From f2c1b1aa892f230cd61d4aa7be052b8b68519c96 Mon Sep 17 00:00:00 2001
From: Eric Rakestraw <eric@rakestraw.us>
Date: Mon, 7 Sep 2026 18:54:47 +0000
Subject: [PATCH] Repair Seriatim ownership and permission drift

---
 tasks/build.yml   | 36 ++++++++++++++++++++++++++++++++++++
 tests/integration | 12 ++++++++++++
 tests/verify.yml  | 14 ++++++++++++++
 3 files changed, 62 insertions(+)

diff --git a/tasks/build.yml b/tasks/build.yml
index 0b6b9c6..fa1089b 100644
--- a/tasks/build.yml
+++ b/tasks/build.yml
@@ -30,6 +30,14 @@
     checksum_algorithm: sha256
   register: seriatim_installed_binary_stat
 
+- name: Require a regular installed Seriatim binary path
+  ansible.builtin.assert:
+    that:
+      - not seriatim_installed_binary_stat.stat.exists or seriatim_installed_binary_stat.stat.isreg
+    fail_msg: >-
+      Seriatim binary path exists but is not a regular file:
+      {{ seriatim_binary_path }}. Move the unexpected object before rerunning the role.
+
 - name: Inspect Seriatim build input state
   ansible.builtin.stat:
     path: "{{ seriatim_build_state_dir }}/build-inputs.json"
@@ -203,3 +211,31 @@
         path: "{{ seriatim_build_tempdir.path }}"
         state: absent
       when: seriatim_build_tempdir.path is defined
+
+- name: Converge installed Seriatim binary metadata
+  ansible.builtin.file:
+    path: "{{ seriatim_binary_path }}"
+    state: file
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Converge Seriatim build state directory metadata
+  ansible.builtin.file:
+    path: "{{ seriatim_build_state_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Converge Seriatim build state file metadata
+  ansible.builtin.file:
+    path: "{{ seriatim_build_state_dir }}/{{ item }}"
+    state: file
+    owner: root
+    group: root
+    mode: "0644"
+  loop:
+    - build-inputs.json
+    - fingerprint.sha256
+    - binary.sha256
diff --git a/tests/integration b/tests/integration
index e9cb4b1..db973bf 100755
--- a/tests/integration
+++ b/tests/integration
@@ -66,6 +66,18 @@ require_changed_recap "$test_tmp/build-input-repair.log"
 run_converge | tee "$test_tmp/build-input-repair-repeat.log"
 require_clean_recap "$test_tmp/build-input-repair-repeat.log"
 
+sudo chown "$(id -u):$(id -g)" /usr/local/bin/seriatim
+sudo chmod 0777 /usr/local/bin/seriatim
+sudo chown "$(id -u):$(id -g)" /usr/local/src/seriatim.ansible-build-state
+sudo chmod 0700 /usr/local/src/seriatim.ansible-build-state
+sudo chown "$(id -u):$(id -g)" /usr/local/src/seriatim.ansible-build-state/*
+sudo chmod 0600 /usr/local/src/seriatim.ansible-build-state/*
+run_converge | tee "$test_tmp/metadata-repair.log"
+require_changed_recap "$test_tmp/metadata-repair.log"
+"$playbook" -i "$inventory" tests/verify.yml
+run_converge | tee "$test_tmp/metadata-repair-repeat.log"
+require_clean_recap "$test_tmp/metadata-repair-repeat.log"
+
 baseline_binary=$(binary_digest)
 baseline_state=$(state_digest)
 for scenario in \
diff --git a/tests/verify.yml b/tests/verify.yml
index b471c11..d17ca6f 100644
--- a/tests/verify.yml
+++ b/tests/verify.yml
@@ -26,6 +26,15 @@
         path: "{{ seriatim_verify_state_dir }}"
       register: seriatim_verify_state_stat
 
+    - name: Inspect Seriatim build state files
+      ansible.builtin.stat:
+        path: "{{ seriatim_verify_state_dir }}/{{ item }}"
+      loop:
+        - build-inputs.json
+        - fingerprint.sha256
+        - binary.sha256
+      register: seriatim_verify_state_file_stats
+
     - name: Resolve installed Seriatim source commit
       ansible.builtin.command:
         argv:
@@ -89,6 +98,11 @@
           - seriatim_verify_state_stat.stat.isdir
           - seriatim_verify_state_stat.stat.pw_name == 'root'
           - seriatim_verify_state_stat.stat.gr_name == 'root'
+          - seriatim_verify_state_stat.stat.mode == '0755'
+          - seriatim_verify_state_file_stats.results | map(attribute='stat.isreg') | unique | list == [true]
+          - seriatim_verify_state_file_stats.results | map(attribute='stat.pw_name') | unique | list == ['root']
+          - seriatim_verify_state_file_stats.results | map(attribute='stat.gr_name') | unique | list == ['root']
+          - seriatim_verify_state_file_stats.results | map(attribute='stat.mode') | unique | list == ['0644']
           - seriatim_verify_commit.stdout == seriatim_expected_commit
           - seriatim_verify_source_status.stdout == ''
           - seriatim_verify_version.stdout == 'seriatim version ' ~ seriatim_expected_version