clientupdate/distsign/roots: add temporary dev root key (#9080)

Adding a root key that signs the current signing key on
pkgs.tailscale.com. This key is here purely for development and should
be replaced before 1.50 release.

Updates #8760

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>

clientupdate/distsign/roots.go

@@ -34,7 +34,7 @@ func parseRoots() ([]ed25519.PublicKey, error) {
 		if !f.Type().IsRegular() {
 			continue
 		}
-		if filepath.Ext(f.Name()) != ".pub" {
+		if filepath.Ext(f.Name()) != ".pem" {
 			continue
 		}
 		raw, err := rootsFS.ReadFile(path.Join("roots", f.Name()))

clientupdate/distsign/roots/distsign-dev-root-pub.pem

@@ -1,3 +1,3 @@
 -----BEGIN ROOT PUBLIC KEY-----
-xFykOJAkOlBoMOXA4UKYtaSGYsOY8r1+0wJzQE5mzUo=
+Muw5GkO5mASsJ7k6kS+svfuanr6XcW9I7fPGtyqOTeI=
 -----END ROOT PUBLIC KEY-----