Fix failure to boot on systems without a TPM

This commit fixes 2 issues with the TPM support code:

1) Remove "REQUIRE_TPM ?=" line from the Makefile, further down the Makefile
checks if REQUIRE_TPM is undefined, but the above line sets it to an empty
string, which is not the same as undefined. Without this handle_image fails
after the tpm_log_pe() call even if REQUIRE_TPM=1 once was not set when
building the shim

2) When secure-boot is disabled then shim_verify() would exit with the
status of tpm_log_pe(), which on systems with a TPM is an error. Combined
with the recent change to always install the shim protocols, this causes
grub to refuse to boot any kernel since the verify() call now always fails.
This commit fixes this by explicitly setting status = EFI_SUCCESS when
secure-boot is disabled.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>

2 files changed, 3 insertions, 2 deletions

diff --git a/Makefile b/Makefile
index 9ab19920..6fb616b3 100644
--- a/Makefile
+++ b/Makefile
@@ -33,7 +33,6 @@ DEBUGINFO	?= $(prefix)/lib/debug/
 DEBUGSOURCE	?= $(prefix)/src/debug/
 OSLABEL		?= $(EFIDIR)
 DEFAULT_LOADER	?= \\\\grub$(ARCH_SUFFIX).efi
-REQUIRE_TPM	?=
 
 ARCH		?= $(shell $(CC) -dumpmachine | cut -f1 -d- | sed s,i[3456789]86,ia32,)
 OBJCOPY_GTE224	= $(shell expr `$(OBJCOPY) --version |grep ^"GNU objcopy" | sed 's/^.*\((.*)\|version\) //g' | cut -f1-2 -d.` \>= 2.24)
diff --git a/shim.c b/shim.c
index 34b819a9..6d777d86 100644
--- a/shim.c
+++ b/shim.c
@@ -1829,8 +1829,10 @@ EFI_STATUS shim_verify (void *buffer, UINT32 size)
 		goto done;
 #endif
 
-	if (!secure_mode())
+	if (!secure_mode()) {
+		status = EFI_SUCCESS;
 		goto done;
+	}
 
 	status = verify_buffer(buffer, size, &context, sha256hash, sha1hash);