client

The platform's runner endpoints, as a runner calls them.

:class:RunnerClient signs every request with the runner's key and trusts an answer only when it verifies: the certificate in the answer must chain to the pinned root key, carry a serial no lower than the highest seen, and name the key that signed the answer, and that signature must cover this very request.

Every failure is a :class:PlatformError. Only a verified answer with a 4xx status (other than 429) is the platform's decision; everything else, from a lost connection to an answer that does not verify, may be tried again.

PlatformError

Bases: Exception

A request did not get a trusted, successful answer.

decided property

Whether the platform refused the request in a verified answer.

__init__(message, *, status=None, code=None, verified=False)

Keep what the caller needs to decide whether to try again.

RunnerClient

Signed requests to the platform, and verified answers from it.

__init__(*, base_url, key, root_key, http, version, runner_id=None, min_serial=0, on_new_serial=None, clock=time.time)

Hold the runner's key, the pinned root and the client.

min_serial is the highest certificate serial seen before; on_new_serial is told of every higher one, so the caller can keep it across restarts.

enrol(*, token, name, capacity) async

Enrol this runner's key with a single-use token.

heartbeat(request) async

Report the leases held.

lease(request) async

Ask for work that fits.

own_state() async

Return this runner's state as the platform holds it.

pool_images() async

Return the images this runner's pool may be asked to run.

post_result(lease_id, request) async

Post how a job ended.

public_key()

Return the runner's public key, base64.

send(method, path, body, keyid=None) async

Sign and send a request as given; the answer is not checked.

verify(sent)

Raise PlatformError unless the answer verifies; learn its serial.

Sent dataclass

A request as sent, and the answer to it, not yet verified.