test: verify Seriatim source installation

tests/verify.yml

@@ -0,0 +1,97 @@
+---
+- name: Verify Seriatim installation
+  hosts: seriatim
+  gather_facts: true
+  become: true
+  vars:
+    seriatim_expected_commit: 0fc92f364316c874d366b00cdc884a33e1900b25
+    seriatim_expected_version: v1.5.0
+    seriatim_verify_source_dir: /usr/local/src/seriatim
+    seriatim_verify_binary_path: /usr/local/bin/seriatim
+    seriatim_verify_state_dir: /usr/local/src/seriatim.ansible-build-state
+  tasks:
+    - name: Inspect Seriatim source directory
+      ansible.builtin.stat:
+        path: "{{ seriatim_verify_source_dir }}"
+      register: seriatim_verify_source_stat
+
+    - name: Inspect installed Seriatim binary
+      ansible.builtin.stat:
+        path: "{{ seriatim_verify_binary_path }}"
+        checksum_algorithm: sha256
+      register: seriatim_verify_binary_stat
+
+    - name: Inspect Seriatim build state directory
+      ansible.builtin.stat:
+        path: "{{ seriatim_verify_state_dir }}"
+      register: seriatim_verify_state_stat
+
+    - name: Resolve installed Seriatim source commit
+      ansible.builtin.command:
+        argv:
+          - /usr/bin/git
+          - -C
+          - "{{ seriatim_verify_source_dir }}"
+          - rev-parse
+          - HEAD
+      register: seriatim_verify_commit
+      changed_when: false
+
+    - name: Inspect installed Seriatim source cleanliness
+      ansible.builtin.command:
+        argv:
+          - /usr/bin/git
+          - -C
+          - "{{ seriatim_verify_source_dir }}"
+          - status
+          - --porcelain
+          - --untracked-files=all
+          - --ignored
+      register: seriatim_verify_source_status
+      changed_when: false
+
+    - name: Read installed Seriatim version
+      ansible.builtin.command:
+        argv:
+          - "{{ seriatim_verify_binary_path }}"
+          - --version
+      register: seriatim_verify_version
+      changed_when: false
+
+    - name: Read stored Seriatim build inputs
+      ansible.builtin.slurp:
+        src: "{{ seriatim_verify_state_dir }}/build-inputs.json"
+      register: seriatim_verify_inputs
+
+    - name: Read stored Seriatim fingerprint
+      ansible.builtin.slurp:
+        src: "{{ seriatim_verify_state_dir }}/fingerprint.sha256"
+      register: seriatim_verify_fingerprint
+
+    - name: Read stored Seriatim checksum
+      ansible.builtin.slurp:
+        src: "{{ seriatim_verify_state_dir }}/binary.sha256"
+      register: seriatim_verify_checksum
+
+    - name: Require valid Seriatim installation state
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.distribution == 'Ubuntu'
+          - ansible_facts.distribution_version is version('26.04', '==')
+          - ansible_facts.architecture in ['x86_64', 'aarch64']
+          - seriatim_verify_source_stat.stat.isdir
+          - seriatim_verify_source_stat.stat.pw_name == 'root'
+          - seriatim_verify_source_stat.stat.gr_name == 'root'
+          - seriatim_verify_binary_stat.stat.isreg
+          - seriatim_verify_binary_stat.stat.pw_name == 'root'
+          - seriatim_verify_binary_stat.stat.gr_name == 'root'
+          - seriatim_verify_binary_stat.stat.mode == '0755'
+          - seriatim_verify_state_stat.stat.isdir
+          - seriatim_verify_state_stat.stat.pw_name == 'root'
+          - seriatim_verify_state_stat.stat.gr_name == 'root'
+          - seriatim_verify_commit.stdout == seriatim_expected_commit
+          - seriatim_verify_source_status.stdout == ''
+          - seriatim_verify_version.stdout == 'seriatim version ' ~ seriatim_expected_version
+          - (seriatim_verify_inputs.content | b64decode | trim | hash('sha256')) == (seriatim_verify_fingerprint.content | b64decode | trim)
+          - seriatim_verify_binary_stat.stat.checksum == (seriatim_verify_checksum.content | b64decode | trim)
+        fail_msg: Installed Seriatim source, binary, or build state is inconsistent.