generate sbkeys scripts: change docker mounts

[webern]

Issue number:

Related to #2669 and Twoliter #14

Description of changes:

Because the new Twoliter build tool will execute docker run commands
from within a container that has the host docker socket mounted, it is
necessary for "inner" and "outer" bind mount paths to match.

Additionally, it was found that generate-aws-sbkeys needed
--network=host on at least some systems.

Testing done:

cargo make build-sbkeys works.

cargo make build-sbkeys
$ tree sbkeys
sbkeys
├── generate-aws-sbkeys
├── generate-local-sbkeys
├── local
│   ├── code-sign.crt
│   ├── code-sign.key
│   ├── config-sign.key
│   ├── db.crt
│   ├── db.key
│   ├── efi-vars.aws
│   ├── efi-vars.json
│   ├── KEK.crt
│   ├── KEK.key
│   ├── PK.crt
│   ├── PK.key
│   ├── shim-sign.crt
│   ├── shim-sign.key
│   ├── vendor.crt
│   └── vendor.key
└── README.md

I ran:

$ ./generate-aws-sbkeys \
  --sdk-image public.ecr.aws/bottlerocket/bottlerocket-sdk-x86_64:v0.33.0 \
  --aws-region us-west-2 \
  --pk-ca arn:aws:acm-pca:us-west-2:123456789012:certificate-authority/aae216e7-e06c-4a3e-b47d-a6954a8bf9bc \
  --kek-ca arn:aws:acm-pca:us-west-2:123456789012:certificate-authority/727a99c4-d5e3-4022-8814-14013150cdd8 \
  --db-ca arn:aws:acm-pca:us-west-2:123456789012:certificate-authority/55e6854a-d705-484a-b645-9b99e510da9b \
  --vendor-ca arn:aws:acm-pca:us-west-2:123456789012:certificate-authority/ae007fb7-d9d2-4205-9811-a809387c2698 \
  --shim-sign-key arn:aws:kms:us-west-2:123456789012:key/mrk-304fc2402af049908b9d370363cf2cb3 \
  --code-sign-key arn:aws:kms:us-west-2:123456789012:key/mrk-9da6264259be415d9e75a8ed423455b7 \
  --config-sign-key arn:aws:kms:us-west-2:123456789012:key/mrk-5e12880d47854da6baa0a7eec1f8eb94 \
  --output-dir ${PWD}/aws-sb-test-3

It worked and I got:

$ tree sbkeys
sbkeys
├── aws-sb-test-3
│   ├── config-sign.key
│   ├── db.crt
│   ├── efi-vars.aws
│   ├── efi-vars.json
│   ├── KEK.crt
│   ├── kms-sign.json
│   ├── PK.crt
│   └── vendor.crt

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[stmcginnis]

Makes sense!

[bcressey]

LGTM. For consistency it might make sense to give sbkeys/generate-aws-sbkeys the same treatment, so the pattern doesn't get copied from there to other scripts.

Does tools/docker-go need the same treatment?