Fix path generation for Dhcpv4 bootloader.

Right now we always look for e.g. "\grubx64.efi", which is completely
wrong.  This makes it look for the path shim was loaded from and modify
that to end in a sanitized version of our default loader name.

Resolves: rhbz#1032583

Signed-off-by: Peter Jones <pjones@redhat.com>
Lengths that might be -1 can't be unsigned, Peter.

Signed-off-by: Peter Jones <pjones@redhat.com>
Support MOK blacklist

The new blacklist, MokListX, stores the keys and hashes that are
banned.
MokManager: show the hash list properly
MokManager: delete the hash properly
MokManager: Match all hashes in the list
MokManager: Write the hash list properly

also return to the previous entry in the list
Copy the MOK blacklist to a RT variable
No newline for console_notify
Verify the EFI images with MOK blacklist

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
Exclude ca.crt while signing EFI images

If ca.crt was added into the certificate database, ca.crt would be the first
certificate in the signature. Because shim couldn't verify ca.crt with the
embedded shim.cer, it failed to load MokManager.efi.signed and
fallback.efi.signed.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>