boot/efi/ 直接查找
+    source_paths.append(os.path.join(mount_point, "boot/efi", efi_grub_file))
+    source_paths.append(os.path.join(mount_point, "boot/efi", "shimx64.efi"))
+    
+    # 3. 从 /usr/lib/grub/x86_64-efi/ 复制 grubx64.efi
+    grub_modules_dir = os.path.join(mount_point, f"usr/lib/grub/{efi_target}")
+    source_paths.append(os.path.join(grub_modules_dir, "grubx64.efi"))
+    
+    # 查找 shim 和 grub
+    shim_source = None
+    grub_source = None
+    
+    for path in source_paths:
+        if os.path.exists(path):
+            log_info(f"找到 EFI 文件: {path}")
+            if "shim" in path.lower():
+                shim_source = path
+            elif "grub" in path.lower():
+                grub_source = path
+    
+    # 复制文件
+    try:
+        if grub_source:
+            grub_target = os.path.join(target_dir, efi_grub_file)
+            shutil.copy2(grub_source, grub_target)
+            log_success(f"✓ 复制 GRUB: {grub_source} -> {grub_target}")
+        
+        if shim_source:
+            # 如果使用 shim，复制 shim 并重命名为 grubx64.efi
+            # 或者保留 shim 文件名并在 NVRAM 中注册
+            shim_target = os.path.join(target_dir, "shimx64.efi")
+            shutil.copy2(shim_source, shim_target)
+            log_success(f"✓ 复制 Shim: {shim_source} -> {shim_target}")
+            
+            # 同时复制为 bootloader 名称，便于启动
+            if efi_grub_file != "shimx64.efi":
+                shutil.copy2(shim_source, os.path.join(target_dir, efi_grub_file))
+        
+        # 如果没有找到任何文件，尝试从 grub 模块生成
+        if not grub_source and not shim_source:
+            log_warning("未找到现有 EFI 文件，尝试使用 grub-mkimage 生成...")
+            
+            # 构建 grub.efi 路径
+            grub_efi_output = os.path.join(target_dir, efi_grub_file)
+            
+            # 获取模块列表（必需模块）
+            modules = "part_gpt part_msdos fat ext2 xfs btrfs normal boot linux configfile search search_fs_uuid search_fs_file"
+            
+            # 尝试使用 grub-mkimage 生成 EFI 文件
+            chroot_cmd_prefix = ["sudo", "chroot", mount_point]
+            mkimage_cmd = chroot_cmd_prefix + [
+                "grub2-mkimage",
+                "-o", grub_efi_output,
+                "-O", efi_target,
+                "-p", "/boot/grub2",
+            ] + modules.split()
+            
+            success, _, stderr = run_command(
+                mkimage_cmd,
+                "使用 grub-mkimage 生成 EFI 文件",
+                timeout=60
+            )
+            
+            if success and os.path.exists(grub_efi_output):
+                log_success(f"✓ 成功生成 EFI 文件: {grub_efi_output}")
+            else:
+                log_error(f"生成 EFI 文件失败: {stderr}")
+                return False
+        
+        return True
+        
+    except Exception as e:
+        log_error(f"手动安装 EFI 文件失败: {e}")
+        return False
+
+
 def install_efi_fallback(mount_point: str, efi_target: str, efi_grub_file: str, 
                          efi_boot_file: str, bootloader_id: str = "GRUB") -> bool:
     """
@@ -1920,6 +2030,16 @@ def chroot_and_repair_grub(mount_point: str, target_disk: str,
                     else:
                         install_errors.append(f"no-nvram 模式: {stderr}")
         
+        # 如果所有 grub2-install 方法都失败，尝试手动复制 EFI 文件（针对 Secure Boot 问题）
+        if not grub_install_success and "Secure Boot" in str(install_errors):
+            log_info("grub2-install 不支持 Secure Boot，尝试手动安装 EFI 文件...")
+            success = _manual_install_efi_files(mount_point, efi_target, efi_grub_file, efi_boot_file, bootloader_id)
+            if success:
+                grub_install_success = True
+                log_success("✓ 手动 EFI 文件安装成功")
+            else:
+                log_error("手动 EFI 文件安装失败")
+        
         # 安装 EFI fallback（如果启用）
         if grub_install_success and use_fallback:
             log_info("安装 EFI fallback 文件...")