Add option to add Microsoft/vendor certs to the signature database about sbctl HOT 4 CLOSED

There are a few solutions I want to implement:

• Embed Microsoft CA we can append
• Scan for the default vendor certificates in db and append.
• Parse the TPM2 eventlog for checksums of OpROM binaries we should append.

This has mostly been improving the APIs for dealing with signature lists and databases in go-uefi.

from sbctl.

This. Right now my options are

• disable secure boot completely
• avoiding sbctl and going the complicated route with one other app
• using sbctl but are in need to have CSM active, because the graphics firmware is Microsoft signed and will of course fail with only my own keys in place.

from sbctl.

I have implemented support in the master branch for enrolling Microsoft signing certs. This needs to be explicitly done, but it's a nice start. This also sports a reset option so you can reenroll keys with secure boot enabled.

This is partially based on work by @zaolin :)<3

λ sbctl master» sudo ./sbctl enroll-keys
‼ File is immutable: /sys/firmware/efi/efivars/KEK-8be4df61-93ca-11d2-aa0d-00e098032b8c
‼ File is immutable: /sys/firmware/efi/efivars/db-d719b2cb-3d3a-4596-a3bc-dad00e67656f
You need to chattr -i files in efivarfs
λ sbctl master» sudo chattr -i /sys/firmware/efi/efivars/{db,KEK}*

λ sbctl master» sudo ./sbctl enroll-keys
Enrolling keys to EFI variables...✓
Enrolled keys to the EFI variables!

λ sbctl master» sudo ./sbctl status
Installed:	✓ sbctl is installed
Owner GUID:	a7b893cc-949d-408c-b5cc-6e7d0370fdb6
Setup Mode:	✓ Disabled
Secure Boot:	✗ Disabled

λ sbctl master» sudo ./sbctl reset
✓ Removed Platform Key!
Use `sbctl enroll-keys` to enroll the Platform Key again.

λ sbctl master» sudo ./sbctl enroll-keys --microsoft
Enrolling keys to EFI variables...
With vendor keys from Microsoft...✓
Enrolled keys to the EFI variables!

λ sbctl master» sudo ./sbctl status
Installed:	✓ sbctl is installed
Owner GUID:	a7b893cc-949d-408c-b5cc-6e7d0370fdb6
Setup Mode:	✓ Disabled
Secure Boot:	✗ Disabled
Vendor Keys:	 microsoft

from sbctl.

Implemented with 4713d98

from sbctl.