tuftool: feature to dump stats

[webern]

As mentioned by @bcressey

We should have a way to track these sizes over time so we'll know if we're getting close to any of these limits. Maybe a tuftool feature to dump stats.

That is, we should have a tuftool feature to dump the size stats as they relate to REPOSITORY_LIMITS. That way when we use tuftool we can make sure Bottlerocket repos are not approaching the size limits.

[iliana]

tough/tough/src/lib.rs

Lines 124 to 128 in 7e86574

	/// The [`Default`] implementation sets the following values:
	/// * `max_root_size`: 1 MiB
	/// * `max_targets_size`: 10 MiB
	/// * `max_timestamp_size`: 1 MiB
	/// * `max_root_updates`: 1024

max_targets_size is the only concern here, right? timestamp.json is essentially a pointer to the current snapshot.json version, and root.json only contains the keys. These files measured in dozens of kilobytes would be absurdly large; they should never reach 1 MiB. 1024 root updates seems equally ridiculous.

max_targets_size is only used when the size of targets.json is not specified in snapshot.json (this field is optional per the spec), but repositories generated by tough list this size.

tough/tough/src/lib.rs

Lines 791 to 794 in 7e86574

	let (max_targets_size, specifier) = match targets_meta.length {
	Some(length) => (length, "snapshot.json"),
	None => (max_targets_size, "max_targets_size parameter"),
	};

tough/tough/src/editor/mod.rs

Lines 348 to 356 in 7e86574

	SnapshotMeta {
	hashes: Some(Hashes {
	sha256: role.sha256.to_vec().into(),
	_extra: HashMap::new(),
	}),
	length: Some(role.length),
	version: role.signed.signed.version(),
	_extra: HashMap::new(),
	}

[webern]

I transferred the ask without thinking about it too much. It may not be necessary if it's as simple as looking at the size of targets.json