Automatically extract and upload trust root from TUF repo

[david-crespo]

Good customer feedback: the CLI could have a command that does steps 1-4 for you.

[david-crespo]

We discussed this in chat: https://matrix.to/#/!azzYLbPmVdoHrGDqri:oxide.computer/$178059070429790quRFT:unix.house?via=oxide.computer&via=unix.house&via=matrix.org

We plan to sign the TUF repos in the future, which means we would want a system that automatically trusts the repo to stop doing that and verify instead once that becomes possible. That might make more sense on the server than in the CLI.

[askfongjojo]

The update team originally has steps 2 and 3 as one API call:

unzip -p "$TUF_REPO_FILE" repo/metadata/1.root.json | oxide api -X POST /v1/system/update/trust-roots --input -

The current documented steps avoid the use of oxide api and the need to create the json-body input file but inadvertently made the procedures longer. Perhaps we can improve the ergonomics of the trust root update CLI?

[ahl]

The update team originally has steps 2 and 3 as one API call:

unzip -p "$TUF_REPO_FILE" repo/metadata/1.root.json | oxide api -X POST /v1/system/update/trust-roots --input -

The current documented steps avoid the use of oxide api and the need to create the json-body input file but inadvertently made the procedures longer. Perhaps we can improve the ergonomics of the trust root update CLI?

Would this work?

unzip -p "$TUF_REPO_FILE" repo/metadata/1.root.json | oxide system update trust-root create --json-body /dev/stdin

or

oxide system update trust-root create --json-body <(unzip -p "$TUF_REPO_FILE" repo/metadata/1.root.json)

[askfongjojo]

The System Update guide in the v20 doc set has been updated to use a single step to upload the trust root:
oxide system update trust-root create --json-body <(unzip -p "$TUF_REPO_FILE" repo/metadata/1.root.json)