+
    5mj              
         R t ^ RIHt ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RI	t	^ RI
t
^ RIt^ RIt^ RIHt ^ RIHt ^ RIHtHt ^ RIHt ^ RIt^ RItRtRtR	tR
tRtRt^xt^
tRt REt!RFt"REt#RGt$RHt%Rt&Rt'Rt(Rt)Rt*Rt+Rt,RIt-]P\                  ! R4      t/]P\                  ! R4      t0]1! 0 RJm4      t2]1! RR04      t3 ! R R]44      t5 ! R R]44      t6R R lt7R  R! lt8 ! R" R#4      t9R$ R% lt:R& R' lt;R( R) lt<R* R+ lt=R]&/R, R- llt>R.RR/RR0RR1]P~                  ^,          R2R3/R4 R5 llt@R6 R7 ltAR8 R9 ltB]	P                  3R: R; lltD]	P                  3R< R= lltE] ! R> R?4      4       tFR@ RA ltGRBR/RC RD lltHR# )Kzk3s Job transport for cdx dispatches.

The module owns no placement state: Kubernetes schedules the Job. It is loaded only
when OD_DISPATCH_K3S=1, so the incumbent dispatcher remains the default.
)annotationsN)	dataclass)Path)AnyCallable)urlsplitoverdeckzcdx-codex-authzcdx-git-readzoverdeck-ghcr-pullOD_DISPATCH_K3S_KUBECONFIGi   i zhttp://10.42.0.1:31888z10.42.0.0/16z	10.42.0.1zoverdeck-factoryzoverdeck-cdx-egressi|  i"  z\^(?:overdeck\.k3s\.local|ghcr\.io/alexcodeplace)/overdeck-agent-sandbox@sha256:[0-9a-f]{64}$z^[a-z0-9]([-a-z0-9]*[a-z0-9])?$	proxy_urlz)git@github.com:alexcodeplace/overdeck.gitz/ssh://git@github.com/alexcodeplace/overdeck.gitc                      ] tR t^;tRtRtR# )PreAgentFailurez9The Job cannot have run, so the podman path remains safe. N__name__
__module____qualname____firstlineno____doc____static_attributes__r       V/home/user/overdeck-private-tests/workstation-ai-broad/modules/systray/k3s_dispatch.pyr   r   ;       Cr   r   c                      ] tR t^?tRtRtR# )PostAgentFailurez9The Job may have run, so retrying on podman is forbidden.r   Nr   r   r   r   r   r   ?   r   r   r   c               $    V ^8  d   QhRRRRRR/# )   valuestrnamereturnr   )formats   "r   __annotate__r!   C   s!      # S S r   c                x    \        V 4      ^?8  g   \        P                  V 4      '       g   \        V R24      hV # )?   z is not a Kubernetes DNS label)len
_DNS_LABEL	fullmatchr   )r   r   s   &&r   _labelr'   C   s5    
5zBj22599&DEFFLr   c               $    V ^8  d   QhRRRRRR/# )r   r   r   r   r   zipaddress.IPv4Addressr   )r    s   "r   r!   r!   I   s"     
 
 
3 
+@ 
r   c                j    \         P                  ! V 4      pTP                  ^8w  g[   TP
                  '       gI   TP                  '       g7   TP                  '       g%   TP                  '       g   TP                  '       d   \        T R 24      hT#   \         d   p\        T R 24      ThRp?ii ; i)z is not configuredN)
	ipaddress
ip_address
ValueErrorr   versionis_unspecifiedis_loopbackis_link_localis_multicastis_reserved)r   r   addressexcs   &&  r   _usable_ipv4r5   I   s    D&&u- 	1 6 6 6':M:M:M   G$8$8$8G<O<O<O&89::N  D&89:CDs   B B2B--B2c                      ] tR t^VtRt]P                  3R R lltR R ltRR/R R	 llt	R
 R lt
R R ltR R ltR R ltR R ltR R ltRtR# )KubernetesApizESmall injectable Kubernetes API seam; tests use it without a cluster.c               $    V ^8  d   QhRRRRRR/# )r   	namespacer   
kubeconfig
str | Noner   Noner   )r    s   "r   r!   KubernetesApi.__annotate__Y   s"      # : VZ r   c                	*    Wn         W n        W0n        R # N)r9   r:   run)selfr9   r:   r@   s   &&&&r   __init__KubernetesApi.__init__Y   s    "$r   c                    V ^8  d   QhRRRR/# )r   argsr   r   	list[str]r   )r    s   "r   r!   r=   ^   s     = =3 =9 =r   c                	~    R .pV P                   '       d   VRV P                   .,          p. VORNV P                  NVO# )kubectl--kubeconfig--namespace)r:   r9   )rA   rE   argvs   &* r   _argvKubernetesApi._argv^   sC    {???^T__55D<<}<dnn<t<<r   documentNc               $    V ^8  d   QhRRRRRR/# )r   rE   r   rN   zdict[str, Any] | Noner   dict[str, Any]r   )r    s   "r   r!   r=   d   s"      s .C ~ r   c               	    T P                  V P                  ! V!  Ve   \        P                  ! V4      R,           MR RR\        P
                  R7      pTP                  '       dB   \        TP                  ;'       g    TP                  P                  4       ;'       g    R4      hTP                  P                  4       '       g   / #  \        P                  ! TP                  4      p\!        T\"        4      '       g   \        R4      hT#   \        \        P                  3 d   p\        RT 24      ThR p?ii ; i  \        P                   d   p\        R4      ThR p?ii ; i)N
T)inputcapture_outputtexttimeoutAPI unreachable: zKubernetes API request failedz$Kubernetes API returned invalid JSONz)Kubernetes API returned an invalid object)r@   rL   jsondumpsremote_dispatchPROBE_TIMEOUT_SECOSError
subprocessSubprocessErrorr   
returncodestderrstdoutstriploadsJSONDecodeError
isinstancedict)rA   rN   rE   doner4   r   s   &$*   r   	_run_jsonKubernetesApi._run_jsond   s2   		F88

D!7?7Ktzz(+d2QU#'99  D ???!4;;#=#=$++"D"D"F"i"iJijj{{  ""I	SJJt{{+E %&&!"MNN 334 	F!$5cU";<#E	F ## 	S!"HIsR	Ss0   AD  E  D=)D88D= E&E!!E&c                    V ^8  d   QhRRRR/# )r   r   r   r   boolr   )r    s   "r   r!   r=   {   s     V V# V$ Vr   c                	    V P                  V P                  R RV4      RR\        P                  R7      pTP                  ^ 8X  d   R# TP                  ;'       g    TP                  P                  4       pRTP                  4       9   g   RTP                  4       9   d   R# \        RT;'       g    R	 24      h  \        \
        P                  3 d   p\        RT 24      ThRp?ii ; i)
getsecretTrT   rU   rV   rW   Nnotfoundz	not foundFzsecret lookup failed)r@   rL   rZ   r[   r\   r]   r^   r   r_   r`   ra   rb   lower)rA   r   rg   r4   details   &&   r   secret_existsKubernetesApi.secret_exists{   s    	F88

5(D1$T'99  D ??a++,,335';&,,.+H 1&2R2R<R1STUU 334 	F!$5cU";<#E	Fs   4B; ;C*C%%C*c                    V ^8  d   QhRRRR/# )r   rN   rP   r   r   r   )r    s   "r   r!   r=      s      > c r   c           	     	    V P                  R RRRRVR7      pVP                  R/ 4      P                  RR4      p\        V\        4      '       d   \        P
                  ! R	V4      '       g   \        R
4      hV# )create-f--orX   rN   metadatauid [0-9a-f-]{36}created Job has no valid UID)rh   rm   re   r   rer&   r   )rA   rN   r   r}   s   &&  r   
create_jobKubernetesApi.create_job   sh    xsD&8Tii
B'++E26#s##2<<8H#+N+N!"@AA
r   c                    V ^8  d   QhRRRR/# )r   rN   rP   r   r<   r   )r    s   "r   r!   r=      s     M M~ M$ Mr   c           	     	4    V P                  R RRRRVR7       R# )rw   rx   ry   rz   rX   r{   N)rh   )rA   rN   s   &&r   rw   KubernetesApi.create   s    xsD&8Lr   c                    V ^8  d   QhRRRR/# )r   job_namer   r   r<   r   )r    s   "r   r!   r=      s     
o 
o# 
o$ 
or   c           
     	    V P                  V P                  R RVRRR4      RR\        P                  R7      pTP                  '       dG   TP                  ;'       g    TP                  P                  4       p\        RT;'       g    R	 24      hR#   \        \
        P                  3 d   p\        RT 24      ThRp?ii ; i)
patchjobz--type=mergez-pz{"spec":{"suspend":false}}Tro   z)could not establish whether Job started: Nzunsuspend failed)r@   rL   rZ   r[   r\   r]   r^   r   r_   r`   ra   rb   )rA   r   rg   r4   rr   s   &&   r   	unsuspendKubernetesApi.unsuspend   s    	_88

7E8^TKgh#$8Y8Y  D ???kk00T[[779F"%NvOkOkYkNl#mnn  334 	_"%Nse#TU[^^	_s   7B C.B==Cc                    V ^8  d   QhRRRR/# )r   r   r   r   rF   r   )r    s   "r   r!   r=      s      # ) r   c           
     	    \        \        4      P                  R 4      p\        P                  \        V4      RV P                  RVR\        \        4      .pV P                  '       d   VRV P                  .,          pV# )zk3s_job_runner.pyrJ   z--jobz	--timeoutrI   )	r   __file__	with_namesys
executabler   r9   JOB_TIMEOUT_SECONDSr:   )rA   r   runnercommands   &&  r   	wait_argvKubernetesApi.wait_argv   sd    h))*=>>>3v;t~~wX`$7 8:???88Gr   c                    V ^8  d   QhRRRR/# )r   r   r   r   r;   r   )r    s   "r   r!   r=      s     
 
3 
: 
r   c           
     	F    V P                  V P                  R RVRRR4      RR^R7      pTP
                  '       d5   RT RTP                  ;'       g    TP                  P                  4        2# R	#   \        \        P                  3 d   pRT RT 2u R	p?# R	p?ii ; i)
deleter   z--ignore-not-foundz--cascade=foregroundz--wait=trueTro   z could not delete Kubernetes Job : N)	r@   rL   r\   r]   r^   r_   r`   ra   rb   )rA   r   rg   r4   s   &&  r   
delete_jobKubernetesApi.delete_job   s    	H88

8UH6JLbdqr#$  D ???5hZr4;;C]C]RVR]R]BdBdBfAghh	 334 	H5hZr#GG	Hs   )A3 3B BB B )r:   r9   r@   )r   r   r   r   r   r]   r@   rB   rL   rh   rs   r   rw   r   r   r   r   r   r   r   r7   r7   V   sH    OCM>> 
=d .VM
o
 
r   r7   c               $    V ^8  d   QhRRRRRR/# )r   sandboxr   
attempt_idr   r   )r    s   "r   r!   r!      s!     0 0s 0 0 0r   c                    \         P                  ! R RV P                  4       4      P                  R4      ;'       g    RpRVR,           RVR,           2# )z
[^a-z0-9-]ry   	workspacezcdx-:N   N:N   N)r   subrq   rb   )r   r   safes   && r   	_job_namer      sI    66-gmmo6<<SAPP[D$s)Ajo.//r   c               $    V ^8  d   QhRRRRRR/# )r   r   r   job_uidr   zlist[dict[str, Any]]r   )r    s   "r   r!   r!      s"      s S 5I r   c                p    \         P                  ! R V4      '       g   \        R4      hRRRRRV RVRR	R
R	/.# )r   r   
apiVersionbatch/v1kindJobr   r}   
controllerTblockOwnerDeletion)r   r&   r   )r   r   s   &&r   _owner_referencer      sJ    <<('22<==j&%5'd0$  r   c               0    V ^8  d   QhRRRRRRRRRRRR	/# )
r   r9   r   r   r   r   targetk3s_result.UploadTargetr   rP   r   )r    s   "r   r!   r!      s9       C 3 QT #:?Mr   c                V   \        V R 4       \        VR4       \        P                  ! V4      p\        VP	                  4       4      R8  d   \        R4      hRRRRRR	VR V R
RV/R\        W#4      /RRRRRR\        P                  ! VP	                  4       4      P                  4       //# )r9   upload Secreti   z?result upload target exceeds the Kubernetes control-plane limitr   v1r   Secretr|   r   labelsoverdeck.dev/cdx-jobownerReferences	immutableTtypeOpaquedataupload-json)
r'   
k3s_resultserialize_targetr$   encoder   r   base64	b64encodedecode)r9   r   r   r   r   r   s   $$$$$ r   upload_secret_manifestr      s    
9k"
4!''/E
5<<>V#_``dFHVT;	 6A&(8(KM 	T68 0 0 @ G G IJ r   c               4    V ^8  d   QhRRRRRRRRRRRRR	R
/# )r   r9   r   r   r   r   r   r   r
   r   rP   r   )r    s   "r   r!   r!      sA     # ## #S #C #RU #$;#HK#P^#r   c                   \        V R 4       \        VR4       \        P                  ! V4      p\        V4      p \        P
                  ! VP                  ;'       g    R4      pTP                  R8w  g   TP                  '       g   TP                  '       gp   TP                  R 9  g_   TP                  '       gM   TP                  '       g;   TP                  ^8w  g*   \!        T4      \"        8w  g   TP$                  \&        8w  d   \        R4      hRRRR	R
RTR T RRT/R\)        Y#4      /RRRRT//RR.RRRR\*        //.RRRRTP$                  /./RRRR\,        //RRR\.        ///.RRRR\0        /./RRRTP                   R2//.RRRRTP$                  /././/#   \         d   p	\        R4      T	hRp	?	ii ; i)!r9   znetwork policyr~   k3s egress proxy URL is invalidNhttpr   znetworking.k8s.io/v1r   NetworkPolicyr|   r   r   r   r   specpodSelectormatchLabelspolicyTypesEgressegresstoipBlockcidrportsprotocolTCPportnamespaceSelectorzkubernetes.io/metadata.nameapp.kubernetes.io/namez/32   r~   /)r'   r   validate_targetr   r*   r+   hostnamer,   r   schemeusernamepasswordpathqueryfragmentr-   r   _PROXY_CONFIG_HOSTr   _PROXY_NODE_PORTr   _PROXY_POD_CIDR_PROXY_NAMESPACE
_PROXY_APP_PROXY_CONTAINER_PORT)
r9   r   r   r   r   r
   parsed_targetparsed_proxyproxy_addressr4   s
   $$$$$$    r   network_policy_manifestr      s}   
9k"
4!"..v6MI&LJ!,,\-B-B-H-HbI f$(=(=(=AVAVAVZfZkZks|Z|  AM  AS  AS  AS  Wc  Wl  Wl  Wl  p}  pE  pE  IJ  pJ  NQ  R_  N`  dv  Nv  zF  zK  zK  O_  z_?@@,foVT;	 6A&(8(KM 	M,BH+MNH:V_$=>?Jv|7H7HIJL'-57G: * "M0*4 $	  z5&:OPQS V0F0F/Gs-K$LMNJv}7I7IJKM
 	  J?@cIJs   *F" "F>-F99F>c               D    V ^8  d   QhRRRRRRRRRRRRRRR	R
RRRRRR/# )r   r   r   r9   imagegit_url	input_refinput_commit	exec_nameforwarded_argvrF   upload_secretr
   r   rP   r   )r    s   "r   r!   r!      sm     l l# l# lc lC lTW ll+.l@IlZ]ll4Blr   c        
   8        \        V R4       \        VR4       \        VR4       \        P                  V4      '       g   \        R4      hV'       d5   VP	                  R4      '       d   \
        P                  ! RV4      '       g   \        R4      h\        V	4      p
 \        P                  ! V
P                  ;'       g    R4      pT
P                  R8w  g;   TP                  ^8w  g*   \        T4      \        8w  g   T
P                  \         8w  d   \        R	4      hRRRRRRR.//pRRRRRRRRRRR//pRRRRRR R!/R"RR#RR$R R%//pR&T
P                   R'2pR(T
P                   R)2pR*pT R+\"        P$                  ! T4       R,T R-\"        P$                  ! T4       R.T R/\"        P$                  ! T4       R0T R1\"        P$                  ! T4       2pR2pR3T
P                   R4T
P                   R52pR6R7TR8TR9T.TOpR:R;R<R=R//R:R>R<R=R?//R:R@R<R=RA//R:RBR<R=RA//R:RCRDRE\&        RFRG//R:RHRDRE\(        RFRG//.pR:R;RIRJ/pRKRLRMRNROT /pR:RPRQRRRSRT///pRURVRWRXRYR:T RTRZT/R[R\RR]^ R^\*        R_R`RaRYRZT/R[RbRcRdRReRfRgRhRiRjRkRlRmRn\-        \.        4      /././//RoR:\0        /.RpTRqR:RrRsTRtRuRvR6R7.RwT.RpTRxTR:RyRzT/.R{TR:R>RIR|/R:RHRIR}R~R/./R:RRsTRtRuRvR6R7.RwT.RpTRxR:RRzR|/.R{R:R>RIR|/R:RCRIRR~R/./.RR:RRsTRtRuRvTRRJRxR:RRzR|/TR:RRzR/R:RRQRR:TRjR///.RTRpTR{TR:R>RIR|/R:R@RIR/R:RBRIR/./	.RT////#   \         d   p\        R	4      ThR
p?ii ; i)zMBuild a suspended restricted Job; dependent resources exist before it starts.zjob namer9   r   Cimage digest is missing or not from the approved sandbox repositoryz	refs/cdx/[0-9a-f]{40,64}*in-cluster git transport is not configuredr~   r   Nr   allowPrivilegeEscalationFreadOnlyRootFilesystemTcapabilitiesdropALLrunAsNonRoot	runAsUseri  
runAsGroupfsGroupseccompProfiler   RuntimeDefaultrequestscpu2memory8Gizephemeral-storage128Milimits412Gi512Miz/usr/bin/ssh -o HostName=ssh.github.com -p 443 -o HostKeyAlias=github.com -o ProxyCommand='/bin/nc -X connect -x $K3S_NODE_PROXY:z~ %h %p' -i /git-read/id_ed25519 -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/git-read/known_hostszK3S_NODE_PROXY="${K3S_POD_IP%.*}.1"; export K3S_NODE_PROXY; attempt=0; while [ "$attempt" -lt 20 ]; do attempt=$((attempt + 1)); if /bin/nc -z -w 1 "$K3S_NODE_PROXY" z; then break; fi; if [ "$attempt" -eq 20 ]; then echo 'cdx-k3s-job: egress proxy did not become ready' >&2; exit 69; fi; sleep 1; donez.git -c safe.directory=/workspace -C /workspacez && git clone --no-checkout z /workspace && z fetch origin z && test "$(z rev-parse FETCH_HEAD)" = z && z checkout --detach zHmkdir -p $HOME/.codex && cp /credential/auth.json $HOME/.codex/auth.jsonzHproxy_host="${K3S_POD_IP%.*}.1"; export HTTPS_PROXY="http://$proxy_host:z!" HTTP_PROXY="http://$proxy_host:z*"; exec /usr/local/bin/cdx-k3s-worker "$@"z/bin/sh-czcdx-k3s-worker--r   r   emptyDir	sizeLimithome2Gitmp256Miresult
credentialrn   
secretNamedefaultModei   zgit-read	mountPath
/workspacer   zoverdeck-cdxzapp.kubernetes.io/componentworkerr   
K3S_POD_IP	valueFromfieldRef	fieldPathzstatus.podIPr   r   r   r   r|   r   r   suspendbackoffLimitactiveDeadlineSecondsttlSecondsAfterFinishedi  templaterestartPolicyNeverautomountServiceAccountTokenaffinitynodeAffinity.requiredDuringSchedulingIgnoredDuringExecutionnodeSelectorTermsmatchExpressionskeyzkubernetes.io/hostnameoperatorInvaluesimagePullSecretssecurityContextinitContainerszfetch-workspacer   imagePullPolicyAlwaysr   rE   envGIT_SSH_COMMANDr   volumeMountsz	/home/cdxz	/git-readreadOnlyzprepare-credentialHOMEz/credential
containersagent
workingDirNODE_USE_ENV_PROXY1CDX_RESULT_UPLOAD_JSONsecretKeyRefr   	resourcesz/tmpz/resultvolumes)r'   _DIGEST_IMAGEr&   r   
startswithr   r   r*   r+   r   r,   r   r-   r   r   r   r   shlexquoteAUTH_SECRETGIT_READ_SECRETr   list_WORKER_NODESIMAGE_PULL_SECRET)r   r9   r   r   r   r   r   r   r   r
   proxyproxy_ipr4   lockedpod_securityrG  ssh_commandproxy_readyworkspace_gitfetchcredential_initagent_scriptagent_commandrH  workspace_mountr   
pod_ip_envs   $$$$$$$$$$                 r   manifestr_     s    8Z 
9k"
=/*""5))cdd)..{;;2<<PbdpCqCqJKKYEJ''(<(<"= ||v!1!1Q!6#h-K]:]afakakoa?@@(%1I4vw/1F"D+t\4t%5@P7QSLeS(E;NPWXE3&:MwWYI V  W\  Wa  Wa  Vb  b`  aK2 38** >	  EM- ##(;;w#7"8/I(>'? @!?"=ekk,>W=XX\/,U[[-F,G		I 
 aO338::, ?++0::, 74	5  l4D!4E5CEM 
j;*>?	k5%9:	
['$:;	:W'=>	x,]TW)XY	Xo}VY'Z[G {KFO&8UW_$h0F,[.16 J 	j&%VX{IxPD.!5LNa*Dj8V*<f$g/Mu.I04F!&(@*d!)4+>J I  4! 3"L3 " (63D*E)F&% "3WeEVX`#i%6IZ\b*v7H'S^._!`(?VV[Ze<f,2J[Zdfj+k+mn
 !"6HY[c#i%6@QSdfl667K"H!I(FFK+U,2L+}^hjn+o+qr( "'5:KX"M<&&';!G"(*>!M"(*BK%3fmUTa5bRd "e!f %i1BF'/FFKYd;e+15+v*N+18[)*T*V% $ I%G %'+ +g  J?@cIJs   "L+ L+ +M6MMr;  
input_pathoutput_path
file_limitcheckTc               8    V ^8  d   QhRRRRRRRRR	RR
RRRRR/# )r   rootr   rE   r   r;  zdict[str, str] | Noner`  Path | Nonera  rb  intrc  rk   r   zsubprocess.CompletedProcessr   )r    s   "r   r!   r!   i  sO      4  2G !,BM!$ ! -Hr   c                  R R\          2RV 2R\         2RR.VOpVe   VP                  R4      MRpVe   VP                  R4      M\        P                  p	\
        P                  ! 4       p
 \        P                  ! WpWWR	\        ^,           R
7      pV
P                  ^ \        P                  4       V
P                  4       pV
P                  \        ^ VR,
          4      4       V
P                  4       P                  RR7      P                  4       pV
P!                  4        Ve   VP!                  4        Ve   V	P!                  4        T'       d.   TP"                  '       d   \%        RTP"                   RT 24      hT#   T
P!                  4        Te   TP!                  4        Te   T	P!                  4        i i ; i)z/usr/bin/prlimitz--as=z--fsize=z--cpu=r  /usr/bin/gitNrbwbF)cwdr;  stdinra   r`   rc  rV   i  replace)errorszgit exited r   )PROCESS_ADDRESS_SPACE_BYTES!RESULT_PROCESSING_TIMEOUT_SECONDSopenr]   PIPEtempfileTemporaryFiler@   seekosSEEK_ENDtellmaxreadr   rb   closer_   RuntimeError)re  r;  r`  ra  rb  rc  rE   rK   sourcedestinationro  	completedsizeerrors   &$$$$$*       r   _run_limited_gitr  i  s   
 	e$?#@AXj\CZ
234dNMQD '1&<Z__T"$F,7,C+""4(K##%F NN+!BQ!F
	 	Ar{{#{{}C4$;'($$I$6<<>LLN"%%%[)=)=(>bHII 	LLN" #s   .B&F ;F>c               4    V ^8  d   QhRRRRRRRRRRR	RR
R/# )r   re  r   
quarantineresult_commitr   r   r;  zdict[str, str]	directoryr   r<   r   )r    s   "r   r!   r!     sJ     "K "KD "Kd "K3 "KVY "K)"K6:"K?C"Kr   c                   VR ,          p\        V R\        V4      RRRVRV 2VV\        R7       ^ pVP                  4       ;_uu_ 4       pV FM  p	V^,          pV\        8  g.   \
        P                  ! RV	P                  4       4      '       d   KD  \        R4      h	  R	R	R	4       VR
,          p
\        V R\        V4      RRVWj\        R7	       ^ p^ pV
P                  4       ;_uu_ 4       pV F  p	V	P                  4       p\        V4      ^8w  g3   \
        P                  ! RV^ ,          4      '       d   V^,          R9  d   \        R4      h \        V^,          4      pT^ 8  g   T\        8  d   \        R4      hY,          pT^,          pT\        8  g   K  \        R4      h	  R	R	R	4       W8w  d   \        R4      hR	#   + '       g   i     EL/; i  \         d   p\        R4      ThR	p?ii ; i  + '       g   i     LV; i)objects	--git-dirzrev-listz	--objectsz--no-object-names^)r;  ra  rb  r   z6result bundle object count or identity is not approvedNzobject-sizeszcat-filez7--batch-check=%(objectname) %(objecttype) %(objectsize))r;  r`  ra  rb  z(result bundle object metadata is invalidz$result bundle object size is invalidz*result bundle contains an oversized objectz+result bundle expanded size is not approvedz,result bundle object inventory is incomplete>   tagblobtreecommit)r  r   MAX_OBJECT_LIST_BYTESrr  MAX_RESULT_OBJECTSr   r&   rb   r}  splitr$   rg  r,   MAX_RESULT_OBJECT_BYTESMAX_RESULT_EXPANDED_BYTES)re  r  r  r   r;  r  r  countr~  linesizestotalmeasuredfieldsr  r4   s   &&&&&&          r   _validate_objectsr    s   )#GT;J[(-1\N9KQT!(5JL E	6DQJE))>PRVR\R\R^1_1_"#[\\  

 &ET;JNTW 'G\^ EH	DZZ\F6{ar||4Fq	'R'RV\]^V_  hI  WI"#MNNT6!9~ ax4"99"#OPPMEMH00"#PQQ  
 IJJ 5 
$  T"#IJPSST 
sP   
AGG+A	G75G7G!6G7G7G	G4	#G/	/G4	4G77H	c          
     ,    V ^8  d   QhRRRRRRRRRR/# )r   re  r   bundler   r   r   r   r   )r    s   "r   r!   r!     s0     ( ( (d (# ( (PS (r   c                   VP                  4       '       d8   ^ VP                  4       P                  u;8  d   \        P                  8:  g   M \        R4      h\        \        P                  ! RR\        V 4      RRR.R\        P                  R7      P                  4       4      pVR	,          pVP                  4       '       g   \        R
4      h\        P                  ! RVP                   R7      ;_uu_ 4       p\        V4      p\#        V RR\        V4      VR,          \$        R7       VR,          p\#        V RR\        V4      4       \        V4      p	RV	9   d   \        R4      hVR,          P'                  V	R,           4       / \(        P*                  CRV	/Cp
\#        V R\        V4      RRRRRR\        V4      RV
R7       \#        V R\        V4      RR V
R7      P,                  P/                  4       P                  4       p\#        V R\        V4      R!R"W+V
R#R$7	      P0                  '       d   \        R%4      h\3        WWW4       \#        V R\        V4      R&R'R(R)R*WR7
       R+p\#        V R\        V4      R,WV
R7       R-V 2p\#        V RR\        V4      R.V R/V 2V
R7       R0R0R04       \#        V RX R124      P,                  P/                  4       P                  4       pVX8w  d   \        R24      hV#   + '       g   i     LZ; i)3zOValidate untrusted objects in quarantine before importing one local result ref.z"result bundle size is not approvedri  -Cz	rev-parsez--path-format=absolutez--git-common-dirT)rU   rV   r  z.controller Git object directory is unavailablezcdx-result-quarantine-)prefixdirr  verifyzbundle-verificationra  rb  zrepository.gitinitz--barerR   z*controller Git object directory is invalidzobjects/info/alternates GIT_ALTERNATE_OBJECT_DIRECTORIESr  r  zfetch.unpackLimit=0zfetch.fsckObjects=truerY  z	--no-tagsHEAD)r;  zFETCH_HEAD^{commit}z
merge-basez--is-ancestorF)r;  rc  z;result bundle does not descend from the submitted workspacefsckz--strictz--connectivity-onlyz--no-reflogsz--no-danglingzrefs/cdx/resultz
update-refzrefs/cdx-fetch/+:Nz	^{commit}z-validated result commit changed during import)is_filestatst_sizer   MAX_BUNDLE_BYTESr}  r   r]   check_outputr   rZ   r[   rb   is_dirrt  TemporaryDirectoryparentr  r  
write_textrw  environra   r   r_   r  )re  r  r   r   commonobject_directory	temporaryr  r  	alternater;  r  quarantine_ref	fetch_refimporteds   &&&&           r   import_resultr    s   >>1v{{}'<'<#[
@[@[#[?@@*))	s4y+7OQcd?<< egF 	)""$$KLL		$	$,D&--	X	X\eO	x3v;IXmLm$9	;!11
vxZA()	9KLL	/	/;;I<LMKK?K{C
OTCX7+sSY{\bhk	m(+s:=RX[

&%%' 	 D+s:o(SOOYzZ\]]$MX{C
OVZQf'-	R*{C
O\>nqr%gY/	wS_.IYYZ[dZeFflop3 
Y4  ki[3LMTT[[]cceH= JKK; 
Y	Xs   :F.K::L
	c          
     ,    V ^8  d   QhRRRRRRRRRR/# )	r   re  r   pre_shar   
result_refr   r   r;   r   )r    s   "r   r!   r!     s0      t c s 4 `j r   c                    \         P                  ! WR7      w  rV\         P                  ! WVR7      pYW8w  d
   RT  RT R2#  \	        T RR	YR
T\
        R7       TP                  4       P                  '       d   \	        T RRR	RTR7       \         P                  ! YR7      w  rY8w  d   RT  RT R2 TP                  RR7       # TP                  4       P                  '       d   \	        T RR	RTR7       TP                  RR7       R#   \         P                   d   pRT  RT 2u Rp?# Rp?ii ; i  \        \        \        P                  3 d"   pRT 2u Rp?TP                  RR7       # Rp?ii ; i  TP                  RR7       i ; i)zNApply one validated delta unless the owner's checkout changed during dispatch.r@   zchecking the local checkout of z	 failed: Nzlocal checkout uY    changed during the k3s dispatch; not overwriting it — the validated result is safe at z in this repositorydiffz--binaryr  r  applyz--checkry   )r`  T)
missing_okz*applying the validated k3s result failed: )rZ   _snapshot_treetree_ofOffloadUnavailabler  MAX_RESULT_PATCH_BYTESr  r  unlinkr\   r}  r]   r^   )
re  r  r  r   r@   current_tree_expected_treer4   latest_trees
   &&&&&     r   apply_resultr    s   F)88G'//3G $dV $//9l:MO	
&vz7Z_$:	<::<T7Iz3SXY(77F'!$ (33=,>QS 	% ::<T7JN 	%1 -- F0iuEEF( \:#=#=> B;C5AA%B 	%sZ   1D	 A.D3 D3 %D3 	D0D+%D0+D03 E4E/E4E7 /E44E7 7Fc               (    V ^8  d   QhRRRRRRRR/# )r   re  r   r   r   r   r   r;   r   )r    s   "r   r!   r!     s)     
 
D 
3 
3 
Wa 
r   c                    V! R R\        V 4      RRRVRV 2.RR\        P                  R7      pTP                  '       d   RTP                  P                  4        2# R	#   \        \        P
                  3 d   pRT 2u R	p?# R	p?ii ; i)
ri  r  pushz-qz--no-verifyr  Tro   z could not remove cdx input ref: N)	r   rZ   SYNC_TIMEOUT_SECr\   r]   r^   r_   r`   rb   )re  r   r   r@   deletedr4   s   &&&&  r   _delete_input_refr    s    8T3t9fdM7VWXaWbTcddO4T4T
 1'..2F2F2H1IJJ	 Z//0 81#778s   .A! !B<B BBc                      ] tR tRt$ R]R&   R]R&   R]R&   R]R&   R]R	&   R
]R&   R]R&   R]R&   R]R&   R]R&   R]R&   R]R&   R]R&   R]R&   RtR]R&   R R lt]P                  3R R llt	Rt
R# )Sessioni  r   	host_namerf   accessr   re  rel_dirr   rF   rK   
sandbox_idr   r  r   r   r7   apizk3s_result.ResultMailboxmailboxztempfile.TemporaryDirectoryr  Nr;   git_warningc                   V ^8  d   QhRR/# )r   r   r<   r   )r    s   "r   r!   Session.__annotate__  s     	8 	8 	8r   c                	   V P                   P                  V P                  4      \        V P                  V P
                  V P                  4      .p V P                  P                  4        V P                  P                  4        V F+  pV'       g   K  \        RV 2\        P                  R7       K-  	  R#   \         d   pTP                  R T 24        Rp?LqRp?ii ; i)z$could not close cdx result mailbox: Ncdx: file)r  r   r   r  re  r   r   r  r|  	Exceptionappendr  cleanupprintr   r`   )rA   ro  r4   r  s   &   r   releaseSession.release  s    ((%%dmm46G		SWS_S_aeaoao6pq	HLL  	 EueWoCJJ7   	HMM@FGG	Hs   B9 9C"CC"c                   V ^8  d   QhRR/# )r   r   r;   r   )r    s   "r   r!   r  "  s     > >z >r   c                    V P                   P                  \        4      p\        V P                  W P
                  V P                  4      p\        V P                  V P
                  V\        V P                  P                  4      R,          VR7      #   \        \        \        \        P                  3 d   pRT 2u Rp?# Rp?ii ; i)zHReceive, quarantine, validate, and locally apply the one attempt result.zresult.patchr  z"result retrieval from k3s failed: N)r  waitRESULT_MAILBOX_GRACE_SECONDSr  re  r  r  r  r   r  r   r\   r}  TimeoutErrorr]   r^   )rA   r@   r  r  r4   s   &&   r   	pull_backSession.pull_back"  s    	>\\&&'CDF&tyy&,,XJ		4<< $T^^%8%8 9N JPSU U|Z5O5OP 	>7u==	>s   BB %C9C=CCr   )r   r   r   r   __annotations__r  r  r]   r@   r  r   r   r   r   r  r    sm    NL
JLN
OOLLNM	%%**"K"	8 'NN > >r   r  c                    V ^8  d   QhRRRR/# )r   registryrf   r   r   )r    s   "r   r!   r!   -  s        d  t  r   c                J  a V P                  R 4      o\        S\        4      '       g   \        R4      h\	        S4      \
        ,
          p\
        \	        S4      ,
          pV'       g	   V'       d   . pV'       d-   VP                  RRP                  \        V4      4       24       V'       d-   VP                  RRP                  \        V4      4       24       \        RRP                  V4       R24      h\        ;QJ d#    V3R l\
         4       F  '       g   K   R	M	  R
M! V3R l\
         4       4      '       d   \        R4      h\        SR,          R4       \        P                  SR,          4      '       g   \        R4      hSR,          \        9  d   \        R4      h\        SR,          R4        \        SR,          4      p\        VP                   ;'       g    RR4      pVP"                  pTP&                  R8w  go   TP(                  '       g]   TP*                  '       gK   TP,                  R9  g:   TP.                  '       g(   TP0                  '       g   TP2                  ^8w  g   Tf   \        R4      hS#   \$         d   p\        R4      ThRp?ii ; i)k3sz$k3s dispatch configuration is absentzunknown keys: z, zmissing keys: z'k3s dispatch configuration is invalid (z; )c              3     <"   T F7  p\        SV,          \        4      '       * ;'       g    SV,          '       * x  K9  	  R # 5ir?   )re   r   ).0r2  r   s   & r   	<genexpr>_config.<locals>.<genexpr>:  s2     
YHXz%*c**<<%*n<HXs
   'AATFz;k3s dispatch configuration values must be non-empty stringsr9   r   r   r   z@in-cluster Git URL is not an approved credential-free repositoryresult_hostzk3s result mailbox hostr
   r~   zk3s egress proxy hostr   Nr   r   )rm   re   rf   r   set_K3S_CONFIG_KEYSr  joinsortedanyr'   rI  r&   _APPROVED_GIT_URLSr5   r   r   r   r,   r   r   r   r   r   r   r-   )	r  unknownmissingdetailsrR  r   
proxy_portr4   r   s	   &       @r   _configr  -  s   LLEeT""DEE%j++GU+G'NN^DIIfWo,F+GHINN^DIIfWo,F+GHI G		RYHZG[[\]^^
s
YHX
Ysss
YHX
YYY[\\
5{+""5>22cddY11`aa}%'@AJ{+,$U^^%9%9r;RSZZ
 	%...ENNNejjXaFa;;;%...M,A,AQ,F*J\?@@L  J?@cIJs   <>J J"JJ"r  c               8    V ^8  d   QhRRRRRRRRR	R
RRRRRR/# )r   r   r   r   rF   rl  rf  registry_pathr   r  z!remote_dispatch.Credential | Nonefallbackz%Callable[[], remote_dispatch.Session]r  zKubernetesApi | Noner   z!Session | remote_dispatch.Sessionr   )r    s   "r   r!   r!   P  sW     Z8 Z8s Z8I Z8K Z8 $Z82SZ8@Z8G[Z8 hIZ8r   c                h   RpRp	Rp
RpRpRpRpRpRpRp Vf   \        R4      h\        P                  ! V4      p\        V4      pVR,          pVR,          pVR,          pVR,          pVR	,          pT;'       g0    \	        V\
        P                  P                  \        4      VR
7      p\        \        \        3 F)  pVP                  V4      '       d   K  \        RV R24      h	  \        P                  ! V4      p\        P                  ! WR
7      pVf   \        R4      h\        P                  ! V4      p\         P"                  ! 4       P$                  R,          p\        P&                  ! V\        P(                  ! 4       4      pV'       g   \        R4      hV'       g   \        R4      h\*        P,                  ! RR7      p
\.        P0                  ! VV\3        V
P4                  4      4      p	V	P7                  4       p\9        VV4      pRVR,           2pRVR,           2p\;        VVVVVVV VVVR7
      pV! \        P<                  ! WVV4      RR\        P>                  R7      p V P@                  '       d'   \        RV PB                  PE                  4        24      hRpRpVPG                  V4      p!VPI                  \K        VVVV!VR7      4       VPI                  \M        VVVV!VVR7      4       VPO                  V4       \Q        R/ VRRVPS                  V4      VVVWWV
R7      p"Rp	Rp
RpT"V	eT   V'       d<   Ve8   VPU                  V4      p#V#'       d   \W        RV# 2\X        PB                  R 7       V	P[                  4        V
e   V
P]                  4        V'       dV   V'       gM   VeH   V'       d?   V'       d6   \_        WWR
7      p#V#'       d    \W        RV# 2\X        PB                  R 7       # # # # # # #   \`         d0   p$\        Pb                  ! R!T$ 2\        Pd                  R"7      T$hRp$?$i\         \        Pb                  \f        \h        Pj                  \l        3 d   p$\W        R#T$ R$2\X        PB                  R 7       T! 4       u Rp$?$T	eT   T'       d<   Te8   TPU                  T4      p#T#'       d   \W        RT# 2\X        PB                  R 7       T	P[                  4        T
e   T
P]                  4        T'       dV   T'       gM   TeH   T'       d?   T'       d6   \_        YYR
7      p#T#'       d    \W        RT# 2\X        PB                  R 7       # # # # # # # Rp$?$ii ; i  T	eT   T'       d<   Te8   TPU                  T4      p#T#'       d   \W        RT# 2\X        PB                  R 7       T	P[                  4        T
e   T
P]                  4        T'       dV   T'       gM   TeH   T'       d?   T'       d6   \_        YYR
7      p#T#'       d    \W        RT# 2\X        PB                  R 7       i i i i i i i ; i)%zGPrepare a suspended Job; only failures proven pre-agent may use podman.Nr~   Fzno credential resolvedr9   r   r   r  r
   r  zSecret z
 is absentz,git snapshot is unavailable for k3s dispatch:N   Nr   z)k3s result mailbox host is not configuredzcdx-k3s-result-)r  zcdx-upload-:N   Nzcdx-egress-)
r   r9   r   r   r   r   r   r   r   r
   Tro   zinput git push failed: )r9   r   r   r   r   )r9   r   r   r   r   r
   r  r  )r  r  re  r  r   rK   r  r   r  r   r   r  r  r  r  r  z7k3s dispatch may have started and will not be retried: )codezcdx: k3s dispatch failed (z); ran on podman)7r   rZ   load_registryr  r7   rw  r  rm   KUBECONFIG_ENVrM  rN  rQ  rs   	repo_rootsnapshot_commitr  uuiduuid4hexdispatch_refnew_dispatch_idrt  r  r   ResultMailboxr   r   startr   r_  push_commit_argvr  r_   r`   rb   r   rw   r   r   r   r  r   r   r  r   r|  r  r  r   r  EXIT_MIRRORr\   r]   r^   r,   )%r   r   rl  r  r  r@   r  r  clientr  r  re  r   r   r   job_createdinput_pushedtransferredr  configr9   r   r  r
   rn   r  r   r   r   r   policy_namer   pushedr   sessionr  r4   s%   $$$$$$$$                             r   open_sessionr"  P  sh    $(F/3G48IDGIHKLKL8!":;;"00?";'	w#]+;'	YYi1OUXY"O5FGF''//%xz&BCC H ((-!11$@?!"PQQ!,,T2ZZ\%%c*
#00/:Y:Y:[\	!"NOO!"MNN//7HI	**;
DDXYWj1%jo%67#JsO#45IUT[!*I&4M!*, _55dWiX$(t_=]=]_!$;FMM<O<O<Q;R"STT##C(,y}6>X^` 	a-	7?5;yR 	S 	"BT<S_!!(+Za[d

 	 v1))(3E%/

;MMO 0@WQZ%dYHEeWoCJJ7  R[W0@<!  00EcUKRaRmRm
	 _??*JdJdfpq *3%/?@szzRzv1))(3E%/

;MMO 0@WQZ%dYHEeWoCJJ7  R[W0@< v1))(3E%/

;MMO 0@WQZ%dYHEeWoCJJ7  R[W0@<s   A%P  <AP  B:P  P  'FP   U$*P555U$+U$,%UU$U' U$$U' 'X14X1A	X1X1#X1/X17:X1i   i   @i   l        )debian2debian3>   r   r   r9   r
   r  )Ir   
__future__r   r   r*   rX   rw  r   rK  r]   r   rt  r  dataclassesr   pathlibr   typingr   r   urllib.parser   r   rZ   	NAMESPACErM  rN  rQ  r  r   rq  r  r  r  r  r  r  rp  DEFAULT_PROXY_URLr   r   r   r   r   r   rP  compilerI  r%   	frozensetr  r   r}  r   r   r'   r5   r7   r   r   r   r   r_  r  r  r  r  r@   r  r  r  r  r"  r   r   r   <module>r.     s  
 #    	 	   
   !    !  	 ( - $' !!  + . * ( 4 ,    % "
  &

c ZZ:;
Z[ /5   Dl DD| D
\ \~0
"#Ll/l^$ /3PT'1'B'BQ'F $(>"KJ(V NX^^ @ EONN 
 $> $> $>N FZ8^bZ8 Z8r   