certlord 1.0.0__py3-none-any.whl

certlord/__init__.py

@@ -0,0 +1,4 @@
+# -*- coding: utf-8 -*-
+# Copyright (C) 2019-2022 fjord-technologies
+# SPDX-License-Identifier: GPL-3.0-or-later
+__all__ = ['classes', 'modules']

certlord/adapters/__init__.py

@@ -0,0 +1 @@
+"""Configuration and integration boundaries for external components."""

certlord/adapters/api_auth.py

@@ -0,0 +1,21 @@
+"""Delegate credential verification to HTTPdis; ignore caller-supplied identity headers."""
+
+
+class HttpdisApiAuth(object):
+    def authenticate(self, request):
+        request.authenticate()
+        return request.get_server_vars().get('HTTP_AUTH_USER')
+
+
+class LocalFixtureAuth(object):
+    """Only wired for explicit loopback development mode."""
+    def authenticate(self, request):
+        return 'local'
+
+
+class ApiRequestAccess(object):
+    def __init__(self, authenticator, policy):
+        self.authenticator, self.policy = authenticator, policy
+
+    def require(self, request, operation):
+        return self.policy.require(self.authenticator.authenticate(request), operation)

certlord/adapters/auton_receipt.py

@@ -0,0 +1,71 @@
+"""Use Auton's structured single-job CLI protocol without forwarding output."""
+import json
+import re
+import time
+from urllib.parse import urlsplit
+from certlord.adapters.processes import CommandRunner, CommandInterrupted, CommandTimeout
+
+
+class InvalidReceipt(ValueError):
+    pass
+
+
+def receipt_target(uri, endpoint, args):
+    # Restrict this opt-in contract to one destination and execution mode. Do not
+    # let arbitrary CLI flags override identity, output format or submit targets.
+    parsed = urlsplit(uri)
+    if (parsed.scheme not in ('http', 'https') or not parsed.hostname
+            or parsed.username or parsed.password or parsed.query or parsed.fragment
+            or parsed.path not in ('', '/')
+            or not isinstance(endpoint, str)
+            or re.fullmatch(r'[A-Za-z0-9_-]{1,128}', endpoint) is None):
+        raise ValueError('Receipt mode requires one plain HTTP origin and endpoint')
+    if len(args) % 2 or any(args[i] not in ('--http-timeout', '--delay') for i in range(0, len(args), 2)):
+        raise ValueError('Receipt mode only supports --http-timeout and --delay overrides')
+    return {'origin': uri.rstrip('/'), 'endpoint': endpoint}
+
+
+def run_receipted(runner, command, attempt_id, notify):
+    target = command['receipt_target']
+    expected = target['endpoint'] + ':' + attempt_id
+    deadline = time.monotonic() + runner.timeout
+    mode = 'run'
+    observed_state = None
+    while True:
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            raise CommandTimeout('Auton receipt deadline exceeded')
+        bounded = CommandRunner(runner.stop_event, remaining, runner.grace)
+        code, output, _ = bounded.run(command['args'] + ['--mode', mode, '--uid', attempt_id], command['env'])
+        try:
+            if not isinstance(output, bytes) or len(output) > 4 * 1024 * 1024:
+                raise ValueError()
+            result = json.loads(output)
+            if (not isinstance(result, dict) or result.get('uid') != expected
+                    or type(result.get('code')) is not int or result['code'] not in (200, 400)
+                    or result.get('status') not in ('new', 'processing', 'complete')):
+                raise ValueError()
+            complete = result['status'] == 'complete'
+            return_code = result.get('return_code')
+            if complete and type(return_code) is not int:
+                raise ValueError()
+            if not complete and (code != 0 or result['code'] != 200 or return_code is not None):
+                raise ValueError()
+            if complete and (code not in (0, 1) or bool(code) != (result['code'] != 200)):
+                raise ValueError()
+        except (ValueError, TypeError, UnicodeError):
+            raise InvalidReceipt('Auton returned no valid matching job receipt') from None
+        # Metadata is constructed from trusted target and matching response identity.
+        receipt = dict(target, uid=expected, status=result['status'], return_code=return_code)
+        if receipt['status'] != observed_state:
+            notify(receipt)
+            observed_state = receipt['status']
+        if complete:
+            # Reject uncertain/interrupted completion even if a provider reports 0.
+            successful = (return_code == 0 and result['code'] == 200
+                          and not result.get('execution_uncertain')
+                          and result.get('outcome') not in ('job.interrupted', 'job.cancelled'))
+            return (0 if successful else 1), receipt
+        mode = 'status'  # Never resubmit after a missing, failed or ambiguous read.
+        if runner.stop_event.wait(min(1.0, max(0, deadline - time.monotonic()))):
+            raise CommandInterrupted('Worker stopping')

certlord/adapters/commands.py

@@ -0,0 +1,122 @@
+# -*- coding: utf-8 -*-
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""Build argv and explicit subprocess environments without running commands."""
+import os
+
+from certlord.classes.config import (AUTON_PROG, CERTBOT_PROG,
+                                    DEFAULT_BECOME_METHOD, DEFAULT_BECOME_OPTS,
+                                    DEFAULT_BECOME_USER, DEFAULT_CERTBOT_ARGS)
+from certlord.classes.exceptions import CertLordConfigError
+
+
+class CommandBuilder(object):
+    def __init__(self, config, modconf):
+        self.config = config
+        self.modconf = modconf
+        self._auton_cred = {}
+
+    @staticmethod
+    def _get_become(cfg):
+        if not isinstance(cfg, dict) or not cfg.get('enabled'):
+            return []
+
+        method = cfg.get('method') or DEFAULT_BECOME_METHOD
+        become = [method]
+
+        if method in DEFAULT_BECOME_OPTS:
+            become += DEFAULT_BECOME_OPTS[method]
+
+        if method == 'sudo':
+            become += ['-u', cfg.get('user') or DEFAULT_BECOME_USER]
+
+        return become
+
+    def certbot_cmd(self):
+        conf = {}
+
+        if isinstance(self.modconf.get('certbot'), dict):
+            conf = self.modconf['certbot']
+
+        r = {'args': self._get_become(conf.get('become')) + [CERTBOT_PROG],
+             'env':  None}
+
+        if not conf:
+            r['args'] += DEFAULT_CERTBOT_ARGS
+            return r
+
+        if 'args' not in conf:
+            r['args'] += DEFAULT_CERTBOT_ARGS
+        else:
+            if not isinstance(conf['args'], list):
+                raise CertLordConfigError("invalid certbot args configuration")
+
+            r['args'] += conf['args']
+
+        if 'search_paths' in conf:
+            if not isinstance(conf['search_paths'], list):
+                raise CertLordConfigError("invalid certbot search_paths configuration")
+
+            r['env'] = {'PATH': os.path.pathsep.join(conf['search_paths'])}
+
+        return r
+
+    def _get_auton_cred(self):
+        if self._auton_cred:
+            return self._auton_cred
+
+        creds = self.config['credentials']['auton']
+        uri   = creds.get('uri') or os.environ.get('AUTON_URI')
+        if not uri:
+            raise CertLordConfigError("missing variable AUTON URI")
+
+        endpoint = creds.get('endpoint') or os.environ.get('AUTON_ENDPOINT')
+        if not endpoint:
+            raise CertLordConfigError("missing variable AUTON endpoint")
+
+        auth_user = creds.get('auth-user') or os.environ.get('AUTON_AUTH_USER') or ""
+        auth_passwd = creds.get('auth-passwd') or os.environ.get('AUTON_AUTH_PASSWD') or ""
+
+        self._auton_cred = {'args': ['--uri', uri,
+                                     '--endpoint', endpoint],
+                            'env':  {'AUTON_AUTH_USER': auth_user,
+                                     'AUTON_AUTH_PASSWD': auth_passwd}}
+
+        return self._auton_cred
+
+    def auton_cmd(self):
+        conf = {}
+
+        if isinstance(self.modconf.get('auton'), dict):
+            conf = self.modconf['auton']
+
+        r = {'args': self._get_become(conf.get('become')) + [AUTON_PROG],
+             'env':  dict(self._get_auton_cred()['env'])}
+
+        if not conf:
+            r['args'] += self._get_auton_cred()['args']
+            return r
+
+        if 'args' not in conf:
+            r['args'] += self._get_auton_cred()['args']
+        else:
+            if not isinstance(conf['args'], list):
+                raise CertLordConfigError("invalid auton args configuration")
+
+            r['args'] += conf['args'] + self._get_auton_cred()['args']
+
+        receipt_mode = conf.get('receipt_mode', False)
+        if type(receipt_mode) is not bool:
+            raise CertLordConfigError('auton receipt_mode must be boolean')
+        if receipt_mode:
+            from certlord.adapters.auton_receipt import receipt_target
+            credentials = self._get_auton_cred()['args']
+            r['receipt_target'] = receipt_target(credentials[1], credentials[3], conf.get('args', []))
+
+        if 'search_paths' in conf:
+            if not isinstance(conf['search_paths'], list):
+                raise CertLordConfigError("invalid auton search_paths configuration")
+
+            r['env']['PATH'] = os.path.pathsep.join(conf['search_paths'])
+
+        return r
+

certlord/adapters/cycle_progress.py

@@ -0,0 +1,77 @@
+"""Bounded cycle evidence in Redis; never a work queue or an execution lease."""
+import hashlib
+import json
+import math
+import uuid
+
+WORKERS = ('certlord-certbot_handler', 'certlord-crawler', 'certlord-deployer')
+
+START = """
+local old = redis.call('HGET', KEYS[1], 'current')
+if old and cjson.decode(old).instance_id ~= ARGV[1] then
+    redis.call('HSET', KEYS[1], 'previous_instance', old)
+end
+redis.call('HSET', KEYS[1], 'current', ARGV[2])
+return 1
+"""
+FINISH = """
+local old = redis.call('HGET', KEYS[1], 'current')
+if not old or cjson.decode(old).cycle_id ~= ARGV[1] then return 0 end
+redis.call('HSET', KEYS[1], 'current', ARGV[2])
+return 1
+"""
+
+
+def record_value(raw):
+    """Reject corrupt records instead of returning arbitrary Redis content."""
+    if raw is None:
+        return None
+    value = json.loads(raw)
+    fields = {'instance_id', 'cycle_id', 'state', 'started_timestamp_seconds',
+              'finished_timestamp_seconds', 'duration_seconds'}
+    if not isinstance(value, dict) or set(value) != fields:
+        raise ValueError('Invalid cycle record')
+    for field in ('instance_id', 'cycle_id'):
+        if str(uuid.UUID(value[field])) != value[field]:
+            raise ValueError('Invalid cycle identity')
+    if value['state'] not in ('running', 'returned', 'raised', 'stopped'):
+        raise ValueError('Invalid cycle state')
+    for field in ('started_timestamp_seconds', 'finished_timestamp_seconds', 'duration_seconds'):
+        number = value[field]
+        if number is None and field != 'started_timestamp_seconds' and value['state'] == 'running':
+            continue
+        if type(number) not in (int, float) or not math.isfinite(number) or number < 0:
+            raise ValueError('Invalid cycle timestamp or duration')
+        if value['state'] == 'running' and field != 'started_timestamp_seconds':
+            raise ValueError('Running cycle has completion evidence')
+    return value
+
+
+class CycleProgressStore:
+    def __init__(self, redis, server_id):
+        self.redis = redis
+        self.prefix = 'cycle-progress:' + hashlib.sha256(str(server_id).encode()).hexdigest() + ':'
+
+    def connection(self):
+        if len(self.redis.servers) != 1:
+            raise ValueError('One authoritative Redis server required')
+        return next(iter(self.redis.servers.values()))['conn']
+
+    def key(self, worker):
+        if worker not in WORKERS:
+            raise ValueError('Unknown cycle worker')
+        return self.prefix + worker
+
+    def start(self, worker, record):
+        return self.connection().eval(START, 1, self.key(worker), record['instance_id'], json.dumps(record)) == 1
+
+    def finish(self, worker, record):
+        return self.connection().eval(FINISH, 1, self.key(worker), record['cycle_id'], json.dumps(record)) == 1
+
+    def read(self):
+        connection = self.connection()
+        result = {}
+        for worker in WORKERS:
+            current, previous = connection.hmget(self.key(worker), 'current', 'previous_instance')
+            result[worker] = {'current': record_value(current), 'previous_instance': record_value(previous)}
+        return result

certlord/adapters/deployment_lease.py

@@ -0,0 +1,51 @@
+# -*- coding: utf-8 -*-
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""Exclusive bounded deployment lease on one authoritative Redis server."""
+import hashlib
+import math
+from uuid import uuid4
+
+from certlord.classes.exceptions import CertLordConfigError
+
+OWNED = "return redis.call('GET', KEYS[1]) == ARGV[1] and 1 or 0"
+RENEW = "if redis.call('GET', KEYS[1]) == ARGV[1] then return redis.call('PEXPIRE', KEYS[1], ARGV[2]) end return 0"
+RELEASE = "if redis.call('GET', KEYS[1]) == ARGV[1] then return redis.call('DEL', KEYS[1]) end return 0"
+ACK = """if redis.call('GET', KEYS[1]) ~= ARGV[1] then return 0 end
+redis.call('SREM', KEYS[2], KEYS[3])
+redis.call('DEL', KEYS[3])
+return 1"""
+
+
+class LeaseLost(Exception):
+    pass
+
+
+class DeploymentLease(object):
+    def __init__(self, redis, server_id, timeout):
+        if len(redis.servers) != 1:
+            raise CertLordConfigError('Deployment coordination requires one authoritative Redis server')
+        if not math.isfinite(timeout) or timeout <= 0:
+            raise CertLordConfigError('Deployment lease duration must be finite and positive')
+        self.conn = next(iter(redis.servers.values()))['conn']
+        self.key = 'deployment-lock:' + hashlib.sha256(str(server_id).encode('utf-8')).hexdigest()
+        self.timeout_ms = int(math.ceil(timeout * 1000))
+        self.token = None
+
+    def acquire(self):
+        token = str(uuid4())
+        if self.conn.set(self.key, token, nx=True, px=self.timeout_ms):
+            self.token = token
+            return True
+        return False
+
+    def renew(self):
+        return bool(self.token and self.conn.eval(RENEW, 1, self.key, self.token, self.timeout_ms))
+
+    def release(self):
+        if self.token:
+            return bool(self.conn.eval(RELEASE, 1, self.key, self.token))
+        return False
+
+    def acknowledge(self, server_id, key):
+        if not self.token or not self.conn.eval(ACK, 3, self.key, server_id, key, self.token):
+            raise LeaseLost('Deployment lease lost; pending work retained')

certlord/adapters/deployment_queue.py

@@ -0,0 +1,40 @@
+# -*- coding: utf-8 -*-
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""Generation-specific deployment entries, atomic within each Redis server."""
+import hashlib
+from certlord.services.certificate_ids import require_certificate_id
+import json
+import time
+from six import iteritems
+
+
+def certificate_generation(certificate):
+    material = [certificate.get('cert', ''), certificate.get('chain', '')]
+    return hashlib.sha256(json.dumps(material, separators=(',', ':')).encode('utf-8')).hexdigest()
+
+
+class DeploymentQueue(object):
+    def __init__(self, redis):
+        self.redis = redis
+
+    def enqueue(self, server_id, certificate_id, domain, certificate):
+        certificate_id = require_certificate_id(certificate_id)
+        identity = [str(server_id), str(certificate_id), domain.lower(),
+                    certificate.get('cert', ''), certificate.get('chain', '')]
+        key = 'deploy:' + hashlib.sha256(json.dumps(identity, separators=(',', ':')).encode('utf-8')).hexdigest()
+        payload = json.dumps({'certificate_id': str(certificate_id), 'domain': domain.lower(),
+                              'generation': certificate_generation(certificate)})
+        for _, server in iteritems(self.redis.servers):
+            with server['conn'].pipeline(transaction=True) as pipe:
+                pipe.hsetnx(key, 'ts', '%.6f' % time.time())
+                pipe.hset(key, 'obj', payload)
+                pipe.sadd(server_id, key)
+                pipe.execute()
+        return key
+
+    def acknowledge(self, server_id, key):
+        for _, server in iteritems(self.redis.servers):
+            with server['conn'].pipeline(transaction=True) as pipe:
+                pipe.srem(server_id, key)
+                pipe.delete(key)
+                pipe.execute()

certlord/adapters/dns_policy.py

@@ -0,0 +1,120 @@
+# -*- coding: utf-8 -*-
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""DNS authorization policy, independent of HTTP and certificate storage."""
+import math
+import re
+import time
+
+import dns.exception
+import dns.resolver
+from six import iteritems
+from certlord.classes.exceptions import CertLordConfigError
+from certlord.classes.config import ALLOWED_DNS_RTYPE, DNS_RTYPE_CAA, DEFAULT_DNS_TIMEOUT
+DNS_RDATA_CAA_MATCH = re.compile(r'^\s*[0-9]+\s*issue\s*"(.+)"$', re.I).match
+
+class DnsPolicy(object):
+    def __init__(self, modconf, resolver=None):
+        self.modconf = modconf
+        try:
+            self.timeout = float(modconf.get('dns_timeout', DEFAULT_DNS_TIMEOUT))
+        except (TypeError, ValueError):
+            raise CertLordConfigError('DNS timeout must be finite and positive')
+        if isinstance(modconf.get('dns_timeout'), bool) or not math.isfinite(self.timeout) or self.timeout <= 0:
+            raise CertLordConfigError('DNS timeout must be finite and positive')
+        self.resolver = resolver if resolver is not None else dns.resolver.Resolver()
+        self._allow_dns_resolv = {}
+        self._expected_caa_rec = set()
+        self._load_allow_dns_resolv()
+        self._load_expected_caa_records()
+
+    def _load_allow_dns_resolv(self):
+        if not self.modconf.get('allow_dns_resolv'):
+            return
+
+        for rtype, rregex in iteritems(self.modconf['allow_dns_resolv']):
+            if rtype not in ALLOWED_DNS_RTYPE:
+                raise CertLordConfigError("invalid allow_dns_resolv type: %s" % rtype)
+
+            if rtype not in self._allow_dns_resolv:
+                self._allow_dns_resolv[rtype] = []
+
+            for r in rregex:
+                self._allow_dns_resolv[rtype].append(re.compile(r).match)
+
+            if not self._allow_dns_resolv[rtype]:
+                del self._allow_dns_resolv[rtype]
+
+
+    def _load_expected_caa_records(self):
+        if not self.modconf.get('expected_caa_records'):
+            return
+
+        for caa_entry in self.modconf['expected_caa_records']:
+            if caa_entry is None:
+                self._expected_caa_rec.add(None)
+            else:
+                self._expected_caa_rec.add(re.compile(caa_entry, re.I).match)
+
+
+    def _query(self, rname, rtype, deadline):
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            raise dns.exception.Timeout()
+        return self.resolver.query(rname, rtype, lifetime=remaining)
+
+    def check_dns_resolv(self, rname):
+        if not self._allow_dns_resolv:
+            return True
+
+        deadline = time.monotonic() + self.timeout
+        for rtype, rregex in iteritems(self._allow_dns_resolv):
+            try:
+                answers = self._query(rname, rtype, deadline)
+            except (dns.resolver.NoAnswer,
+                    dns.resolver.NXDOMAIN):
+                continue
+
+            for rdata in answers:
+                txt = rdata.to_text().rstrip('.')
+                for r in rregex:
+                    if r(txt):
+                        return True
+
+        return False
+
+
+    def check_caa_records(self, rname):
+        if not self._expected_caa_rec:
+            return True
+
+        rname_splitted = rname.split('.')
+        answers        = None
+        sdom           = rname
+
+        deadline = time.monotonic() + self.timeout
+        for i in range(0, len(rname_splitted)):
+            sdom = '.'.join(rname_splitted[i:])
+
+            try:
+                answers = self._query(sdom, DNS_RTYPE_CAA, deadline)
+            except (dns.resolver.NoAnswer,
+                    dns.resolver.NXDOMAIN):
+                continue
+            else:
+                break
+
+        if not answers:
+            return None in self._expected_caa_rec
+
+        for rregex in self._expected_caa_rec:
+            if rregex is None:
+                continue
+
+            for rdata in answers:
+                m = DNS_RDATA_CAA_MATCH(rdata.to_text())
+                if m and rregex(m.group(1)):
+                    return True
+
+        return False
+
+

certlord/adapters/issuance_command.py

@@ -0,0 +1,38 @@
+"""Bind the installed ACME HTTP connector to one issuance attempt."""
+import os
+from contextlib import contextmanager
+from pathlib import Path
+from tempfile import TemporaryDirectory
+
+import yaml
+from sonicprobe import helpers
+from certlord.classes.config import ISSUANCE_HEADER, CERTBOT_INSTALLER_CONFIG_OPTION, DEFAULT_INSTALLER_CONFIG
+
+
+@contextmanager
+def issuance_command(command, attempt):
+    args = list(command['args'])
+    env = command.get('env')
+    source = (env if env is not None else os.environ).get('CBT_HTTPREQ_INST_CONFIG', DEFAULT_INSTALLER_CONFIG)
+    for index, arg in enumerate(args):
+        if arg == CERTBOT_INSTALLER_CONFIG_OPTION:
+            if index + 1 >= len(args):
+                raise ValueError('Missing installer configuration path')
+            source = args[index + 1]
+        elif arg.startswith(CERTBOT_INSTALLER_CONFIG_OPTION + '='):
+            source = arg.split('=', 1)[1]
+    conf = helpers.load_conf_yaml_file(source)
+    if not isinstance(conf, dict):
+        raise ValueError('Invalid installer configuration')
+    deploy = conf.setdefault('deploy', {})
+    headers = deploy.setdefault('headers', {})
+    # Remove differently-cased copies before assigning the canonical header.
+    for name in list(headers):
+        if name.lower() == ISSUANCE_HEADER.lower():
+            del headers[name]
+    headers[ISSUANCE_HEADER] = attempt
+    with TemporaryDirectory(prefix='certlord-issuance-') as directory:
+        path = Path(directory) / 'installer.yml'
+        with open(path, 'x', opener=lambda name, flags: os.open(name, flags, 0o600)) as stream:
+            yaml.safe_dump(conf, stream)
+        yield args + [CERTBOT_INSTALLER_CONFIG_OPTION, str(path)], env

certlord/adapters/operations.py

@@ -0,0 +1,69 @@
+"""Bounded read-only observations of current Redis work, never queue repair."""
+import hashlib
+import json
+import math
+import re
+import time
+from certlord.services.certificate_ids import valid_certificate_id
+
+
+def operations_snapshot(redis, server_id, limit, max_retries):
+    if len(redis.servers) != 1:
+        raise ValueError('One authoritative Redis server required')
+    connection = next(iter(redis.servers.values()))['conn']
+    started = time.time()
+    pending = {'create': 0, 'renew': 0, 'delete': 0, 'invalid-dns': 0, 'other': 0}
+    retries = blocked = 0
+    seen = set()
+    for raw_key in connection.scan_iter(match='cert:*', count=100):
+        key = raw_key.decode() if isinstance(raw_key, bytes) else raw_key
+        if key in seen:
+            continue
+        seen.add(key)
+        if len(seen) > limit:
+            raise ValueError('Pending observation limit exceeded')
+        if not valid_certificate_id(key[5:]):
+            continue
+        raw = connection.get(raw_key)
+        if raw is None:
+            continue
+        records = json.loads(raw)['certs']
+        for record in records.values():
+            status = record.get('status')
+            pending[status if status in pending else 'other'] += 1
+            retry = record.get('retry', 0)
+            if type(retry) is not int or retry < 0:
+                raise ValueError('Invalid retry state')
+            if status in ('create', 'renew', 'delete'):
+                retries += retry
+                blocked += int(retry >= max_retries)
+    members = set()
+    oldest = None
+    missing = 0
+    for raw_key in connection.sscan_iter(server_id, count=100):
+        key = raw_key.decode() if isinstance(raw_key, bytes) else raw_key
+        if key in members:
+            continue
+        members.add(key)
+        if len(members) > limit:
+            raise ValueError('Deployment observation limit exceeded')
+        if not re.fullmatch(r'deploy:[0-9a-f]{64}', key):
+            raise ValueError('Invalid deployment queue key')
+        timestamp = connection.hget(raw_key, 'ts')
+        if timestamp is None:
+            missing += 1
+            continue
+        timestamp = float(timestamp)
+        if not math.isfinite(timestamp) or timestamp <= 0:
+            raise ValueError('Invalid deployment timestamp')
+        oldest = timestamp if oldest is None else min(oldest, timestamp)
+    lease_key = 'deployment-lock:' + hashlib.sha256(str(server_id).encode()).hexdigest()
+    ttl = connection.pttl(lease_key)
+    completed = time.time()
+    return {'started_timestamp_seconds': started, 'completed_timestamp_seconds': completed,
+            'pending_actions': pending, 'pending_retry_count': retries,
+            'pending_at_retry_limit': blocked, 'deployment_entries': len(members),
+            'deployment_missing_timestamps': missing,
+            'deployment_oldest_age_seconds': None if oldest is None else max(0, completed-oldest),
+            'deployment_lease_ttl_seconds': ttl/1000 if ttl >= 0 else None,
+            'deployment_lease_state': 'held' if ttl >= 0 else ('absent' if ttl == -2 else 'unbounded')}