Roadmap for enclave-cc to support CoCo Key Broker System

[Xynnn007]

Background

Now enclave-cc uses eaa-kbc & verdictd as underlying attestation & confidential resource broker componant. At the same time, CoCo key broker system is under development. CoCo Key Broker System includes

• CC-KBC in Attestation-Agent: To collect hardware & software evidence and do remote attestation and make resource request from AS
• Attestation-Service: To verify the evidence sent by CC-KBC
• CC-KBS: To distribute confidential resources

Currently, we also use eaa-kbc & verdictd, where

• eaa-kbc: same functionality as cc-kbc
• verdictd: same functionality as AS + CC-KBS

What we want

To support CoCo key broker system in enclave-cc, we need the following things. Let's make a simple roadmap for this

• Implement Occlum attester in Attestation-agent's cc-kbc
  SGX Occlum support in CC-KBC guest-components#213
• Implement SGX verifier in Attestation-Service (As Occlum & Gramine share sgx qvl)
  SGX Verifier Driver trustee#202
• Add build features for both attestation-agent/eaa-kbc and attestation-agent/cc-kbc for agent-enclave
• Related tests/ci using coco-key broker system

[mythi]

@Xynnn007 I think we can close this: it's currently implemented for the functionality we have (i.e., we don't need to track Gramine support here)