Fix check logic for SetupMode variable.

After going back and inspecting this further, the logic for "SetupMode"
being present at all was incorrect.  Also initialize our state earlier
so it's sure to always be set.

Signed-off-by: Peter Jones <pjones@redhat.com>
Bump version to 0.7.

Do not use 0.6; on some machines it misunderstands the SetupMode
variable.

Signed-off-by: Peter Jones <pjones@redhat.com>
fix verify_mok()

() Fix the return value semantics. If the MokList doesn't
exist, we are OK. If the MokList was compromised but we
were able to erase it, that is OK too. Only if the list
can't be nuked do we return an error.

() Fix use of potentially uninitialized attribute variable

() Actually use the return value when called from verify_buffer.

Change-Id: If16df21d79c52a1726928df96d133390cde4cb7e
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
shim.c: Add support for hashing/relocation of 32-bit binaries

Change-Id: Ib93305f7f1691d1b142567507df1058de62dde06
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
netboot.h: fix build error on 32-bit systems

Function prototype/implementation mismatch.

Change-Id: I89aaae1b49d0372d3aed76fc21c194e0ae55f72e
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
properly compile OpenSSL in 32-bit mode

Change-Id: Iff3ee5ae0f0b95b282b99a23e465723b4e9f6104
Signed-off-by: Andrey Petrov <andrey.petrov@intel.com>
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
fallback.c: fix 32-bit compilation

fh->Read expects pointer to 32-bit int, use UINTN

Change-Id: If1a728efd51a9a24dfcd8123e84bf4c0713491fe
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
fix fallback.so build dependency

Exposed during parallel builds

Change-Id: I9867858166dcafd69438f37ee5da14a267ace8f4
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
propagate some path variables

If these are overridden on the command line, pass them along to
the sub-makes.

Change-Id: I531ccb5d2f5e4be8e99d4892cdcfffffc1ad9877
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
allow 32-bit compilation with 64-bit compiler

Also removed unused LIB_PATH from some Makefiles.

Change-Id: I7d28d18f7531b51b6121a2ffb88bcaedec57c467
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
shim: improve error messages

%r when used in Print() will show a string representation of
an EFI_STATUS code.

Change-Id: I6db47f5213454603bd66177aca378ad01e9f0bd4
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
Support MOK blacklist

The new blacklist, MokListX, stores the keys and hashes that are
banned.
MokManager: show the hash list properly
MokManager: delete the hash properly
MokManager: Match all hashes in the list
MokManager: Write the hash list properly

also return to the previous entry in the list
Copy the MOK blacklist to a RT variable
No newline for console_notify
Verify the EFI images with MOK blacklist

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
Exclude ca.crt while signing EFI images

If ca.crt was added into the certificate database, ca.crt would be the first
certificate in the signature. Because shim couldn't verify ca.crt with the
embedded shim.cer, it failed to load MokManager.efi.signed and
fallback.efi.signed.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>