shim: improve debugging output

Distinguish debugging and error messages with macros, which makes
it easy to change their implementation later.

Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
fix verify_mok()

() Fix the return value semantics. If the MokList doesn't
exist, we are OK. If the MokList was compromised but we
were able to erase it, that is OK too. Only if the list
can't be nuked do we return an error.

() Fix use of potentially uninitialized attribute variable

() Actually use the return value when called from verify_buffer.

Change-Id: If16df21d79c52a1726928df96d133390cde4cb7e
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
add VerifyBlob to shim_lock protocol

Implement a generic binary verification function that doesn't assume
PE/COFF format. The binary data and the signature are passed
separately. A SHA256 hash is taken and the digest is verified using
the built-in shim and the vendor key.

shim has some functions to check black/white lists for
Authenticode-signed PE/COFF images. Here we introduce
slightly different functions for doing the same checks
for generic blobs. We are feeling paranoid so only
SHA256 hashes are checked.

OpenSSL errors are only printed if the entire verification
fails, as some errors may be expected when checking the
databases.

Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>