perf(delivery): reuse proofs within installer operations

scripts/release/factory_service.py

@@ -9,7 +9,7 @@ import stat
 import subprocess
 from pathlib import Path
 
-from . import configuration, install, preflight, service_install, services
+from . import configuration, install, manifest, preflight, service_install, services
 from .policy import DeliveryError, canonical, digest, fields, read_json, sha256
 
 UNIT = "kf-sandbox-factory.service"
@@ -167,6 +167,7 @@ def generate(output: Path) -> dict:
     payload = install.RELEASES / selected["release_id"] / "payload"
     for name in (
         "factory_service.py",
+        "manifest.py",
         "services.py",
         "service_profiles.py",
         "layout.py",
@@ -199,6 +200,7 @@ def generate(output: Path) -> dict:
     return result
 
 
+@manifest.verified_operation
 def install_unit(source: Path, expected: str) -> dict:
     if os.getuid() != 0 or os.geteuid() != 0:
         raise DeliveryError("factory unit installation requires root operator")
@@ -219,6 +221,7 @@ def install_unit(source: Path, expected: str) -> dict:
     payload = install.RELEASES / selected["release_id"] / "payload"
     for name in (
         "factory_service.py",
+        "manifest.py",
         "services.py",
         "service_profiles.py",
         "layout.py",

scripts/release/proxy_install.py

@@ -15,6 +15,7 @@ from . import (
     configuration,
     install,
     journal,
+    manifest,
     preflight,
     proxy_runtime,
     proxy_service,
@@ -308,6 +309,7 @@ def temporary_directories() -> None:
             os.chown(temporary_directory, proxy_service.UID, proxy_service.UID)
 
 
+@manifest.verified_operation
 def install_proxy(source: Path, expected: str, certificate: Path, key: Path) -> dict:
     if os.getuid() != 0 or os.geteuid() != 0 or os.getgid() != 0:
         raise DeliveryError("root proxy installer required")
@@ -325,6 +327,7 @@ def install_proxy(source: Path, expected: str, certificate: Path, key: Path) ->
         "proxy.py",
         "proxy_service.py",
         "proxy_install.py",
+        "manifest.py",
         "proxy_guard.py",
         "proxy_runtime.py",
     ):