Simplify the Seriatim role

tests/verify.yml

@@ -1,111 +1,73 @@
 ---
-- name: Verify Seriatim installation
-  hosts: seriatim
-  gather_facts: true
+- name: Verify the Seriatim installation
+  hosts: localhost
+  connection: local
+  gather_facts: false
   become: true
   vars:
     seriatim_expected_commit: 0fc92f364316c874d366b00cdc884a33e1900b25
     seriatim_expected_version: v1.5.0
-    seriatim_verify_source_dir: /usr/local/src/seriatim
-    seriatim_verify_binary_path: /usr/local/bin/seriatim
-    seriatim_verify_state_dir: /usr/local/src/seriatim.ansible-build-state
+    seriatim_source_dir: /usr/local/src/seriatim
+    seriatim_binary_path: /usr/local/bin/seriatim
   tasks:
-    - name: Inspect Seriatim source directory
+    - name: Inspect the source directory
       ansible.builtin.stat:
-        path: "{{ seriatim_verify_source_dir }}"
-      register: seriatim_verify_source_stat
+        path: "{{ seriatim_source_dir }}"
+      register: seriatim_source
 
-    - name: Inspect installed Seriatim binary
-      ansible.builtin.stat:
-        path: "{{ seriatim_verify_binary_path }}"
-        checksum_algorithm: sha256
-      register: seriatim_verify_binary_stat
-
-    - name: Inspect Seriatim build state directory
-      ansible.builtin.stat:
-        path: "{{ seriatim_verify_state_dir }}"
-      register: seriatim_verify_state_stat
-
-    - name: Inspect Seriatim build state files
-      ansible.builtin.stat:
-        path: "{{ seriatim_verify_state_dir }}/{{ item }}"
-      loop:
-        - build-inputs.json
-        - fingerprint.sha256
-        - binary.sha256
-      register: seriatim_verify_state_file_stats
-
-    - name: Resolve installed Seriatim source commit
+    - name: Find incorrectly owned source entries
       ansible.builtin.command:
         argv:
-          - /usr/bin/git
+          - find
+          - "{{ seriatim_source_dir }}"
+          - (
+          - -not
+          - -user
+          - root
+          - -or
+          - -not
+          - -group
+          - root
+          - )
+          - -print
+          - -quit
+      register: seriatim_source_ownership
+      changed_when: false
+
+    - name: Read the selected source commit
+      ansible.builtin.command:
+        argv:
+          - git
           - -C
-          - "{{ seriatim_verify_source_dir }}"
+          - "{{ seriatim_source_dir }}"
           - rev-parse
           - HEAD
-      register: seriatim_verify_commit
+      register: seriatim_source_commit
       changed_when: false
 
-    - name: Inspect installed Seriatim source cleanliness
-      ansible.builtin.command:
-        argv:
-          - /usr/bin/git
-          - -C
-          - "{{ seriatim_verify_source_dir }}"
-          - status
-          - --porcelain
-          - --untracked-files=all
-          - --ignored
-      register: seriatim_verify_source_status
-      changed_when: false
+    - name: Inspect the installed binary
+      ansible.builtin.stat:
+        path: "{{ seriatim_binary_path }}"
+      register: seriatim_binary
 
-    - name: Read installed Seriatim version
+    - name: Read the installed version
       ansible.builtin.command:
         argv:
-          - "{{ seriatim_verify_binary_path }}"
+          - "{{ seriatim_binary_path }}"
           - --version
-      register: seriatim_verify_version
+      register: seriatim_version_output
       changed_when: false
 
-    - name: Read stored Seriatim build inputs
-      ansible.builtin.slurp:
-        src: "{{ seriatim_verify_state_dir }}/build-inputs.json"
-      register: seriatim_verify_inputs
-
-    - name: Read stored Seriatim fingerprint
-      ansible.builtin.slurp:
-        src: "{{ seriatim_verify_state_dir }}/fingerprint.sha256"
-      register: seriatim_verify_fingerprint
-
-    - name: Read stored Seriatim checksum
-      ansible.builtin.slurp:
-        src: "{{ seriatim_verify_state_dir }}/binary.sha256"
-      register: seriatim_verify_checksum
-
-    - name: Require valid Seriatim installation state
+    - name: Assert the installation contract
       ansible.builtin.assert:
         that:
-          - ansible_facts.distribution == 'Ubuntu'
-          - ansible_facts.distribution_version is version('26.04', '==')
-          - ansible_facts.architecture in ['x86_64', 'aarch64']
-          - seriatim_verify_source_stat.stat.isdir
-          - seriatim_verify_source_stat.stat.pw_name == 'root'
-          - seriatim_verify_source_stat.stat.gr_name == 'root'
-          - seriatim_verify_binary_stat.stat.isreg
-          - seriatim_verify_binary_stat.stat.pw_name == 'root'
-          - seriatim_verify_binary_stat.stat.gr_name == 'root'
-          - seriatim_verify_binary_stat.stat.mode == '0755'
-          - seriatim_verify_state_stat.stat.isdir
-          - seriatim_verify_state_stat.stat.pw_name == 'root'
-          - seriatim_verify_state_stat.stat.gr_name == 'root'
-          - seriatim_verify_state_stat.stat.mode == '0755'
-          - seriatim_verify_state_file_stats.results | map(attribute='stat.isreg') | unique | list == [true]
-          - seriatim_verify_state_file_stats.results | map(attribute='stat.pw_name') | unique | list == ['root']
-          - seriatim_verify_state_file_stats.results | map(attribute='stat.gr_name') | unique | list == ['root']
-          - seriatim_verify_state_file_stats.results | map(attribute='stat.mode') | unique | list == ['0644']
-          - seriatim_verify_commit.stdout == seriatim_expected_commit
-          - seriatim_verify_source_status.stdout == ''
-          - seriatim_verify_version.stdout == 'seriatim version ' ~ seriatim_expected_version
-          - (seriatim_verify_inputs.content | b64decode | trim | hash('sha256')) == (seriatim_verify_fingerprint.content | b64decode | trim)
-          - seriatim_verify_binary_stat.stat.checksum == (seriatim_verify_checksum.content | b64decode | trim)
-        fail_msg: Installed Seriatim source, binary, or build state is inconsistent.
+          - seriatim_source.stat.isdir
+          - seriatim_source.stat.pw_name == "root"
+          - seriatim_source.stat.gr_name == "root"
+          - seriatim_source_ownership.stdout == ""
+          - seriatim_source_commit.stdout == seriatim_expected_commit
+          - seriatim_binary.stat.isreg
+          - seriatim_binary.stat.pw_name == "root"
+          - seriatim_binary.stat.gr_name == "root"
+          - seriatim_binary.stat.mode == "0755"
+          - seriatim_version_output.stdout == "seriatim version " ~ seriatim_expected_version