ukify: Rework multi-profile UKIs

The API introduced in https://github.com/systemd/systemd/pull/34295
is less than ideal:

- It doesn't consider signing at all (ukify can't sign separately yet)
- Measurement is completely broken (all profile sections are marked to
  not be measured)
- It focuses on a very niche use case of extending existing UKIs and makes
  the more common use case of building a UKI with several profiles included
  much harder than needed.

Let's instead rework the API to focus on the primary use case of building
a UKI with multiple profiles added to it immediately. We require the profiles
to be built upfront as separate PE binaries with UKI. There's no need to sign
or measure these, they're solely vehicles for profile sections. This saves us
from having to complicate the command line and config parsing to support defining
multiple profiles.

To add the profiles when building a UKI, we introduce the new --add-profile
switch which takes a path to a PE binary describing a profile. The required
sections are read from each PE binary, measured and added as a profile.

The integration test is disabled until the new API is merged and exposed in
mkosi so that building a UKI with profiles can be left to mkosi and the integration
test will only test the switching between profiles and not the building of UKIs
with profiles.

0 files changed, 0 insertions, 0 deletions