Add TDX version of Oak Containers Orchestrator

This also creates a TDX version of the Oak Containers System Image. This
version still uses the DICE attester for now, but will be switched over
to the TDX attester once it is available.

BUG: 380442628

Change-Id: I3d7ff72e146c78e70ea59dbad830ab1b2988e902

oak_containers/orchestrator_bin_tdx/BUILD

@@ -0,0 +1,34 @@
+#
+# Copyright 2025 The Project Oak Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+load("@rules_rust//rust:defs.bzl", "rust_binary")
+
+package(
+    default_visibility = ["//:default_visibility"],
+    licenses = ["notice"],
+)
+
+rust_binary(
+    name = "bin/oak_containers_orchestrator",
+    srcs = ["src/main.rs"],
+    deps = [
+        "//oak_attestation",
+        "//oak_containers/orchestrator",
+        "@oak_crates_index//:anyhow",
+        "@oak_crates_index//:tikv-jemallocator",
+        "@oak_crates_index//:tokio",
+    ],
+)

oak_containers/orchestrator_bin_tdx/README.md

@@ -0,0 +1,10 @@
+<!-- Oak Logo Start -->
+<!-- An HTML element is intentionally used since GitHub recommends this approach to handle different images in dark/light modes. Ref: https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#specifying-the-theme-an-image-is-shown-to -->
+<!-- markdownlint-disable-next-line MD033 -->
+<h1><picture><source media="(prefers-color-scheme: dark)" srcset="/docs/oak-logo/svgs/oak-containers-negative-colour.svg?sanitize=true"><source media="(prefers-color-scheme: light)" srcset="/docs/oak-logo/svgs/oak-containers.svg?sanitize=true"><img alt="Project Oak Containers Logo" src="/docs/oak-logo/svgs/oak-containers.svg?sanitize=true"></picture></h1>
+<!-- Oak Logo End -->
+
+# Orchestrator with RTMR Attestation
+
+A version of the Oak Containers Orchestrator that uses the RTMR Attestation
+mechanism and is compatible with Intel TDX.

oak_containers/orchestrator_bin_tdx/src/main.rs

@@ -0,0 +1,22 @@
+//
+// Copyright 2025 The Project Oak Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#[global_allocator]
+static ALLOCATOR: tikv_jemallocator::Jemalloc = tikv_jemallocator::Jemalloc;
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    oak_containers_orchestrator::main::<oak_attestation::dice::DiceAttester>().await
+}

oak_containers/stage1_bin_tdx/README.md

@@ -4,7 +4,7 @@
 <h1><picture><source media="(prefers-color-scheme: dark)" srcset="/docs/oak-logo/svgs/oak-containers-negative-colour.svg?sanitize=true"><source media="(prefers-color-scheme: light)" srcset="/docs/oak-logo/svgs/oak-containers.svg?sanitize=true"><img alt="Project Oak Containers Logo" src="/docs/oak-logo/svgs/oak-containers.svg?sanitize=true"></picture></h1>
 <!-- Oak Logo End -->
 
-# Stage 1 with DICE Attestation
+# Stage 1 with RTMR Attestation
 
 A version of the Oak Containers Stage 1 that will use the RTMR Attestation
 mechanism and is compatible with Intel TDX

oak_containers/system_image/BUILD

@@ -34,6 +34,17 @@ pkg_files(
     strip_prefix = "/oak_containers/orchestrator_bin/bin",
 )
 
+pkg_files(
+    name = "orchestrator_tdx_files",
+    srcs = [
+        "//oak_containers/orchestrator_bin_tdx:bin/oak_containers_orchestrator",
+    ],
+    attributes = pkg_attributes(
+        mode = "0744",
+    ),
+    strip_prefix = "/oak_containers/orchestrator_bin_tdx/bin",
+)
+
 pkg_files(
     name = "syslogd_files",
     srcs = [
@@ -66,6 +77,16 @@ pkg_tar(
     package_dir = "/usr/bin",
 )
 
+pkg_tar(
+    name = "rust_bins_tdx_tar",
+    srcs = [
+        ":agent_files",
+        ":orchestrator_tdx_files",
+        ":syslogd_files",
+    ],
+    package_dir = "/usr/bin",
+)
+
 pkg_tar(
     name = "oak_containers_system_image_tar",
     deps = [
@@ -82,6 +103,22 @@ xz_compress(
     target = ":oak_containers_system_image_tar",
 )
 
+pkg_tar(
+    name = "oak_containers_tdx_system_image_tar",
+    deps = [
+        ":rust_bins_tdx_tar",
+        "@oak_containers_system_image_base//file:base-image.tar.xz",
+    ],
+)
+
+xz_compress(
+    name = "oak_containers_tdx_system_image",
+    out = "oak_containers_tdx_system_image.tar.xz",
+    # This rule will fail unless you run: just oak_containers_sytem_image_binaries
+    # This restriction will be removed once everything is bazelified.
+    target = ":oak_containers_tdx_system_image_tar",
+)
+
 pkg_tar(
     name = "oak_containers_nvidia_system_image_tar",
     deps = [