bootctl: Add --secure-boot-auto-enroll

When specified, bootctl install will also set up secure boot
auto-enrollment. For now, We sign all variables using the same
certificate and key pair.

src/basic/efivars.h

@@ -23,9 +23,10 @@
 #define EFI_VENDOR_SYSTEMD      SD_ID128_MAKE(8c,f2,64,4b,4b,0b,42,8f,93,87,6d,87,60,50,dc,67)
 #define EFI_VENDOR_SYSTEMD_STR  SD_ID128_MAKE_UUID_STR(8c,f2,64,4b,4b,0b,42,8f,93,87,6d,87,60,50,dc,67)
 
-#define EFI_VARIABLE_NON_VOLATILE       UINT32_C(0x00000001)
-#define EFI_VARIABLE_BOOTSERVICE_ACCESS UINT32_C(0x00000002)
-#define EFI_VARIABLE_RUNTIME_ACCESS     UINT32_C(0x00000004)
+#define EFI_VARIABLE_NON_VOLATILE                          UINT32_C(0x00000001)
+#define EFI_VARIABLE_BOOTSERVICE_ACCESS                    UINT32_C(0x00000002)
+#define EFI_VARIABLE_RUNTIME_ACCESS                        UINT32_C(0x00000004)
+#define EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS UINT32_C(0x00000020)
 
 /* Note that the <lowercaseuuid>-<varname> naming scheme is an efivarfs convention, i.e. part of the Linux
  * API file system implementation for EFI. EFI itself processes UIDS in binary form.

src/basic/utf8.c

@@ -504,6 +504,10 @@ size_t char16_strlen(const char16_t *s) {
         return n;
 }
 
+size_t char16_strsize(const char16_t *s) {
+        return s ? (char16_strlen(s) + 1) * sizeof(*s) : 0;
+}
+
 /* expected size used to encode one unicode char */
 static int utf8_unichar_to_encoded_len(char32_t unichar) {
 

src/basic/utf8.h

@@ -42,6 +42,7 @@ char* utf16_to_utf8(const char16_t *s, size_t length /* bytes! */);
 char16_t *utf8_to_utf16(const char *s, size_t length);
 
 size_t char16_strlen(const char16_t *s); /* returns the number of 16-bit words in the string (not bytes!) */
+size_t char16_strsize(const char16_t *s);
 
 int utf8_encoded_valid_unichar(const char *str, size_t length);
 int utf8_encoded_to_unichar(const char *str, char32_t *ret_unichar);