fix(flashtestations): no `root` access for builder

[0x416e746f6e]

presently flashtestations demand that builder runs under root (b/c if in cases of TPM or TDX via device we could still give necessary permissions to a non-root, then in case of configfs-based access that is simply not possible).

however, running such a complex service as op-rbuilder/op-reth is, exposed to the internet, and under a root account, is just plain asking for trouble. we mustn't do that.

instead we should extract TDX quote producer into a separate sidecar service, that would be simple and minimal, that would listen on hardcoded 127.0.0.1 loopback (only port-number should be configurable), and which op-rbuilder would query via http to get the quote.

[ilyaluk]

that would listen on hardcoded 127.0.0.1 loopback

It could also bind to unix socket, that way we'll have more granular control over permissions

[fnerdman]

I wouldn't recommend adding services (that can fail) if it's not necessary. shipping the ./attest golang binary with the suid bit set should solve this problem as well, right?

[0x416e746f6e]

It could also bind to unix socket

@ilyaluk: if builder has a switch like --flashtestations.provider ${SOCKET} then it could be indeed unix or tcp one

[0x416e746f6e]

I wouldn't recommend adding services (that can fail) if it's not necessary. shipping the ./attest golang binary with the suid bit set should solve this problem as well, right?

@fnerdman: argument "service can fail" equally applies to the local suid-ed binary. which means that there's no added value with exec'd binary vs. network call over a socket.

while with the socket option (like --flashtestations.provider ${SOCKET}) it would allow developing op-rbuilder locally (by pointing the switch to some dummy quote producer, very similarly to how it's done today for arm builds).

[fnerdman]

I guess the argument is more like the management overhead of services in general: can fail and therefore needs to be monitored. Again, I believe adding a small service where it's not needed is a good practice that rewards in the long term.

regarding the dummy quote producer, this feature has already been added to op-rbuilder, in the rust quote, you can directly call that http endpoint, by setting a startup arg.