Comment 3 for bug 1525393

In build/util/efi-image:

                        if wget -q "$file" -O "$workdir/grub$efi_name.efi" 2>/dev/null

Will lead to a 0-length grubx64.efi and skipping signed shim if wget fails.

This should be fixed to download to a temp location and only copy in place if it succeeds and, probably, also be a hard failure if we can determine that we're expecting this to be a signed build.