uefisign: Separate file verdicts from failures

[quentin.thebault_defenso.fr]

Summary

uefisign: Separate file verdicts from failures

uefisign(8) exited 1 for everything, so a caller (e.g. a signing script
or a CI check) could not tell an unsigned or malformed file from a
program failure.  Split the status into four values:

    0  success (file was signed or with -V, contains a signature)
    1  program or library failure
    2  no signature found (with -V)
    3  invalid file format (input is not a conforming PE image)

PR:             298383
Sponsored by:   Defenso

[emaste]

sysexits(3) states

This interface has been deprecated and is retained only for compatibility. Its use is discouraged.

I agree it's useful to be able to distinguish the different failure cases though.

[emaste]

I hate to request a bunch of rework on this, but IMO a lot of this is churn that isn't really needed.

grep(1) has a similar need for more than just a binary success/failure exit and is succinct:

The grep utility exits with one of the following values:

0     One or more lines were selected.
1     No lines were selected.
>1    An error occurred.

Can we similarly have three or four exit values to use here?

[imp]

The sysexit parts of this are too churny. Can't we exit 2 or 3 or whatever to indicate signing issues instead?

[quentin.thebault_defenso.fr]

Simplify return codes to 4 values:

0  success (file was signed or with -V, contains a signature)
1  program or library failure
2  no signature found (with -V)
3  invalid file format (input is not a conforming PE image)