Install and configure Notarius

tests/converge.yml

@@ -0,0 +1,6 @@
+---
+- name: Converge Notarius role
+  hosts: localhost
+  gather_facts: true
+  roles:
+    - role: ansible-role-notarius

tests/integration

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repository_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+workspace_venv="$repository_root/../.venv"
+test_tmp=$(mktemp -d)
+chmod 0700 "$test_tmp"
+
+export ANSIBLE_COLLECTIONS_PATH="$test_tmp/collections"
+export ANSIBLE_ROLES_PATH="$(dirname "$repository_root")"
+
+inventory="$repository_root/tests/inventory"
+converge="$repository_root/tests/converge.yml"
+verify="$repository_root/tests/verify.yml"
+ansible_playbook="$workspace_venv/bin/ansible-playbook"
+default_commit=77ae132e5609916da40dcd4fcc749c000a63cbac
+
+cleanup() {
+  exit_status=$?
+  trap - EXIT
+  "$ansible_playbook" -i "$inventory" "$converge" >/dev/null 2>&1 || true
+  rm -rf -- "$test_tmp"
+  exit "$exit_status"
+}
+trap cleanup EXIT
+
+require_clean_recap() {
+  grep -Eq 'changed=0 .*failed=0' "$1"
+}
+
+cd "$repository_root"
+"$workspace_venv/bin/ansible-galaxy" collection install \
+  -r collections/requirements.yml \
+  -p "$ANSIBLE_COLLECTIONS_PATH"
+"$ansible_playbook" -i "$inventory" --syntax-check "$converge"
+"$workspace_venv/bin/ansible-lint" "$converge" "$verify"
+
+baseline_log="$test_tmp/baseline.log"
+"$ansible_playbook" -i "$inventory" "$converge" | tee "$baseline_log"
+"$ansible_playbook" -i "$inventory" \
+  -e "notarius_expected_version=v0.6.0" \
+  -e "notarius_expected_commit=$default_commit" \
+  "$verify"
+repeat_log="$test_tmp/repeat.log"
+"$ansible_playbook" -i "$inventory" "$converge" | tee "$repeat_log"
+require_clean_recap "$repeat_log"

tests/inventory

@@ -0,0 +1 @@
+localhost ansible_connection=local

tests/verify.yml

@@ -0,0 +1,83 @@
+---
+- name: Verify Notarius installation
+  hosts: localhost
+  gather_facts: false
+  tasks:
+    - name: Read the selected source commit
+      become: true
+      ansible.builtin.command:
+        argv:
+          - git
+          - -C
+          - /usr/local/src/notarius
+          - rev-parse
+          - HEAD
+      register: notarius_commit
+      changed_when: false
+
+    - name: Inspect source ownership
+      become: true
+      ansible.builtin.command:
+        argv:
+          - find
+          - /usr/local/src/notarius
+          - -not
+          - -user
+          - root
+          - -o
+          - -not
+          - -group
+          - root
+      register: notarius_source_ownership
+      changed_when: false
+
+    - name: Inspect binary metadata
+      become: true
+      ansible.builtin.stat:
+        path: /usr/local/bin/notarius
+      register: notarius_binary_metadata
+
+    - name: Inspect configuration metadata
+      become: true
+      ansible.builtin.stat:
+        path: /usr/local/etc/notarius/config.yml
+      register: notarius_config_metadata
+
+    - name: Read default configuration
+      become: true
+      ansible.builtin.slurp:
+        src: /usr/local/etc/notarius/config.yml
+      register: notarius_default_config
+
+    - name: Read the installed version
+      ansible.builtin.command:
+        argv:
+          - /usr/local/bin/notarius
+          - --version
+      register: notarius_version_output
+      changed_when: false
+
+    - name: Validate Notarius configuration
+      ansible.builtin.command:
+        argv:
+          - /usr/local/bin/notarius
+          - config
+          - validate
+          - --config
+          - /usr/local/etc/notarius/config.yml
+      changed_when: false
+
+    - name: Assert the installation contract
+      ansible.builtin.assert:
+        that:
+          - notarius_commit.stdout == notarius_expected_commit
+          - notarius_source_ownership.stdout == ""
+          - notarius_binary_metadata.stat.isreg
+          - notarius_binary_metadata.stat.pw_name == "root"
+          - notarius_binary_metadata.stat.gr_name == "root"
+          - notarius_binary_metadata.stat.mode == "0755"
+          - notarius_config_metadata.stat.pw_name == "root"
+          - notarius_config_metadata.stat.gr_name == "root"
+          - notarius_config_metadata.stat.mode == "0644"
+          - '(notarius_default_config.content | b64decode | from_yaml) == {"version": 4}'
+          - notarius_version_output.stdout == "notarius " ~ notarius_expected_version