[File] GUID, UUID, endianness, and all the rest

[Christoph Biedl]

The last hours have been a fairly disturbing ride ...

What I can tell for sure: The test suite fails on big endian, powerpc
was the first I tested:

```
TZ=UTC MAGIC=../magic/magic ./test -e ../tests/efi-signature-list-sha256.testfile ../tests/efi-signature-list-sha256.result
test: ERROR: result was (len 4)
data
expected (len 49)
EFI Signature List, SHA256, total size: 76 bytes
```

... which is why I had to disable that test before uploading 5.47 to
Debian.

Of course, things cannot stay that way. Upon closer inspection, the
first cause was the magic line

| magic/Magdir/efi:29:>0  guid    C1C41626-504C-4092-ACA9-41F936934328    EFI Signature List, SHA256

did not match on big endian. Using "leguid" or "beguid" didn't help.

The magiccheck function compares (as hex dump)

 C1C41626504C4092ACA941F936934328 (m->value.guid)
 2616C4C14C509240ACA941F936934328 (p->guid)

... which of course fails.

Lesson learned after a while, the wire format for GUID is weird.

So https://en.wikipedia.org/wiki/Universally_unique_identifier
shed some light on this, section "Byte Ordering":

| Variant 1 UUIDs are sequentially encoded in big-endian. For example,
| 00112233-4455-6677-8899-aabbccddeeff is encoded as the bytes 00 11 22 33
| 44 55 66 77 88 99 aa bb cc dd ee ff.
|
| In contrast, variant 2 UUIDs ("GUIDs"): historically used in Microsoft
| COM/OLE libraries, have a mixed-endian format, with the first three
| fields (corresponding to version 1 timestamp subfields) being
| little-endian, while the final two fields are emitted as big-endian
| arrays of bytes. The example UUID above, if it were a variant 2 UUID,
| would be encoded on the wire as
| 33 22 11 00 55 44 77 66 88 99 aa bb cc dd ee ff.


What are the implications for file/libmagic?

* The current handling of guid is buggy on BE. I don't know where to
  fix, perhaps in mconvert.
* Personally, I'd introduce a "uuid" data type, matching the "variant 1"
  mentioned above. This will end the UUID/GUID confusion, at least for
  submissions to magic rules, the manpage should provide some guidance.
* Also, I fail to see the need for beguid and leguid, introduced
  fairly recently. Perhaps I'm missing something here.

    Christoph