Support portable measurement policies on bare metal

[ameba23]

Following Easy-TEE/attest#22 we want to allow portable measurement policies on bare metal.

Previously the attestation crate had a guard to disallow them as it was not fully implemented.

This PR updates the attest crates and removes that guard. It also makes a change to the measurement policy record structure, as it must now explicitly specify an attestation type to remove ambiguity, as we can no longer assume portable measurements = GcpTdx.

It pins known trusted OVMF firmware, and on bare metal this must be used in order for attestations to be verified.

[alexhulbert]

You should be good to add the RTMR0/MRTD and update the pinned attest commit to 12f1e29f6ea63ecc2f80f39c2c1f1172720bcf24. That will make RTMR0 and MRTD work.

I'll send a link to the latest tdx OVMF firmware that's on Ubuntu's repo. That seems like a good first firmware to pin. Going forward, we probably want to have a list of allowed MRTDs.

[ameba23]

You should be good to add the RTMR0/MRTD and update the pinned attest commit to 12f1e29f6ea63ecc2f80f39c2c1f1172720bcf24. That will make RTMR0 and MRTD work.

I'll send a link to the latest tdx OVMF firmware that's on Ubuntu's repo. That seems like a good first firmware to pin. Going forward, we probably want to have a list of allowed MRTDs.

@alexhulbert thats wonderful. ⭐

Do you think we want to pin specific versions of trusted firmware, or have some remote resource that lets us look them up like google does?

Pinning ones is nice because it doesn't need any extra infra or network calls. But it does mean we cant support newer versions without re-releasing.

I've gone for pinning for now, using https://archive.ubuntu.com/ubuntu/pool/main/e/edk2/ovmf-inteltdx_2025.02-8ubuntu3.2_all.deb and extracting the .fd file from the debian package. I don't know if this matches the version that @bakhtin is using - but its a start and we can add more.

Edit: I added an extra firmware blob from Fedora, which looking at the devops repo, i think is the one used by Buildernet on Openmetal.

To avoid embedding the full firmware blob in the binary, DcapFirmware is extracted at build time. See 46073f9

One thing to note:

The newer Ubuntu 26.04 package contains only OVMF.inteltdx.ms.fd

That image has Secure Boot enabled and Microsoft PK/KEK/db/dbx certificates pre-enrolled. If i understand right, this wont play nice with attest as currently implemented. Probably i should write this up in an issue in attest rather than discuss it here.