cli: allow debug encryption-decrypt command to ignore missing files

[nicktrav]

Is your feature request related to a problem? Please describe.

The debug encryption-decrypt command was added in #89668 to assist with decrypting SSTs in encrypted stores. Currently, this requires the entire store to be in-tact (i.e. manifest file(s), marker files, registry files, and all SSTs).

There are situations where a user may want to decrypt a limited set of SSTs in an environment removed isolated from the running cockroach process to avoid interference (i.e. separate host or directory to minimize risk).

Currently, when attempting to decrypt an SST from a slimmed down store, the decryption command will error out when it can't find an SST in slimmed down store directory.

Describe the solution you'd like

Allow the decryption commands to proceed in the case that not all SSTs in the registry are present.

I assume the errors are due to the fact that the DB needs to be opened in read only mode, and not all files listed in the manifest are present in the slimmed down store.

Describe alternatives you've considered

Ignore this slimmed down store scenario, and instead require that a user run the command on a real store directory.

Additional context

Related to cockroachlabs/support#2061.

Jira issue: CRDB-24282

[nicktrav]

Here's a small reproducer that mirrors what we were doing in the linked support case.

# Setup.
$ curl -LO https://binaries.cockroachdb.com/cockroach-v21.2.17.linux-amd64.tgz
$ tar xzf ./cockroach-v21.2.17.linux-amd64.tgz
$ curl -LO https://binaries.cockroachdb.com/cockroach-v23.1.0-alpha.1.linux-amd64.tgz
$ tar xzf cockroach-v23.1.0-alpha.1.linux-amd64.tgz
$ rm -rf /tmp/cockroach
$ mkdir /tmp/cockroach

# Create a DB at version 22.1.17.
$ ./cockroach-v21.2.17.linux-amd64/cockroach gen encryption-key /tmp/cockroach/key.aes
$ ./cockroach-v21.2.17.linux-amd64/cockroach start-single-node --store /tmp/cockroach --insecure --logtostderr --enterprise-encryption=path=/tmp/cockroach,key=/tmp/cockroach/key.aes,old-key=plain

# Run a workload to create some data on disk.
$ ./cockroach-v21.2.17.linux-amd64/cockroach workload run kv --drop --read-percent 0

# Create a fake store with only a single SST to decrypt, but all the auxillary
# files required to open the store.
$ mkdir /tmp/fake-store
$ cp /tmp/cockroach/MANIFEST-0000* /tmp/cockroach/COCKROACH* /tmp/cockroach/marker.* /tmp/cockroach/000094.sst /tmp/fake-store/

# Run the debug tool from the 23.1 binary on the fake store directory.
$ ./cockroach-v23.1.0-alpha.1.linux-amd64/cockroach debug encryption-decrypt /tmp/fake-store /tmp/fake-store/000094.sst /tmp/fake-store/000094.sst.decrypted --enterprise-encryption=path=/tmp/fake-store,key=/tmp/cockroach/key.aes,old-key=plain
ERROR: could not open store: L6: 000096: stat /tmp/fake-store/000096.sst: no such file or directory
L6: 000097: stat /tmp/fake-store/000097.sst: no such file or directory
L6: 000100: stat /tmp/fake-store/000100.sst: no such file or directory
L6: 000101: stat /tmp/fake-store/000101.sst: no such file or directory
L6: 000102: stat /tmp/fake-store/000102.sst: no such file or directory
L6: 000103: stat /tmp/fake-store/000103.sst: no such file or directory
Failed running "debug encryption-decrypt"

[nicktrav]

From @jbowens (link) - to do this without the need for opening the entire engine / store, we just need to grab the encryptedFS and do a vfs.CopyAcrossFS.