Add signed passive runtime updates and independent crash recovery

hydra/cli.py

@@ -21,6 +21,8 @@ def parser() -> argparse.ArgumentParser:
                      help='Distribution preferences for newly created profiles')
     commands = cli.add_subparsers(dest='command')
     commands.add_parser('menu', help='Open the terminal VM menu')
+    update = commands.add_parser('update', help='Signed runtime updates and rollback')
+    update.add_argument('update_args', nargs=argparse.REMAINDER)
     download = commands.add_parser('download', help='Download and validate a direct ISO URL')
     download.add_argument('url')
     download.add_argument('--sha256')
@@ -92,8 +94,15 @@ def _download_progress():
 def main(argv: list[str] | None = None) -> int:
     cli = parser()
     args = cli.parse_args(argv)
-    runtime = Runtime(args.config, args.state, args.runtime)
     try:
+        if args.command == 'update':
+            checkout = Path(__file__).resolve().parents[1]
+            if checkout == Path('/usr/lib/hydra'):
+                command = ['/usr/bin/hydra-update']
+            else:
+                command = [sys.executable, '-I', str(checkout / 'bin/hydra-update')]
+            return subprocess.run(command + args.update_args, check=False).returncode
+        runtime = Runtime(args.config, args.state, args.runtime)
         if args.command is None and not sys.stdin.isatty():
             cli.print_help()
             return 0