feat: compat code for non x86_64-linux

- do not build packages, which require `x86_64-linux`
- use Phala `dcap-qvl` crate for remote attestation, if possible
- nix: exclude `nixsgx` on non `x86_64-linux` platforms

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>

packages/container-vault-unseal/default.nix

@@ -1,30 +1,43 @@
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) 2024 Matter Labs
 { dockerTools
+, lib
+, stdenv
 , buildEnv
 , teepot
 , openssl
 , curl
 , nixsgx
 }:
-dockerTools.buildLayeredImage {
-  name = "vault-unseal";
+if (stdenv.hostPlatform.isDarwin) then {
+  # FIXME: dockerTools.buildLayeredImage seems to be broken on Darwin
+} else
+  dockerTools.buildLayeredImage {
+    name = "vault-unseal";
 
-  config.Entrypoint = [ "${teepot.teepot.vault_unseal}/bin/vault-unseal" ];
+    config.Entrypoint = [ "${teepot.teepot.vault_unseal}/bin/vault-unseal" ];
 
-  contents = buildEnv {
-    name = "image-root";
-    paths = with dockerTools; with nixsgx;[
-      openssl.out
-      curl.out
-      sgx-dcap.quote_verify
-      sgx-dcap.default_qpl
-      usrBinEnv
-      binSh
-      caCertificates
-      fakeNss
-      teepot.teepot.vault_unseal
-    ];
-    pathsToLink = [ "/bin" "/lib" "/etc" ];
-  };
-}
+    contents = buildEnv {
+      name = "image-root";
+      paths =
+        with dockerTools;
+        with nixsgx;
+        [
+          openssl.out
+          curl.out
+          usrBinEnv
+          binSh
+          caCertificates
+          fakeNss
+          teepot.teepot.vault_unseal
+        ] ++ lib.optionals (stdenv.hostPlatform.system == "x86_64-linux") [
+          sgx-dcap.quote_verify
+          sgx-dcap.default_qpl
+        ];
+      pathsToLink = [
+        "/bin"
+        "/lib"
+        "/etc"
+      ];
+    };
+  }