docs/rofl: Document refresh-trust-root subcommand

Author: anzoman

docs/rofl.md

@@ -554,3 +554,20 @@ You can also define specific [Network and ParaTime][npa] parameters:
 
 [ParaTime ID]: https://github.com/oasisprotocol/oasis-core/blob/master/docs/runtime/identifiers.md
 [chain domain separation context]: https://github.com/oasisprotocol/oasis-core/blob/master/docs/crypto.md#chain-domain-separation
+
+### Refresh the trust root in the app manifest {#refresh-trust-root}
+
+The consensus block height and hash of the [trust root](#trust-root) are stored
+in the deployment section of the `rofl.yaml` app manifest and are embedded into
+the app at build time. Instead of editing the manifest by hand, you can fetch
+the latest trust root and update the manifest automatically by running
+`oasis rofl refresh-trust-root`:
+
+![code shell](../examples/rofl/refresh-trust-root.in.static)
+
+![code](../examples/rofl/refresh-trust-root.out.static)
+
+By default the latest finalized consensus block is used. Pass `--height` to pin
+a specific block or `--deployment` to update a non-default deployment. After
+refreshing, run [`oasis rofl build`](#build) for the new trust root to take
+effect.

examples/rofl/refresh-trust-root.in.static

@@ -0,0 +1 @@
+oasis rofl refresh-trust-root

examples/rofl/refresh-trust-root.out.static

@@ -0,0 +1 @@
+Updated 'rofl.yaml' with trust root: height=1022, hash=bb3e63d729dd568ce07b37eea33eddf8082ed4cacbd64097aad32168a4a4fc9a