Add experimental support for AWS Nitro

[ameba23]

WIP

This adds experimental AWS Nitro support to attested-tls.

Pairs with flashbots/attested-tls-proxy#162 which adds vsocket support to attestation-provider-server allowing us to check that these nitro attestation documents will verify.

There is also a flake for reproducibly building a docker container with attestation-provider-server: https://github.com/flashbots/attested-tls-proxy/blob/peg/nitro-test/flake.nix

Heres how to deploy using that flake (from the attested-tls-proxy repo on the paired branch):

1. Build the OCI image from the flake in attested-tls-proxy:

nix build ".#attestation-provider-server-image"

This produces a Docker image tarball at result in the repo root.

2. Scp that image to the nitro host, and load into Docker:

docker load < result

3. Build the EIF from the loaded image:

nitro-cli build-enclave \
  --docker-uri attestation-provider-server:latest \
  --output-file attestation-provider-server.eif

4. Run the enclave:

nitro-cli run-enclave \
  --eif-path attestation-provider-server.eif \
  --cpu-count 2 \
  --memory 512 \
  --enclave-cid 10 \
  --enclave-name attestation-provider-server

The flake bakes in the enclave startup command, so the container starts the server in vsock mode and with --server-attestation-type aws-nitro by default. That means you do not need to pass extra runtime flags when building the EIF.

The server side then listens on vsock port 8000, and the parent host can connect with the client command using:

attestation-provider-server client \
  --server-transport vsock \
  --server-cid 10 \
  --log-dcap-quote \
  --server-vsock-port 8000

Which should verify the attestation-document, and dump it to a local file. But not actually check measurements.

This shows that nitro attestations can be verified but does not yet demonstrate an attested-tls workflow with nitro.

[ameba23]

flashbots/attested-tls-proxy#163 adds full vsocket support to attested-tls-proxy allowing us to test a full attested-tls workflow on nitro. More details coming soon