Refactor VM lifecycle management and enhance validation

- Introduced a new method `installed_kernel` in `ImageStore` to handle kernel verification and checksum validation.
- Updated `Installer` to include additional packages: `nftables` and `conntrack`.
- Refined `LifecycleService` to improve error handling and state management during VM creation, starting, stopping, and deletion.
- Enhanced port management with new methods for setting and syncing ports, including validation for port rules.
- Improved error handling in `StateStore` to raise specific `NotFoundError` and `ConflictError` exceptions.
- Updated network management to ensure proper TAP device handling and firewall integration.
- Enhanced API responses in `vms.py` to include policy status for better client-side handling.
- Added validation for VM names and ports in `validation.py` to enforce stricter rules and prevent conflicts.

uvm/images.py

@@ -58,23 +58,14 @@ class ImageStore:
         self._runner = runner or CommandRunner()
 
     def installed_assets(self) -> GuestAssets:
-        kernel = self._settings.kernel_image
+        kernel = self.installed_kernel()
         rootfs = self._settings.rootfs_image
         if not kernel.exists() or not rootfs.exists():
             raise UvmError("guest assets missing. Run: sudo uvm install")
         manifest = load_manifest(self._settings.integrity_manifest_path)
-        kernel_checksum = self._settings.kernel_sha256
         rootfs_checksum = self._settings.rootfs_sha256
         if manifest.verified or self._settings.allow_unverified_downloads:
-            kernel_checksum = kernel_checksum or manifest.checksums.get("kernel")
             rootfs_checksum = rootfs_checksum or manifest.checksums.get("rootfs")
-        verify_file(
-            kernel,
-            kernel_checksum,
-            "guest kernel",
-            "UVM_KERNEL_SHA256",
-            allow_unverified=self._settings.allow_unverified_downloads,
-        )
         verify_file(
             rootfs,
             rootfs_checksum,
@@ -84,6 +75,19 @@ class ImageStore:
         )
         return GuestAssets(kernel=kernel, rootfs=rootfs)
 
+    def installed_kernel(self) -> Path:
+        """A retained private disk does not depend on the original rootfs template."""
+        kernel = self._settings.kernel_image
+        if not kernel.is_file():
+            raise UvmError("guest kernel missing. Run: sudo uvm install")
+        manifest = load_manifest(self._settings.integrity_manifest_path)
+        checksum = self._settings.kernel_sha256
+        if manifest.verified or self._settings.allow_unverified_downloads:
+            checksum = checksum or manifest.checksums.get("kernel")
+        verify_file(kernel, checksum, "guest kernel", "UVM_KERNEL_SHA256",
+                    allow_unverified=self._settings.allow_unverified_downloads)
+        return kernel
+
     def create_vm_disk(self, source: Path, destination: Path) -> Path:
         """Copy the template before Firecracker opens it read-write for a VM."""