Add section headers

Provide a little more contextual information when people are in shim
menus.
Add support for disabling signature verification

Provide a mechanism for a physically present end user to disable signature
verification. This is handled by the OS passing down a variable that
contains a UINT32 and a SHA256 hash. If this variable is present, MokManager
prompts the user to choose whether to enable or disable signature validation
(depending on the value of the UINT32). They are then asked to type the
passphrase that matches the hash. This then saves a boot services variable
which is checked by shim, and if set will skip verification of signatures.
Skip signature checking if insecure

If we're configured to run untrusted code, print a message and skip the
validation checks.
Pause on callback failures

If a callback returns any kind of failure, wait for a keypress in order to
give the user an opportunity to read any failure messages.
Add MOK password auth

Add support for setting an MOK password. The OS passes down a password hash.
MokManager then presents an option for setting a password. Selecting it
prompts the user for the same password again. If they match, the hash is
enrolled into a boot services variable and MokManager will prompt for the
password whenever it's started.
Clean up timeout counter handling

Reduce menu redrawing by only redrawing the invalidated section of the menu
during the timeout countdown.
Don't print SHA1 sum when calculating file fingerprints

There's no point in printing the SHA1 of a SHA256...
Clear screen before prompting

We were drawing prompts on top of existing text, which was less than
ideal.
Support a vendor-specific DBX list.

In some rare corner cases, it's useful to add a blacklist of things that
were allowed by a copy of shim that was never signed by the UEFI signing
service.  In these cases it's okay for them to go into a local dbx,
rather than taking up precious flash.

Signed-off-by: Peter Jones <pjones@redhat.com>
Fix key database parsing

The pointer to the certificate needs to be incremented by the size of the
entire certificate, not just the certificate data.
Clean up checks for MokManager entry

Add a helper function and tidy up the calls for getting into MokManager
Delete MokList properly

A cut and paste error meant that attempts to delete MokList were instead
appending a zero-length addition.
Update image validation enable/disable

Update this to match the new mokutil behaviour
Fix password hash calculation

This was hardcoded, rather than being based on the actual password length,
resulting in incorrect hashes being generated.
Merge branch 'mok' of github.com:mjg59/shim into mok
Add another missing screen clearing

Another case where we were drawing text over existing text.
Miscellaneous small fixups

Fixes for some small bugs noticed during review
Boot unsigned binaries if we're not in secure mode

read_header would fail if the binary was unsigned, even if we weren't then
going to verify the signature. Move that check to the verify function
instead.
Improve signature validation enable/disable

The logic used in checking the signature validation password was a bit
ugly. Improve that so it behaves rather more as expected.
Clean up password setting

Permit clearing of the password, and avoid a case where choosing not to set
a password would result in an error message on exit. Fix the same problem
with MokSB.