podvm-mkosi: Add option in mkosi build for AA_KBC

[mkulke]

Without providing this option the image will not contain an attestation-agent with cc_kbc support.

[katexochen]

489.2 error: failed to run custom build command for `tdx-attest-sys v0.1.0 (https://github.com/intel/SGXDataCenterAttestationPrimitives?tag=DCAP_1.16#71557c7d)`
489.2
489.2 Caused by:
489.2   process didn't exit successfully: `/guest-components/target/release/build/tdx-attest-sys-5af8ca8a89d377d8/build-script-build` (exit status: 101)
489.2   --- stdout
489.2   cargo:rustc-link-lib=tdx_attest
489.2   cargo:rerun-if-changed=bindings.h
489.2
489.2   --- stderr
489.2   bindings.h:32:10: fatal error: 'tdx_attest.h' file not found

I think we need to install additional packages in the builder for this to work?

[mkulke]

489.2 error: failed to run custom build command for `tdx-attest-sys v0.1.0 (https://github.com/intel/SGXDataCenterAttestationPrimitives?tag=DCAP_1.16#71557c7d)`
489.2
489.2 Caused by:
489.2   process didn't exit successfully: `/guest-components/target/release/build/tdx-attest-sys-5af8ca8a89d377d8/build-script-build` (exit status: 101)
489.2   --- stdout
489.2   cargo:rustc-link-lib=tdx_attest
489.2   cargo:rerun-if-changed=bindings.h
489.2
489.2   --- stderr
489.2   bindings.h:32:10: fatal error: 'tdx_attest.h' file not found

I think we need to install additional packages in the builder for this to work?

hmm, we shouldn't need this if we pick the attesters individually. let me add a gh action workflow to check

[katexochen]

hmm, we shouldn't need this if we pick the attesters individually. let me add a gh action workflow to check

This is with AA_KBC=cc_kbc_all_attesters

[mkulke]

hmm, we shouldn't need this if we pick the attesters individually. let me add a gh action workflow to check

This is with AA_KBC=cc_kbc_all_attesters

Ah, yes. this won't work atm. Do we have a podvm configuration that would work with a TDX attester? (the upcoming Azure impl will most likely not depend on the tdx attester libs) If not, we can maybe avoid dealing with that dependency for the time being and address it once the use case comes up.

I just checked building w/ cc_kbc_az_snp_vtpm and that seems to work.

[bpradipt]

/lgtm