feat: release Dever 0.1.5 with direct workers and long transactions

test/onboarding/verify_prepared_release.py

@@ -78,8 +78,11 @@ def worker_project(image, ecosystem):
 
 
 def isolated(image, init):
+    isolator = Path(os.environ["DEVER_TEST_ISOLATOR"])
+    if not isolator.is_absolute() or not isolator.is_file():
+        raise ValueError("DEVER_TEST_ISOLATOR requires an absolute test-only executable")
     return [
-        WORKSPACE / "target/sandbox-inputs/assets/bin/bwrap",
+        isolator,
         "--unshare-all", "--die-with-parent", "--new-session", "--bind", image,
         "/", "--proc", "/proc", "--dev", "/dev", "--chdir", "/", "--ro-bind",
         init, "/fixture-proc-init",
@@ -195,7 +198,7 @@ def ordinary_uid_target_reuse(image):
         child.stderr.close()
 
 
-def install_assets(assets, image, manifest):
+def install_assets(assets, image, manifest, trusted_key):
     # Only transport is local: signature verification, full tar extraction and
     # the final bootstrap executable are the real first-install implementation.
     installer = load_installer()
@@ -215,7 +218,7 @@ def install_assets(assets, image, manifest):
     installer.download = download
     installer.install(argparse.Namespace(
         version="latest", release=None, system_root=image, no_start=True,
-        trusted_key=WORKSPACE / "skills/assets/release.pub",
+        trusted_key=trusted_key,
     ))
 
 
@@ -238,7 +241,7 @@ def accept(release, assets, image, report, init, extension_helper=None):
     try:
         minimal_os(image)
         if assets:
-            install_assets(assets, image, manifest)
+            install_assets(assets, image, manifest, WORKSPACE / "skills/assets/release.pub")
         else:
             execute([
                 "/bin/bash", WORKSPACE / "install",