From ca49dae1bb92ed67d03865529caaa7f9a57a4323 Mon Sep 17 00:00:00 2001
From: Eric Rakestraw <eric@rakestraw.us>
Date: Mon, 7 Sep 2026 19:09:09 +0000
Subject: [PATCH] Harden malformed Seriatim state recovery

---
 tasks/build.yml | 38 ++++++++++++++++++++++++++++++++++----
 1 file changed, 34 insertions(+), 4 deletions(-)

diff --git a/tasks/build.yml b/tasks/build.yml
index 357ea88..acab150 100644
--- a/tasks/build.yml
+++ b/tasks/build.yml
@@ -75,16 +75,38 @@
     path: "{{ seriatim_build_state_dir }}/binary.sha256"
   register: seriatim_checksum_state_stat
 
+- name: Remove malformed Seriatim build state objects
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: absent
+  loop:
+    - path: "{{ seriatim_build_state_dir }}/build-inputs.json"
+      exists: "{{ seriatim_build_inputs_state_stat.stat.exists }}"
+      is_regular: "{{ seriatim_build_inputs_state_stat.stat.isreg | default(false) }}"
+    - path: "{{ seriatim_build_state_dir }}/fingerprint.sha256"
+      exists: "{{ seriatim_fingerprint_state_stat.stat.exists }}"
+      is_regular: "{{ seriatim_fingerprint_state_stat.stat.isreg | default(false) }}"
+    - path: "{{ seriatim_build_state_dir }}/binary.sha256"
+      exists: "{{ seriatim_checksum_state_stat.stat.exists }}"
+      is_regular: "{{ seriatim_checksum_state_stat.stat.isreg | default(false) }}"
+  when:
+    - item.exists | bool
+    - not item.is_regular | bool
+
 - name: Read stored Seriatim fingerprint
   ansible.builtin.slurp:
     src: "{{ seriatim_build_state_dir }}/fingerprint.sha256"
   register: seriatim_stored_fingerprint_result
-  when: seriatim_fingerprint_state_stat.stat.exists
+  failed_when: false
+  when:
+    - seriatim_fingerprint_state_stat.stat.isreg | default(false)
+    - seriatim_fingerprint_state_stat.stat.readable | default(false)
 
 - name: Read stored Seriatim build inputs
   ansible.builtin.slurp:
     src: "{{ seriatim_build_state_dir }}/build-inputs.json"
   register: seriatim_stored_build_inputs_result
+  failed_when: false
   when:
     - seriatim_build_inputs_state_stat.stat.isreg | default(false)
     - seriatim_build_inputs_state_stat.stat.readable | default(false)
@@ -93,7 +115,10 @@
   ansible.builtin.slurp:
     src: "{{ seriatim_build_state_dir }}/binary.sha256"
   register: seriatim_stored_checksum_result
-  when: seriatim_checksum_state_stat.stat.exists
+  failed_when: false
+  when:
+    - seriatim_checksum_state_stat.stat.isreg | default(false)
+    - seriatim_checksum_state_stat.stat.readable | default(false)
 
 - name: Record stored Seriatim state values
   ansible.builtin.set_fact:
@@ -106,8 +131,13 @@
   when:
     - seriatim_build_inputs_state_stat.stat.isreg | default(false)
     - seriatim_build_inputs_state_stat.stat.readable | default(false)
-    - seriatim_fingerprint_state_stat.stat.exists
-    - seriatim_checksum_state_stat.stat.exists
+    - seriatim_fingerprint_state_stat.stat.isreg | default(false)
+    - seriatim_fingerprint_state_stat.stat.readable | default(false)
+    - seriatim_checksum_state_stat.stat.isreg | default(false)
+    - seriatim_checksum_state_stat.stat.readable | default(false)
+    - not (seriatim_stored_build_inputs_result.failed | default(true))
+    - not (seriatim_stored_fingerprint_result.failed | default(true))
+    - not (seriatim_stored_checksum_result.failed | default(true))
 
 - name: Read installed Seriatim version
   ansible.builtin.command: