Install and configure Notarius

tasks/main.yml

@@ -0,0 +1,101 @@
+---
+- name: Validate the supported platform
+  ansible.builtin.assert:
+    that:
+      - ansible_facts.distribution == "Ubuntu"
+      - ansible_facts.distribution_version == "26.04"
+      - ansible_facts.architecture in ["x86_64", "aarch64"]
+    fail_msg: Notarius supports Ubuntu 26.04 on x86_64 or aarch64.
+
+- name: Install Git
+  become: true
+  ansible.builtin.apt:
+    name: git
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+  when: notarius_manage_build_dependencies
+
+- name: Install Go
+  become: true
+  community.general.snap:
+    name: go
+    channel: "{{ notarius_go_snap_channel }}"
+    classic: true
+    state: present
+  when: notarius_manage_build_dependencies
+
+- name: Create installation parent directories
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  loop:
+    - "{{ notarius_source_dir | dirname }}"
+    - "{{ notarius_binary_path | dirname }}"
+    - "{{ notarius_config_path | dirname }}"
+
+- name: Check out Notarius source
+  become: true
+  ansible.builtin.git:
+    repo: "{{ notarius_repository_url }}"
+    dest: "{{ notarius_source_dir }}"
+    version: "{{ notarius_version }}"
+    force: true
+  register: notarius_checkout
+
+- name: Inspect the installed binary
+  ansible.builtin.stat:
+    path: "{{ notarius_binary_path }}"
+  register: notarius_binary
+
+- name: Build Notarius
+  become: true
+  ansible.builtin.command:
+    argv:
+      - "{{ notarius_go_binary }}"
+      - build
+      - -trimpath
+      - -ldflags
+      - "-X gitea.maximumdirect.net/eric/notarius/internal/buildinfo.Override={{ notarius_version }}"
+      - -o
+      - "{{ notarius_binary_path }}"
+      - ./cmd/notarius
+    chdir: "{{ notarius_source_dir }}"
+  environment:
+    CGO_ENABLED: "0"
+    GOTOOLCHAIN: local
+    GOWORK: "off"
+  changed_when: true
+  when: >-
+    notarius_checkout.changed or
+    not notarius_binary.stat.exists
+
+- name: Converge installed metadata
+  become: true
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: "{{ item.state }}"
+    owner: root
+    group: root
+    mode: "{{ item.mode | default(omit) }}"
+    recurse: "{{ item.recurse | default(omit) }}"
+  loop:
+    - path: "{{ notarius_source_dir }}"
+      state: directory
+      recurse: true
+    - path: "{{ notarius_binary_path }}"
+      state: file
+      mode: "0755"
+
+- name: Write Notarius configuration
+  become: true
+  ansible.builtin.template:
+    src: config.yml.j2
+    dest: "{{ notarius_config_path }}"
+    owner: root
+    group: root
+    mode: "0644"