feat: securely prepare verification roots

harness/lib/managed_lock_broker.py

@@ -191,7 +191,9 @@ class Broker:
         self.token = secrets.token_hex(32)
         self.deadline = time.monotonic() + args.ttl_seconds
         self.set = ManagedLockSet.for_issue(self.root, args.owner, args.repository, args.issue, timeout=args.acquire_timeout)
-        self.meta = {"owner": args.owner, "repository": args.repository, "issue": args.issue, "role": args.role, "run_id": args.run_id, "pid": os.getpid(), "deadline": self.deadline}
+        self.meta = {"root": str(self.root), "owner": args.owner, "repository": args.repository,
+                     "issue": args.issue, "role": args.role, "run_id": args.run_id,
+                     "pid": os.getpid(), "deadline": self.deadline}
         self.state = {**self.meta, "socket": str(self.sock_path), "status": "held", "token": self.token}
         self.server: socket.socket | None = None
         self.socket_identity: tuple[int, int] | None = None
@@ -274,7 +276,7 @@ class Broker:
         action = req.get("action")
         if action == "status":
             return {"status": self.state["status"], "deadline": self.deadline,
-                    "repository_held": self.set.repository.held,
+                    "repository_held": self.set.repository.held, "root": self.state["root"],
                     "owner": self.state["owner"], "repository": self.state["repository"],
                     "issue": self.state["issue"], "role": self.state["role"],
                     "pid": self.state["pid"]}