hw/uefi: fix ContentInfo detection in wrap_pkcs7()

Fix wrap_pkcs7()'s detection for an already present PKCS ContentInfo
envelope: It previously compared byte 15 with 0x0a (ASN.1
ENUMERATED) instead of 0xa0 (the [0] EXPLICIT context tag of
ContentInfo.content). See the original edk2 function [1] where this was
taken from.

Due to that typo, an already wrapped signature got wrapped a second
time, and gnutls_pkcs7_import() rejected it. This breaks Secure Boot key
enrollment with .auth files carrying the envelope, as created by
systemd's "bootctl --secure-boot-auto-enroll".

[1] https://github.com/tianocore/edk2/blob/8f8372439d8ec5f565dbda1548c18deb068e0080/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c#L68

Fixes: 3e33af2cb3 ("hw/uefi: add var-service-pkcs7.c")
Cc: qemu-stable@nongnu.org
Signed-off-by: Martin Pitt <martin@amutable.com>
Message-ID: <atUllV8bSaHylfKv@piware.de>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

hw/uefi/var-service-pkcs7.c

@@ -80,7 +80,7 @@ static void wrap_pkcs7(gnutls_datum_t *pkcs7)
         pkcs7->data[4] == 0x06 &&
         pkcs7->data[5] == 0x09 &&
         memcmp(pkcs7->data + 6, signed_data_oid, sizeof(signed_data_oid)) == 0 &&
-        pkcs7->data[15] == 0x0a &&
+        pkcs7->data[15] == 0xa0 &&
         pkcs7->data[16] == 0x82) {
         return;
     }