dropbear-transport 0.1.1a1__tar.gz

dropbear_transport-0.1.1a1/.gitignore

@@ -0,0 +1,71 @@
+# macOS
+.DS_Store
+
+# Python
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+
+# Local caches (e.g. lerobot dataset + smoke-test artifacts)
+.cache/
+
+# Virtual environments
+.venv/
+venv/
+
+# Build and packaging output
+build/
+dist/
+*.egg-info/
+
+# Local environment files
+.env
+.env.*
+!.env.example
+
+# Logs
+*.log
+
+# Experiment note assets and generated analysis payloads
+sandbox/experiments/*/notes/assets/
+
+# Local scratch/checkouts
+tmp/
+.worktrees/
+.codex/*
+!.codex/skills/
+!.codex/skills/**
+
+# Root cleanup holding area for generated/non-product artifacts moved out of
+# the repository root.
+sandbox/.root-artifacts/
+
+# Phase 0 traces and generated infra state (now under sandbox/)
+sandbox/traces/*.jsonl
+sandbox/traces/*.csv
+sandbox/traces/*.parquet
+sandbox/traces/mtr/
+sandbox/experiments/*/runs/**/mtr-*.txt
+sandbox/experiments/*/runs/**/qlog/
+sandbox/infra/terraform/.terraform/
+# .terraform.lock.hcl is intentionally committed so the whole team pins identical
+# provider versions. State now lives in S3 (see sandbox/infra/terraform/backend.tf);
+# the local tfstate files below are stale artifacts and stay ignored.
+sandbox/infra/terraform/terraform.tfstate
+sandbox/infra/terraform/terraform.tfstate.backup
+sandbox/infra/terraform/tfplan
+sandbox/infra/certs/
+
+# Local model checkpoints
+sandbox/policies/flash/molmoact2-so101/MolmoAct2-SO100_101/
+.gstack/
+
+# Cold-start benchmark run outputs (raw per-iteration meta/ssm dumps + combined.json).
+# Commit a baseline report.md by hand if you want to keep it; runs/ is ephemeral.
+mvp/benchmarks/runs/
+mvp/e2e/runs/
+sandbox/benchmarks/runs/

dropbear_transport-0.1.1a1/LICENSE

@@ -0,0 +1,176 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and
+distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the
+copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other
+entities that control, are controlled by, or are under common control with
+that entity. For the purposes of this definition, "control" means (i) the
+power, direct or indirect, to cause the direction or management of such
+entity, whether by contract or otherwise, or (ii) ownership of fifty percent
+(50%) or more of the outstanding shares, or (iii) beneficial ownership of
+such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications,
+including but not limited to software source code, documentation source, and
+configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation
+or translation of a Source form, including but not limited to compiled object
+code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form,
+made available under the License, as indicated by a copyright notice that is
+included in or attached to the work (an example is provided in the Appendix
+below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form,
+that is based on (or derived from) the Work and for which the editorial
+revisions, annotations, elaborations, or other modifications represent, as a
+whole, an original work of authorship. For the purposes of this License,
+Derivative Works shall not include works that remain separable from, or
+merely link (or bind by name) to the interfaces of, the Work and Derivative
+Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original
+version of the Work and any modifications or additions to that Work or
+Derivative Works thereof, that is intentionally submitted to Licensor for
+inclusion in the Work by the copyright owner or by an individual or Legal
+Entity authorized to submit on behalf of the copyright owner. For the
+purposes of this definition, "submitted" means any form of electronic,
+verbal, or written communication sent to the Licensor or its representatives,
+including but not limited to communication on electronic mailing lists,
+source code control systems, and issue tracking systems that are managed by,
+or on behalf of, the Licensor for the purpose of discussing and improving the
+Work, but excluding communication that is conspicuously marked or otherwise
+designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on
+behalf of whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable copyright license to
+reproduce, prepare Derivative Works of, publicly display, publicly perform,
+sublicense, and distribute the Work and such Derivative Works in Source or
+Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this
+section) patent license to make, have made, use, offer to sell, sell, import,
+and otherwise transfer the Work, where such license applies only to those
+patent claims licensable by such Contributor that are necessarily infringed
+by their Contribution(s) alone or by combination of their Contribution(s)
+with the Work to which such Contribution(s) was submitted. If You institute
+patent litigation against any entity (including a cross-claim or counterclaim
+in a lawsuit) alleging that the Work or a Contribution incorporated within
+the Work constitutes direct or contributory patent infringement, then any
+patent licenses granted to You under this License for that Work shall
+terminate as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or
+Derivative Works thereof in any medium, with or without modifications, and in
+Source or Object form, provided that You meet the following conditions:
+
+(a) You must give any other recipients of the Work or Derivative Works a copy
+of this License; and
+
+(b) You must cause any modified files to carry prominent notices stating that
+You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works that You
+distribute, all copyright, patent, trademark, and attribution notices from the
+Source form of the Work, excluding those notices that do not pertain to any
+part of the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its distribution,
+then any Derivative Works that You distribute must include a readable copy of
+the attribution notices contained within such NOTICE file, excluding those
+notices that do not pertain to any part of the Derivative Works, in at least
+one of the following places: within a NOTICE text file distributed as part of
+the Derivative Works; within the Source form or documentation, if provided
+along with the Derivative Works; or, within a display generated by the
+Derivative Works, if and wherever such third-party notices normally appear.
+The contents of the NOTICE file are for informational purposes only and do
+not modify the License. You may add Your own attribution notices within
+Derivative Works that You distribute, alongside or as an addendum to the
+NOTICE text from the Work, provided that such additional attribution notices
+cannot be construed as modifying the License.
+
+You may add Your own copyright statement to Your modifications and may
+provide additional or different license terms and conditions for use,
+reproduction, or distribution of Your modifications, or for any such
+Derivative Works as a whole, provided Your use, reproduction, and distribution
+of the Work otherwise complies with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any
+Contribution intentionally submitted for inclusion in the Work by You to the
+Licensor shall be under the terms and conditions of this License, without any
+additional terms or conditions. Notwithstanding the above, nothing herein
+shall supersede or modify the terms of any separate license agreement you may
+have executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names,
+trademarks, service marks, or product names of the Licensor, except as
+required for reasonable and customary use in describing the origin of the
+Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in
+writing, Licensor provides the Work (and each Contributor provides its
+Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied, including, without limitation, any warranties
+or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+PARTICULAR PURPOSE. You are solely responsible for determining the
+appropriateness of using or redistributing the Work and assume any risks
+associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in
+tort (including negligence), contract, or otherwise, unless required by
+applicable law (such as deliberate and grossly negligent acts) or agreed to in
+writing, shall any Contributor be liable to You for damages, including any
+direct, indirect, special, incidental, or consequential damages of any
+character arising as a result of this License or out of the use or inability
+to use the Work (including but not limited to damages for loss of goodwill,
+work stoppage, computer failure or malfunction, or any and all other
+commercial damages or losses), even if such Contributor has been advised of
+the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work
+or Derivative Works thereof, You may choose to offer, and charge a fee for,
+acceptance of support, warranty, indemnity, or other liability obligations
+and/or rights consistent with this License. However, in accepting such
+obligations, You may act only on Your own behalf and on Your sole
+responsibility, not on behalf of any other Contributor, and only if You agree
+to indemnify, defend, and hold each Contributor harmless for any liability
+incurred by, or claims asserted against, such Contributor by reason of your
+accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+Copyright 2026 Dreamscale Labs
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

dropbear_transport-0.1.1a1/PKG-INFO

@@ -0,0 +1,38 @@
+Metadata-Version: 2.4
+Name: dropbear-transport
+Version: 0.1.1a1
+Summary: Dropbear QUIC data plane: pinned client, UDP preflight, multi-session worker server
+Project-URL: Homepage, https://dropbear.dreamscalelabs.com
+Project-URL: Documentation, https://dropbear.dreamscalelabs.com/docs
+Author: Dreamscale Labs
+License-Expression: Apache-2.0
+License-File: LICENSE
+Keywords: inference,quic,robotics,transport
+Classifier: Development Status :: 2 - Pre-Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Requires-Python: <3.13,>=3.12
+Requires-Dist: aioquic<2,>=1.2.0
+Requires-Dist: cryptography>=43.0.0
+Requires-Dist: numpy>=2.0.0
+Requires-Dist: pillow>=11.0.0
+Requires-Dist: pydantic>=2.9.0
+Requires-Dist: websockets>=14.0
+Description-Content-Type: text/markdown
+
+# dropbear-transport
+
+Shared QUIC transport primitives for Dropbear.
+
+This package contains the pinned QUIC client, multi-session worker server,
+wire-message models, JPEG/image helpers, and UDP preflight checks used by the
+SDK, worker, control plane, validation, and E2E packages.
+
+This is a pre-alpha implementation dependency of the public `dropbear`
+package. Most users should install `dropbear`, which selects the compatible
+transport version automatically; no independent transport API stability is
+promised before 1.0.
+
+Documentation: https://dropbear.dreamscalelabs.com/docs

dropbear_transport-0.1.1a1/README.md

@@ -0,0 +1,14 @@
+# dropbear-transport
+
+Shared QUIC transport primitives for Dropbear.
+
+This package contains the pinned QUIC client, multi-session worker server,
+wire-message models, JPEG/image helpers, and UDP preflight checks used by the
+SDK, worker, control plane, validation, and E2E packages.
+
+This is a pre-alpha implementation dependency of the public `dropbear`
+package. Most users should install `dropbear`, which selects the compatible
+transport version automatically; no independent transport API stability is
+promised before 1.0.
+
+Documentation: https://dropbear.dreamscalelabs.com/docs

dropbear_transport-0.1.1a1/pyproject.toml

@@ -0,0 +1,48 @@
+[project]
+name = "dropbear-transport"
+version = "0.1.1a1"
+description = "Dropbear QUIC data plane: pinned client, UDP preflight, multi-session worker server"
+readme = "README.md"
+requires-python = ">=3.12,<3.13"
+license = "Apache-2.0"
+license-files = ["LICENSE"]
+authors = [
+  { name = "Dreamscale Labs" },
+]
+classifiers = [
+  "Development Status :: 2 - Pre-Alpha",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: Apache Software License",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.12",
+]
+keywords = ["robotics", "quic", "inference", "transport"]
+dependencies = [
+  "aioquic>=1.2.0,<2",
+  "cryptography>=43.0.0",
+  "numpy>=2.0.0",
+  "pillow>=11.0.0",
+  "pydantic>=2.9.0",
+  "websockets>=14.0",
+]
+
+[project.urls]
+Homepage = "https://dropbear.dreamscalelabs.com"
+Documentation = "https://dropbear.dreamscalelabs.com/docs"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/dropbear_transport"]
+
+[tool.hatch.build.targets.sdist]
+only-include = [
+  "src/dropbear_transport",
+  "README.md",
+  "LICENSE",
+]
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"

dropbear_transport-0.1.1a1/src/dropbear_transport/__init__.py

@@ -0,0 +1,79 @@
+"""Dropbear QUIC data-plane transport (mvp/transport, epic C1).
+
+Binding public API per docs/plans/2026-06-10-dropbear-mvp-00-master.md:
+preflight(), QuicClient, MultiSessionQuicServer, plus the shared constants
+table and wire message models every other mvp/ package re-exports.
+"""
+
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("dropbear-transport")
+except PackageNotFoundError:  # Direct source import outside an installed environment.
+    __version__ = "0+unknown"
+
+from dropbear_transport import constants
+from dropbear_transport.certs import (
+    cert_file_fingerprint,
+    fingerprint_der_sha256,
+    write_self_signed_cert,
+)
+from dropbear_transport.client import QuicClient
+from dropbear_transport.errors import (
+    CertFingerprintMismatchError,
+    QuicRequestError,
+    TransportError,
+    error_payload,
+)
+from dropbear_transport.messages import (
+    PROTOCOL_VERSION,
+    Action,
+    ActionChunk,
+    CameraFrame,
+    Observation,
+    ObservationFrame,
+    RobotState,
+    RtcRequestContext,
+    RuntimeRequestContext,
+    RuntimeResponseMetadata,
+)
+from dropbear_transport.preflight import (
+    PreflightResult,
+    UdpReachabilityReason,
+    UdpReachabilityReport,
+    diagnose_udp,
+    preflight,
+)
+from dropbear_transport.relay_client import RelayClient
+from dropbear_transport.server import MultiSessionQuicServer, SessionStats
+
+__all__ = [
+    "Action",
+    "ActionChunk",
+    "CameraFrame",
+    "CertFingerprintMismatchError",
+    "MultiSessionQuicServer",
+    "Observation",
+    "ObservationFrame",
+    "PROTOCOL_VERSION",
+    "PreflightResult",
+    "QuicClient",
+    "QuicRequestError",
+    "RelayClient",
+    "RobotState",
+    "RtcRequestContext",
+    "RuntimeRequestContext",
+    "RuntimeResponseMetadata",
+    "SessionStats",
+    "TransportError",
+    "UdpReachabilityReport",
+    "UdpReachabilityReason",
+    "cert_file_fingerprint",
+    "constants",
+    "diagnose_udp",
+    "error_payload",
+    "fingerprint_der_sha256",
+    "preflight",
+    "write_self_signed_cert",
+    "__version__",
+]

dropbear_transport-0.1.1a1/src/dropbear_transport/bench.py

@@ -0,0 +1,158 @@
+"""Loopback latency micro-benchmark: ported client/server overhead, no inference.
+
+Compares against the sandbox phase0 stack (run separately in its own venv —
+e.g. `cd sandbox && uv run pytest tests/integration/test_local_quic_loop.py`,
+or its benchmark CLI). The full A3 GA re-run is owned by 07-validation.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import socket
+import tempfile
+import time
+from dataclasses import asdict, dataclass
+from pathlib import Path
+
+from dropbear_transport.certs import cert_file_fingerprint, write_self_signed_cert
+from dropbear_transport.client import QuicClient
+from dropbear_transport.messages import (
+    Action,
+    ActionChunk,
+    CameraFrame,
+    Observation,
+    ObservationFrame,
+    RobotState,
+)
+from dropbear_transport.server import MultiSessionQuicServer
+from dropbear_transport.time import monotonic_ns
+
+_SESSION_ID = "dropbear_sess_bench"
+_TOKEN = "bench-token"
+
+
+@dataclass(frozen=True)
+class BenchReport:
+    iterations: int
+    payload_bytes: int
+    cameras: int
+    connect_ms: float
+    rtt_ms_p50: float
+    rtt_ms_p95: float
+    rtt_ms_mean: float
+    rtt_ms_max: float
+
+    def as_dict(self) -> dict[str, float | int]:
+        return asdict(self)
+
+
+def _percentile(sorted_values: list[float], q: float) -> float:
+    index = min(len(sorted_values) - 1, max(0, round(q * (len(sorted_values) - 1))))
+    return sorted_values[index]
+
+
+def _unused_udp_port() -> int:
+    with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
+        sock.bind(("127.0.0.1", 0))
+        return sock.getsockname()[1]
+
+
+def _make_observation(observation_id: int, payload_bytes: int, cameras: int) -> Observation:
+    payload = b"\xab" * payload_bytes
+    camera_ids = [f"cam_{index}" for index in range(cameras)]
+    frame = ObservationFrame(
+        session_id=_SESSION_ID,
+        observation_id=observation_id,
+        capture_time_ns=monotonic_ns(),
+        send_time_ns=monotonic_ns(),
+        cameras=[
+            CameraFrame(
+                camera_id=camera_id,
+                width=640,
+                height=480,
+                encoding="jpeg",
+                payload_bytes=payload_bytes,
+            )
+            for camera_id in camera_ids
+        ],
+        robot_state=RobotState(
+            joint_positions=[0.0] * 6, joint_velocities=[0.0] * 6, gripper=0.5
+        ),
+        actions_remaining=0,
+        instruction="benchmark",
+    )
+    return Observation(
+        frame=frame,
+        camera_payloads={camera_id: payload for camera_id in camera_ids},
+        chunk_size=10,
+    )
+
+
+def _echo_chunk(observation: Observation) -> ActionChunk:
+    now = monotonic_ns()
+    return ActionChunk(
+        session_id=_SESSION_ID,
+        chunk_id=observation.frame.observation_id,
+        generated_from_observation_id=observation.frame.observation_id,
+        server_receive_time_ns=now,
+        inference_start_time_ns=now,
+        inference_end_time_ns=now,
+        server_send_time_ns=now,
+        actions=[Action(action_index=index, target=[0.0] * 6) for index in range(10)],
+    )
+
+
+async def run_loopback_bench(
+    iterations: int = 200,
+    warmup: int = 20,
+    payload_bytes: int = 20_000,
+    cameras: int = 1,
+) -> BenchReport:
+    with tempfile.TemporaryDirectory() as tmp:
+        cert_path, key_path = write_self_signed_cert(Path(tmp))
+        fingerprint = cert_file_fingerprint(cert_path)
+        port = _unused_udp_port()
+        server: MultiSessionQuicServer | None = None
+
+        async def on_observation(session_id: str, observation: Observation) -> None:
+            assert server is not None
+            await server.send_action_chunk(session_id, _echo_chunk(observation))
+
+        server = MultiSessionQuicServer(
+            port, cert_path, key_path, on_observation, host="127.0.0.1"
+        )
+        server.upsert_session(_SESSION_ID, _TOKEN, "bench-user", time.time() + 3_600)
+        async with server.run():
+            client = await QuicClient.connect(
+                "127.0.0.1",
+                port,
+                cert_fingerprint=fingerprint,
+                session_id=_SESSION_ID,
+                session_token=_TOKEN,
+            )
+            chunks = client.action_chunks()
+            rtts_ms: list[float] = []
+            for index in range(1, warmup + iterations + 1):
+                observation = _make_observation(index, payload_bytes, cameras)
+                start_ns = monotonic_ns()
+                await client.send_observation(observation)
+                while True:
+                    chunk = await asyncio.wait_for(anext(chunks), timeout=10)
+                    if chunk.generated_from_observation_id == index:
+                        break
+                rtt_ms = (monotonic_ns() - start_ns) / 1_000_000.0
+                if index > warmup:
+                    rtts_ms.append(rtt_ms)
+            connect_ms = client.connect_ms or 0.0
+            await client.close()
+        rtts_ms.sort()
+        return BenchReport(
+            iterations=iterations,
+            payload_bytes=payload_bytes,
+            cameras=cameras,
+            connect_ms=connect_ms,
+            rtt_ms_p50=_percentile(rtts_ms, 0.50),
+            rtt_ms_p95=_percentile(rtts_ms, 0.95),
+            rtt_ms_mean=sum(rtts_ms) / len(rtts_ms),
+            rtt_ms_max=rtts_ms[-1],
+        )

dropbear_transport-0.1.1a1/src/dropbear_transport/certs.py

@@ -0,0 +1,85 @@
+"""Self-signed cert minting + SHA-256(DER) fingerprint helpers.
+
+The worker mints one cert on first boot (10-year validity, persisted on EBS) and
+registers its fingerprint with the control plane; the SDK pins it post-handshake.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import ipaddress
+import os
+from datetime import UTC, datetime, timedelta
+from pathlib import Path
+
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.x509.oid import NameOID
+
+
+def write_self_signed_cert(
+    target_dir: Path,
+    *,
+    common_name: str = "dropbear-worker",
+    validity_days: int = 3650,
+) -> tuple[Path, Path]:
+    """Mint a self-signed cert + key as PEM files; returns (cert_path, key_path)."""
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    subject = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, common_name)])
+    now = datetime.now(UTC)
+    cert = (
+        x509.CertificateBuilder()
+        .subject_name(subject)
+        .issuer_name(subject)
+        .public_key(key.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(now - timedelta(minutes=1))
+        .not_valid_after(now + timedelta(days=validity_days))
+        .add_extension(
+            x509.SubjectAlternativeName(
+                [
+                    x509.DNSName("localhost"),
+                    x509.IPAddress(ipaddress.ip_address("127.0.0.1")),
+                    x509.IPAddress(ipaddress.ip_address("::1")),
+                ]
+            ),
+            critical=False,
+        )
+        .sign(key, hashes.SHA256())
+    )
+
+    target_dir.mkdir(mode=0o700, parents=True, exist_ok=True)
+    target_dir.chmod(0o700)
+    key_path = target_dir / "quic.key"
+    cert_path = target_dir / "quic.crt"
+    _write_private_key(
+        key_path,
+        key.private_bytes(
+            serialization.Encoding.PEM,
+            serialization.PrivateFormat.TraditionalOpenSSL,
+            serialization.NoEncryption(),
+        ),
+    )
+    cert_path.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
+    return cert_path, key_path
+
+
+def fingerprint_der_sha256(der: bytes) -> str:
+    """Hex SHA-256 of a DER-encoded certificate (the pinning format everywhere)."""
+    return hashlib.sha256(der).hexdigest()
+
+
+def cert_file_fingerprint(cert_path: Path) -> str:
+    """Fingerprint of a PEM cert file (what the worker registers over its WS)."""
+    cert = x509.load_pem_x509_certificate(cert_path.read_bytes())
+    return fingerprint_der_sha256(cert.public_bytes(serialization.Encoding.DER))
+
+
+def _write_private_key(path: Path, data: bytes) -> None:
+    if path.exists():
+        path.chmod(0o600)
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "wb") as key_file:
+        key_file.write(data)
+    path.chmod(0o600)