Repair Seriatim ownership and permission drift

tests/integration

@@ -66,6 +66,18 @@ require_changed_recap "$test_tmp/build-input-repair.log"
 run_converge | tee "$test_tmp/build-input-repair-repeat.log"
 require_clean_recap "$test_tmp/build-input-repair-repeat.log"
 
+sudo chown "$(id -u):$(id -g)" /usr/local/bin/seriatim
+sudo chmod 0777 /usr/local/bin/seriatim
+sudo chown "$(id -u):$(id -g)" /usr/local/src/seriatim.ansible-build-state
+sudo chmod 0700 /usr/local/src/seriatim.ansible-build-state
+sudo chown "$(id -u):$(id -g)" /usr/local/src/seriatim.ansible-build-state/*
+sudo chmod 0600 /usr/local/src/seriatim.ansible-build-state/*
+run_converge | tee "$test_tmp/metadata-repair.log"
+require_changed_recap "$test_tmp/metadata-repair.log"
+"$playbook" -i "$inventory" tests/verify.yml
+run_converge | tee "$test_tmp/metadata-repair-repeat.log"
+require_clean_recap "$test_tmp/metadata-repair-repeat.log"
+
 baseline_binary=$(binary_digest)
 baseline_state=$(state_digest)
 for scenario in \

tests/verify.yml

@@ -26,6 +26,15 @@
         path: "{{ seriatim_verify_state_dir }}"
       register: seriatim_verify_state_stat
 
+    - name: Inspect Seriatim build state files
+      ansible.builtin.stat:
+        path: "{{ seriatim_verify_state_dir }}/{{ item }}"
+      loop:
+        - build-inputs.json
+        - fingerprint.sha256
+        - binary.sha256
+      register: seriatim_verify_state_file_stats
+
     - name: Resolve installed Seriatim source commit
       ansible.builtin.command:
         argv:
@@ -89,6 +98,11 @@
           - seriatim_verify_state_stat.stat.isdir
           - seriatim_verify_state_stat.stat.pw_name == 'root'
           - seriatim_verify_state_stat.stat.gr_name == 'root'
+          - seriatim_verify_state_stat.stat.mode == '0755'
+          - seriatim_verify_state_file_stats.results | map(attribute='stat.isreg') | unique | list == [true]
+          - seriatim_verify_state_file_stats.results | map(attribute='stat.pw_name') | unique | list == ['root']
+          - seriatim_verify_state_file_stats.results | map(attribute='stat.gr_name') | unique | list == ['root']
+          - seriatim_verify_state_file_stats.results | map(attribute='stat.mode') | unique | list == ['0644']
           - seriatim_verify_commit.stdout == seriatim_expected_commit
           - seriatim_verify_source_status.stdout == ''
           - seriatim_verify_version.stdout == 'seriatim version ' ~ seriatim_expected_version