590 lines
23 KiB
Python
590 lines
23 KiB
Python
"""Root operator file installation, independent of migrations and service start."""
|
|
|
|
import hashlib
|
|
import os
|
|
import re
|
|
import secrets
|
|
import stat
|
|
import subprocess
|
|
from pathlib import Path
|
|
|
|
from . import file_copy, manifest, preflight, restore_io
|
|
from .layout import RELEASES as RELEASES
|
|
from .policy import DeliveryError, canonical, digest, fields, read_json, sha256
|
|
|
|
CURRENT = Path("/opt/kf-onlinejudge/current")
|
|
IMAGES = Path("/var/lib/kf-judge/images")
|
|
ACTIVE = Path("/etc/kf-onlinejudge/active.json")
|
|
APPLICATION_UNITS = (
|
|
"kf-api.service",
|
|
"kf-coordinator.service",
|
|
"kf-outbox.service",
|
|
"kf-problem-import.service",
|
|
"kf-worker.service",
|
|
"kf-sandbox-factory.service",
|
|
"kf-proxy.service",
|
|
)
|
|
LEGACY_HEADER = {
|
|
"image_kind": "linux_gnu_cxx_x86_64_v1",
|
|
"architecture": "x86_64",
|
|
"revision": 1,
|
|
}
|
|
|
|
|
|
def directory(path: Path, mode: int) -> None:
|
|
if not path.exists() and not path.is_symlink():
|
|
preflight.protected(path.parent, directory=True)
|
|
path.mkdir(mode=mode)
|
|
# Services deliberately run with UMask=0077. Explicit public layout
|
|
# modes apply only to the directory just created by this installer;
|
|
# an existing directory still goes through strict refusal below.
|
|
descriptor = os.open(path, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW | os.O_CLOEXEC)
|
|
try:
|
|
created = os.fstat(descriptor)
|
|
current = path.lstat()
|
|
if (
|
|
not stat.S_ISDIR(created.st_mode)
|
|
or created.st_uid != os.geteuid()
|
|
or (created.st_dev, created.st_ino) != (current.st_dev, current.st_ino)
|
|
):
|
|
raise DeliveryError("new installation directory identity changed")
|
|
os.fchmod(descriptor, mode)
|
|
os.fsync(descriptor)
|
|
finally:
|
|
os.close(descriptor)
|
|
preflight.protected(path, directory=True)
|
|
actual_mode = stat.S_IMODE(path.stat().st_mode)
|
|
if actual_mode != mode:
|
|
raise DeliveryError(
|
|
"existing directory mode differs; operator review required: "
|
|
+ str(path)
|
|
+ f" (expected {mode:04o}, observed {actual_mode:04o})"
|
|
)
|
|
|
|
|
|
def exclusive_file(path: Path, data: bytes, mode: int) -> None:
|
|
preflight.protected(path.parent, directory=True)
|
|
if path.exists() or path.is_symlink():
|
|
preflight.protected(path)
|
|
if stat.S_IMODE(path.stat().st_mode) != mode or path.read_bytes() != data:
|
|
raise DeliveryError("existing installed file differs; refused overwrite")
|
|
return
|
|
fd = os.open(path, os.O_CREAT | os.O_EXCL | os.O_WRONLY | os.O_NOFOLLOW, mode)
|
|
try:
|
|
with os.fdopen(fd, "wb", closefd=False) as output:
|
|
output.write(data)
|
|
output.flush()
|
|
os.fchmod(fd, mode)
|
|
os.fsync(fd)
|
|
finally:
|
|
os.close(fd)
|
|
sync_directory(path.parent)
|
|
|
|
|
|
def sync_directory(path: Path) -> None:
|
|
fd = os.open(path, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
|
|
try:
|
|
os.fsync(fd)
|
|
finally:
|
|
os.close(fd)
|
|
|
|
|
|
def copy_verified(source: Path, target: Path, expected: str, mode: int) -> None:
|
|
_copy_verified(source, target, expected, mode, readback=True)
|
|
|
|
|
|
def _copy_verified(
|
|
source: Path,
|
|
target: Path,
|
|
expected: str,
|
|
mode: int,
|
|
*,
|
|
readback: bool,
|
|
expected_bytes: int | None = None,
|
|
synchronize: bool = True,
|
|
) -> None:
|
|
preflight.protected(source)
|
|
sha256(expected)
|
|
if target.exists() or target.is_symlink():
|
|
if digest(source) != expected:
|
|
raise DeliveryError("source changed after bundle verification")
|
|
preflight.protected(target)
|
|
if digest(target) != expected or stat.S_IMODE(target.stat().st_mode) != mode:
|
|
raise DeliveryError("existing release differs; refused overwrite")
|
|
return
|
|
preflight.protected(target.parent, directory=True)
|
|
incoming = os.open(source, os.O_RDONLY | os.O_NOFOLLOW)
|
|
outgoing = os.open(target, os.O_CREAT | os.O_EXCL | os.O_WRONLY | os.O_NOFOLLOW, 0o600)
|
|
try:
|
|
with (
|
|
os.fdopen(incoming, "rb", closefd=False) as src,
|
|
os.fdopen(outgoing, "wb", closefd=False) as dst,
|
|
):
|
|
# A single-file copy verifies its source stream immediately. In a
|
|
# new frozen tree, the mandatory complete destination inventory
|
|
# below verifies every copied byte against the trusted records;
|
|
# hashing the same stream as well adds no independent evidence.
|
|
copied = hashlib.sha256() if readback else None
|
|
if copied is None:
|
|
size = os.fstat(incoming).st_size if expected_bytes is None else expected_bytes
|
|
file_copy.transfer(src, dst, size)
|
|
else:
|
|
while chunk := src.read(1024 * 1024):
|
|
copied.update(chunk)
|
|
dst.write(chunk)
|
|
dst.flush()
|
|
if copied is not None and copied.hexdigest() != expected:
|
|
raise DeliveryError(
|
|
"source changed after bundle verification; incomplete copy retained"
|
|
)
|
|
os.fchmod(outgoing, mode)
|
|
if synchronize:
|
|
os.fsync(outgoing)
|
|
if readback and digest(target) != expected:
|
|
raise DeliveryError("installed bytes differ; incomplete release retained")
|
|
finally:
|
|
os.close(incoming)
|
|
os.close(outgoing)
|
|
|
|
|
|
def ensure_accounts() -> None:
|
|
if preflight.identity_conflicts():
|
|
raise DeliveryError("OS identity conflicts")
|
|
import grp
|
|
import pwd
|
|
|
|
for name, identity in preflight.ACCOUNTS.items():
|
|
try:
|
|
grp.getgrnam(name)
|
|
except KeyError:
|
|
subprocess.run(
|
|
["/usr/bin/groupadd", "--gid", str(identity), name],
|
|
check=True,
|
|
timeout=10,
|
|
capture_output=True,
|
|
)
|
|
try:
|
|
pwd.getpwnam(name)
|
|
except KeyError:
|
|
subprocess.run(
|
|
[
|
|
"/usr/bin/useradd",
|
|
"--uid",
|
|
str(identity),
|
|
"--gid",
|
|
str(identity),
|
|
"--no-create-home",
|
|
"--no-user-group",
|
|
"--key",
|
|
"SUB_UID_COUNT=0",
|
|
"--key",
|
|
"SUB_GID_COUNT=0",
|
|
"--home-dir",
|
|
"/nonexistent",
|
|
"--shell",
|
|
"/usr/bin/nologin",
|
|
name,
|
|
],
|
|
check=True,
|
|
timeout=10,
|
|
capture_output=True,
|
|
)
|
|
if preflight.identity_conflicts():
|
|
raise DeliveryError("OS identity readback differs")
|
|
|
|
|
|
def data_directory(path: Path, owner: int) -> None:
|
|
preflight.protected(path.parent, directory=True)
|
|
if not path.exists() and not path.is_symlink():
|
|
path.mkdir(mode=0o700)
|
|
os.chown(path, owner, owner)
|
|
info = path.lstat()
|
|
if (
|
|
not stat.S_ISDIR(info.st_mode)
|
|
or info.st_uid != owner
|
|
or info.st_gid != owner
|
|
or stat.S_IMODE(info.st_mode) != 0o700
|
|
):
|
|
raise DeliveryError("existing private data directory identity/mode differs")
|
|
|
|
|
|
def frozen_copy(
|
|
source: Path,
|
|
target: Path,
|
|
*,
|
|
path_prefix: str = "",
|
|
verified_records: list[dict] | None = None,
|
|
) -> None:
|
|
"""For already verified release images, never accept external archive members."""
|
|
# Only the caller's verified manifest supplies these records. The complete
|
|
# destination is independently read and hashed before this function returns.
|
|
records = (
|
|
manifest.inventory(source, path_prefix=path_prefix)
|
|
if verified_records is None
|
|
else verified_records
|
|
)
|
|
directories = manifest.directories(source, path_prefix=path_prefix)
|
|
if target.exists() or target.is_symlink():
|
|
preflight.protected(target, directory=True)
|
|
if (
|
|
manifest.inventory(target, path_prefix=path_prefix) != records
|
|
or manifest.directories(target, path_prefix=path_prefix) != directories
|
|
):
|
|
raise DeliveryError("existing protected image differs")
|
|
for record in records:
|
|
preflight.protected(target / record["path"])
|
|
return
|
|
_copy_new_tree(source, target, records, directories)
|
|
if (
|
|
manifest.inventory(target, path_prefix=path_prefix) != records
|
|
or manifest.directories(target, path_prefix=path_prefix) != directories
|
|
):
|
|
raise DeliveryError("installed image readback differs")
|
|
|
|
|
|
def _copy_new_tree(source: Path, target: Path, records: list[dict], directories: list[str]) -> None:
|
|
"""Create a new sealed tree; the caller must verify the complete destination."""
|
|
|
|
def copy(record: dict) -> None:
|
|
# frozen_copy verifies this image immediately; a release staging tree
|
|
# gets the stronger complete bundle check before atomic publication.
|
|
_copy_verified(
|
|
source / record["path"],
|
|
target / record["path"],
|
|
record["sha256"],
|
|
int(record["mode"], 8),
|
|
readback=False,
|
|
expected_bytes=record["bytes"],
|
|
synchronize=False,
|
|
)
|
|
|
|
# Retain the filesystem error cursor before creating any destination.
|
|
# The enclosing installation service/caller owns its existing deadline.
|
|
filesystems = restore_io.Filesystems([target], None)
|
|
try:
|
|
target.mkdir(mode=0o700)
|
|
for name in sorted(directories, key=lambda name: (name.count("/"), name)):
|
|
(target / name).mkdir(mode=0o700)
|
|
for batch in restore_io.batches(records):
|
|
file_copy.bounded_copies(batch, copy)
|
|
filesystems.sync(None)
|
|
for name in sorted(directories, key=lambda name: name.count("/"), reverse=True):
|
|
(target / name).chmod(0o555)
|
|
target.chmod(0o555)
|
|
filesystems.sync(None)
|
|
finally:
|
|
filesystems.close()
|
|
|
|
|
|
def files(bundle: Path, expected: str) -> dict:
|
|
if os.geteuid() != 0:
|
|
raise DeliveryError("installer requires root")
|
|
preflight.protected(bundle, directory=True)
|
|
data = manifest.verify(bundle, expected)
|
|
observation = preflight.observe(bundle / "payload", bundle_data=data)
|
|
if not observation["eligible"]:
|
|
raise DeliveryError("installation preflight refused: " + "; ".join(observation["errors"]))
|
|
# Per-entry ownership matters even when the inventory is identical.
|
|
for record in data["files"]:
|
|
preflight.protected(bundle / "payload" / record["path"])
|
|
for name in data["directories"]:
|
|
preflight.protected(bundle / "payload" / name, directory=True)
|
|
ensure_accounts()
|
|
for name, mode in (
|
|
("/opt/kf-onlinejudge", 0o755),
|
|
(str(RELEASES), 0o755),
|
|
("/etc/kf-onlinejudge", 0o700),
|
|
("/etc/kf-judge", 0o700),
|
|
("/var/lib/kf-onlinejudge", 0o755),
|
|
("/var/lib/kf-onlinejudge/recovery", 0o700),
|
|
("/var/lib/kf-judge", 0o755),
|
|
("/var/lib/kf-judge/tasks", 0o755),
|
|
(str(IMAGES), 0o755),
|
|
):
|
|
directory(Path(name), mode)
|
|
exclusive_file(Path("/var/lib/kf-onlinejudge/recovery/restore.lock"), b"", 0o600)
|
|
for name in ("artifacts", "imports"):
|
|
data_directory(Path("/var/lib/kf-onlinejudge") / name, preflight.ACCOUNTS["kf-oj"])
|
|
data_directory(Path("/var/lib/kf-onlinejudge/worker"), preflight.ACCOUNTS["kf-worker"])
|
|
node_unit = bundle / "payload/deploy/release/kfonlinejudge.slice"
|
|
exclusive_file(Path("/etc/systemd/system/kfonlinejudge.slice"), node_unit.read_bytes(), 0o644)
|
|
release = RELEASES / data["release_id"]
|
|
if release.exists():
|
|
preflight.protected(release, directory=True)
|
|
manifest.verify(release, expected)
|
|
for record in data["files"]:
|
|
preflight.protected(release / "payload" / record["path"])
|
|
else:
|
|
stage = RELEASES / ("." + data["release_id"] + ".installing")
|
|
if stage.exists() or stage.is_symlink():
|
|
raise DeliveryError("incomplete release requires explicit operator inspection")
|
|
stage.mkdir(mode=0o700)
|
|
# Read every destination byte once in verify_staged, after copying the
|
|
# manifest and before publishing. Images still get their own complete
|
|
# independent readback in frozen_copy.
|
|
_copy_new_tree(
|
|
bundle / "payload",
|
|
stage / "payload",
|
|
data["files"],
|
|
manifest.directories(bundle / "payload"),
|
|
)
|
|
copy_verified(bundle / "manifest.json", stage / "manifest.json", expected, 0o444)
|
|
manifest.verify_staged(stage, expected)
|
|
stage.chmod(0o555)
|
|
os.rename(stage, release)
|
|
sync_directory(RELEASES)
|
|
image_base = IMAGES / data["release_id"]
|
|
directory(image_base, 0o755)
|
|
image_records = {}
|
|
for name in data["images"]:
|
|
prefix = "images/" + name + "/"
|
|
image_records[name] = [
|
|
{**record, "path": record["path"].removeprefix(prefix)}
|
|
for record in data["files"]
|
|
if record["path"].startswith(prefix)
|
|
]
|
|
frozen_copy(
|
|
release / "payload/images" / name,
|
|
image_base / name,
|
|
path_prefix="images/catalog/",
|
|
verified_records=image_records[name],
|
|
)
|
|
legacy = image_base / "legacy-gnu"
|
|
if legacy.exists():
|
|
preflight.protected(legacy, directory=True)
|
|
if read_json(legacy / "manifest.json") != LEGACY_HEADER:
|
|
raise DeliveryError("legacy compatibility image header differs")
|
|
wanted = {r["path"]: r for r in image_records["gnu"] if r["path"] != "manifest.json"}
|
|
actual = {
|
|
r["path"]: r
|
|
for r in manifest.inventory(legacy, path_prefix="images/catalog/")
|
|
if r["path"] != "manifest.json"
|
|
}
|
|
if wanted != actual or (
|
|
manifest.directories(legacy, path_prefix="images/catalog/")
|
|
!= manifest.directories(image_base / "gnu", path_prefix="images/catalog/")
|
|
):
|
|
raise DeliveryError("legacy compatibility image bytes differ")
|
|
else:
|
|
# This is an explicit v1 compatibility image, not a catalog rewrite.
|
|
# All executable/library bytes are identical to the verified GNU image.
|
|
frozen_copy(
|
|
image_base / "gnu",
|
|
legacy,
|
|
path_prefix="images/catalog/",
|
|
verified_records=image_records["gnu"],
|
|
)
|
|
legacy.chmod(0o700)
|
|
old = legacy / "manifest.json"
|
|
old.chmod(0o600)
|
|
old.write_bytes(canonical(LEGACY_HEADER))
|
|
old.chmod(0o444)
|
|
legacy.chmod(0o555)
|
|
receipt = {
|
|
"schema_version": 1,
|
|
"release_id": data["release_id"],
|
|
"source_sha": data["source_sha"],
|
|
"manifest_sha256": expected,
|
|
"images": data["images"],
|
|
"legacy_header_sha256": digest(legacy / "manifest.json"),
|
|
"files_installed": True,
|
|
"activated": False,
|
|
"migrated": False,
|
|
"execution_verified": False,
|
|
}
|
|
exclusive_file(
|
|
Path("/etc/kf-onlinejudge") / (data["release_id"] + ".files.json"),
|
|
canonical(receipt),
|
|
0o600,
|
|
)
|
|
return receipt
|
|
|
|
|
|
def selection(*, check_configuration: bool = True) -> dict:
|
|
"""One bounded protected binding; no process or health claim."""
|
|
from .configuration import (
|
|
check_installed,
|
|
installed_receipt_path,
|
|
private,
|
|
validate_receipt,
|
|
)
|
|
|
|
preflight.protected(ACTIVE)
|
|
private(ACTIVE)
|
|
value = fields(
|
|
read_json(ACTIVE, 4096),
|
|
{
|
|
"schema_version",
|
|
"release_id",
|
|
"manifest_sha256",
|
|
"configuration_id",
|
|
"receipt_sha256",
|
|
},
|
|
"active binding",
|
|
)
|
|
if (
|
|
type(value["schema_version"]) is not int
|
|
or value["schema_version"] != 1
|
|
or not isinstance(value["release_id"], str)
|
|
or not re.fullmatch(r"sd-[0-9a-f]{12}", value["release_id"])
|
|
or not isinstance(value["configuration_id"], str)
|
|
or not re.fullmatch(r"cfg-[0-9a-f]{24}", value["configuration_id"])
|
|
):
|
|
raise DeliveryError("invalid active release/configuration binding")
|
|
sha256(value["manifest_sha256"])
|
|
sha256(value["receipt_sha256"])
|
|
receipt = installed_receipt_path(value["release_id"], value["configuration_id"])
|
|
preflight.protected(receipt)
|
|
private(receipt)
|
|
if digest(receipt) != value["receipt_sha256"]:
|
|
raise DeliveryError("active configuration receipt differs")
|
|
binding = validate_receipt(read_json(receipt, 16384), installed=True)
|
|
if any(
|
|
binding[key] != value[key] for key in ("release_id", "configuration_id", "manifest_sha256")
|
|
):
|
|
raise DeliveryError("active configuration identity differs")
|
|
target = RELEASES / value["release_id"] / "payload"
|
|
info = CURRENT.lstat()
|
|
if not stat.S_ISLNK(info.st_mode) or info.st_uid != 0 or os.readlink(CURRENT) != str(target):
|
|
raise DeliveryError("active code pointer differs from configuration binding")
|
|
preflight.protected(target, directory=True)
|
|
if check_configuration:
|
|
check_installed(receipt)
|
|
return value
|
|
|
|
|
|
def require_stopped() -> None:
|
|
"""Do not select different private identities while any app unit is alive."""
|
|
for unit in APPLICATION_UNITS:
|
|
result = subprocess.run(
|
|
[
|
|
"/usr/bin/systemctl",
|
|
"show",
|
|
unit,
|
|
"--property=LoadState,ActiveState,MainPID",
|
|
],
|
|
capture_output=True,
|
|
text=True,
|
|
timeout=5,
|
|
check=False,
|
|
env={"PATH": "/usr/bin", "LC_ALL": "C"},
|
|
)
|
|
if len(result.stdout) > 4096:
|
|
raise DeliveryError("application stop observation exceeds limit")
|
|
values = dict(line.split("=", 1) for line in result.stdout.splitlines() if "=" in line)
|
|
if (
|
|
result.returncode
|
|
or values.get("LoadState") not in {"loaded", "not-found"}
|
|
or values.get("ActiveState") != "inactive"
|
|
or values.get("MainPID") != "0"
|
|
):
|
|
raise DeliveryError("all application units must be stopped before selection")
|
|
delegated = Path("/sys/fs/cgroup/kfonlinejudge.slice/kf-judge-tasks")
|
|
if delegated.exists():
|
|
if delegated.is_symlink() or (delegated / "cgroup.procs").read_text().strip():
|
|
raise DeliveryError("delegated execution processes remain")
|
|
if any(path.is_dir() for path in delegated.iterdir()):
|
|
raise DeliveryError("delegated task groups remain; cleanup proof required")
|
|
|
|
|
|
def _compatible_selection(current: dict, target: dict) -> None:
|
|
"""Select software only across the same declared schema and runtime ABI."""
|
|
if any(current[key] != target[key] for key in ("platform", "toolchains", "images", "locks")):
|
|
raise DeliveryError(
|
|
"release selection requires identical runtime/toolchain/lock identities"
|
|
)
|
|
|
|
def migrations(value: dict) -> dict:
|
|
return {
|
|
item["path"]: item
|
|
for item in value["files"]
|
|
if item["path"].startswith("backend/migrations/")
|
|
}
|
|
|
|
previous = migrations(current)
|
|
if not previous or previous != migrations(target):
|
|
raise DeliveryError("release selection requires identical nonempty Backend migrations")
|
|
|
|
|
|
@manifest.verified_operation
|
|
def activate(release_id: str, expected: str, batch: str) -> dict:
|
|
"""Only files + separately installed exact configuration may be selected.
|
|
|
|
This command starts no service, migrates no table, and removes no old version.
|
|
Runtime admission/isolation/health remains a separate bounded operation.
|
|
"""
|
|
if (
|
|
os.geteuid() != 0
|
|
or not re.fullmatch(r"sd-[0-9a-f]{12}", release_id)
|
|
or not re.fullmatch(r"cfg-[0-9a-f]{24}", batch)
|
|
):
|
|
raise DeliveryError("invalid activation identity or privilege")
|
|
expected = sha256(expected)
|
|
release = RELEASES / release_id
|
|
preflight.protected(release, directory=True)
|
|
from .configuration import check_installed, installed_receipt_path
|
|
|
|
config_receipt = installed_receipt_path(release_id, batch)
|
|
binding = check_installed(config_receipt)
|
|
# check_installed has already verified the complete selected release and
|
|
# configuration bytes. Bind that result to the explicit operator request.
|
|
if (
|
|
binding.get("manifest_sha256") != expected
|
|
or binding.get("release_id") != release_id
|
|
or binding.get("configuration_id") != batch
|
|
):
|
|
raise DeliveryError("configuration not bound to selected release")
|
|
require_stopped()
|
|
for port in (8000, 8100):
|
|
import socket
|
|
|
|
with socket.socket() as check:
|
|
try:
|
|
check.bind(("127.0.0.1", port))
|
|
except OSError as error:
|
|
raise DeliveryError("stop and drain services before activation") from error
|
|
if Path("/var/lib/kf-judge/factory/control.sock").exists():
|
|
raise DeliveryError("factory socket present; explicit stop/cleanup required")
|
|
for name in ("tasks", "identities", "captures"):
|
|
path = Path("/var/lib/kf-judge") / name
|
|
if path.exists():
|
|
preflight.protected(path, directory=True)
|
|
if next(path.iterdir(), None) is not None:
|
|
raise DeliveryError("execution leases or task resources remain; activation refused")
|
|
if ACTIVE.exists() or ACTIVE.is_symlink() or CURRENT.exists() or CURRENT.is_symlink():
|
|
# Retiring a byte-bound old batch is allowed after a kernel change.
|
|
# It is never accepted for execution under that changed environment.
|
|
previous = selection(check_configuration=False)
|
|
current_data = manifest.verify(
|
|
RELEASES / previous["release_id"], previous["manifest_sha256"]
|
|
)
|
|
target_data = manifest.verify(release, expected)
|
|
_compatible_selection(current_data, target_data)
|
|
if selection(check_configuration=False) != previous:
|
|
raise DeliveryError("selected binding changed before activation")
|
|
active = {
|
|
"schema_version": 1,
|
|
"release_id": release_id,
|
|
"manifest_sha256": expected,
|
|
"configuration_id": batch,
|
|
"receipt_sha256": digest(config_receipt),
|
|
}
|
|
incoming = ACTIVE.parent / (".active-" + secrets.token_hex(16))
|
|
exclusive_file(incoming, canonical(active), 0o600)
|
|
temporary = CURRENT.parent / (".current-" + secrets.token_hex(16))
|
|
temporary.symlink_to(release / "payload")
|
|
os.replace(temporary, CURRENT)
|
|
sync_directory(CURRENT.parent)
|
|
os.replace(incoming, ACTIVE)
|
|
sync_directory(ACTIVE.parent)
|
|
# A power loss between the two atomic writes leaves a detectable binding
|
|
# mismatch. No service is started and check-active refuses that state.
|
|
selection()
|
|
return {
|
|
"selected_source_sha": binding["source_sha"],
|
|
"configuration_id": batch,
|
|
"activated": True,
|
|
"services_started": False,
|
|
"execution_verified": False,
|
|
}
|