Build remote attestation for UEFI

.devcontainer.json

@@ -4,7 +4,7 @@
 // - https://code.visualstudio.com/docs/remote/devcontainerjson-reference
 {
   // Do not modify manually. This value is automatically updated by ./scripts/docker_build .
-  "image": "sha256:1efea0378c65660a81d23f82740f666da3f57108d8cb63d1217fcf67d908093c",
+  "image": "sha256:ab889141f07b886f02ca3ec664341d7dfada94826c5538842b795b005bc1a417",
   "extensions": [
     "bazelbuild.vscode-bazel",
     "bodil.prettier-toml",

Dockerfile

@@ -52,6 +52,26 @@ RUN apt-get --yes update \
   && git --version \
   && shellcheck --version
 
+# We build our own fork of ring crate from its source. This requires some extra
+# build config that isn't needed for the version published on crates.io, which
+# includes pre-generated assets.
+# Ring requires nasm, and a specific version of clang & llvm
+ARG llvm_version=14
+RUN echo "deb http://apt.llvm.org/buster/ llvm-toolchain-buster-$llvm_version main" >> /etc/apt/sources.list.d/llvm.list \
+  && curl https://apt.llvm.org/llvm-snapshot.gpg.key | apt-key add - \
+  && apt-get update --yes \
+  && apt-get install --no-install-recommends --yes \
+  clang-${llvm_version} \
+  llvm-${llvm_version} \
+  nasm \
+  && rm --recursive --force /var/lib/apt/lists/*
+
+# Ring epects these ENV variables in its build tooling
+ENV llvm_version=$llvm_version
+ENV CC_x86_64_unknown_uefi=clang-$llvm_version
+ENV AR_x86_64_unknown_uefi=llvm-ar-$llvm_version
+ENV NASM_EXECUTABLE=nasm
+
 # Install a version of docker CLI.
 RUN curl --fail --silent --show-error --location https://download.docker.com/linux/debian/gpg | apt-key add -
 RUN echo "deb [arch=amd64] https://download.docker.com/linux/debian buster stable"  > /etc/apt/sources.list.d/backports.list \