Add helper binary for bulk certificate processing.

[busykai]

Instead of launching 'openssl x509' for each file, use small binary to
process files in bulk. This optimization improves performance more than
7 times (measured on store generation). Performance of 'clrtrust
generate' is important for first-time booting.

Before:

$ time sudo clrtrust generate 
Trust store generated at /var/cache/ca-certs

real	0m2.736s
user	0m2.368s
sys	0m0.390s

After:

$ time sudo ./clrtrust generate 
Trust store generated at /var/cache/ca-certs

real	0m0.352s
user	0m0.280s
sys	0m0.086s

[busykai]

@icarus-sparry would you fancy reviewing this change?

[busykai]

Needs copyright.

[icarus-sparry]

Some optional changes.

[icarus-sparry]

Unless you want to explicitly want to return just 0/1, you could loose lines 196-199, as the function by default will return the value of the last command (in this case the subshell) by default.

[icarus-sparry]

Is there any sanity checking somewhere that filenames do not include embedded newlines and tabs?

If not, then can I suggest using

find "$dir" -maxdepth 1 -type f -exec "${CLR_HELPER_CMD}" -f {} +

and making the helper program loop over its arguments? Another popular approach is to add a -z flag to the helper to accept NUL terminated filenames rather than newline terminated ones.

[busykai]

Since there are few other places already which would fail anyways, I documented this as an issue #16. I will address it at some point, but not as part of this change.

[icarus-sparry]

This is fine. If I was writing it I would do it more like

for d in ${CLR_LIBEXEC_DIR+"$CLR_LIB_EXEC_DIR"} "$(dirname "$0")" "${LIBEXEC_DIR}"
do if [ -x "$d/${CLR_HELPER_NAME}" ] ; then
    CLR_HELPER_CMD="$d/${CLR_HELPER_NAME}"
    break
    fi
 done

[busykai]

I started with it, just like the lock file location few lines below, but after few modifications got confused. This is way cleaner, thanks!

[icarus-sparry]

Perhaps a global return code to indicate if there were any errors (e.g. missing files) rather than success except for "somehow I got to line 136" and "missing or conflicting -s -f switches"?

[busykai]

Will do. Actually, the errors are not handled correctly in the caller script either, so this must be taken care of.

[icarus-sparry]

I suggest below allowing the filenames to be specified on the command line.

If you don't then perhaps a check that nothing extra has been passed on the command line?

Maybe a '-z' mode to read the names NUL deliminated rather than newline deliminated?

[busykai]

thank you for the review, @icarus-sparry! it's very helpful.