new dependency?

I found https://blog.jak-linux.org/2023/02/01/ubuntu-key-rotation/ although I still don't see how base-files fits in, but I'll read through it again and maybe I'll figure it out.

https://bugs.launchpad.net/ubuntu/+source/shim/+bug/1996503
https://ubuntu.com/security/CVE-2022-28737
Buffer overflow when loading crafted EFI images

Thanks for the links!

Looking into the version diff from 1.51 to 1.54 I see:

--- shim-signed-1.51/debian/control 2021-08-13 16:00:15.000000000 +0000
+++ shim-signed-1.54/debian/control 2023-01-31 11:57:37.000000000 +0000
...
-Depends: ${misc:Depends}, grub-efi-amd64-signed | grub-efi-arm64-signed, grub2-common (>= 2.04-1ubuntu24), mokutil (>= 0.3.0+1538710437.fb6250f-0ubuntu2), sbsigntool
-Breaks: shim (<< 15.3)
+Depends: ${misc:Depends}, grub-efi-amd64-signed (>= 1.191~) | grub-efi-arm64-signed (>= 1.191~) | base-files (<< 12.3), grub-efi-amd64-signed (>= 1.187.2~) | grub-efi-arm64-signed (>= 1.187.2~), grub2-common (>= 2.04-1ubuntu24), mokutil (>= 0.3.0+1538710437.fb6250f-0ubuntu2), sbsigntool
+Breaks: shim (<< 15.3), fwupd-signed (<< 1.44.1~)

My assumption for this dependency on base-files is that it should prevent installation of that package if certain requirements are not met.
I translate this into:
Either Ubuntu release kinetic and older OR grub-efi-*-signed version 1.191 or higher.

This matches the line in the change log
* debian/control: Depend on new grub versions (1.191 on lunar+, 1.187.2 elsewhere)

Anyway, base-files is an important package on Ubuntu. You should have it installed in any case - if not then your Ubuntu system is somewhat incomplete.

When reading through the links, I realized the backport of the newer grub was the piece I had not realized when I asked the question.

I appreciate all the feedback. Thanks!