diff --git a/README.md b/README.md index a5009ef..409706f 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,8 @@ Installs [Seriatim](https://gitea.maximumdirect.net/eric/seriatim) from source on Ubuntu 26.04 (`x86_64` or `aarch64`). The role requires gathered facts and -privilege escalation for its default paths and dependency installation. +uses privilege escalation on tasks that install dependencies or manage +root-owned application state. ## Variables @@ -13,18 +14,21 @@ seriatim_source_dir: /usr/local/src/seriatim seriatim_binary_path: /usr/local/bin/seriatim seriatim_manage_build_dependencies: true seriatim_go_snap_channel: 1.26/stable +seriatim_go_binary: /snap/bin/go ``` -When `seriatim_manage_build_dependencies` is `false`, Git and `/snap/bin/go` -must already be available. Otherwise, the role installs Git with APT and the -classic Go Snap from `seriatim_go_snap_channel`. +When `seriatim_manage_build_dependencies` is `false`, Git and the executable +selected by `seriatim_go_binary` must already be available. Otherwise, the role +installs Git with APT and the classic Go Snap from +`seriatim_go_snap_channel`. The checkout is authoritative: local source changes are discarded while selecting `seriatim_version`. The role builds `./cmd/seriatim` directly to -`seriatim_binary_path` using `/snap/bin/go`, `CGO_ENABLED=0`, `GOWORK=off`, +`seriatim_binary_path` using `seriatim_go_binary`, `CGO_ENABLED=0`, `GOWORK=off`, `GOTOOLCHAIN=local`, `-trimpath`, and release linker metadata. It rebuilds when -the checkout changes, the binary is absent, or `seriatim --version` does not -exactly match the selected version. +the checkout changes or the binary is absent. Exact version output is verified +by the repository-local integration suite rather than during production +convergence. The source tree is recursively owned by `root:root`. The installed binary is a regular file owned by `root:root` with mode `0755`. @@ -33,7 +37,6 @@ regular file owned by `root:root` with mode `0755`. ```yaml - hosts: seriatim_hosts - become: true roles: - role: ansible-role-seriatim ``` @@ -42,12 +45,12 @@ regular file owned by `root:root` with mode `0755`. The integration driver installs pinned collection dependencies, runs syntax checking and ansible-lint, and verifies the default release and idempotence. It -also covers missing and wrong-version binaries, metadata drift without a -rebuild, selection of the previous release, restoration of the default -release, and platform failures before application state is created. The suite -mutates only `/usr/local/src/seriatim`, `/usr/local/bin/seriatim`, and paths -inside its private temporary directory, and leaves the default release -installed: +also covers a missing binary, a caller-supplied Go executable with dependency +management disabled, metadata drift without a build, selection of the previous +release, restoration of the default release, and platform failures before +application state is created. The suite mutates only +`/usr/local/src/seriatim`, `/usr/local/bin/seriatim`, and paths inside its +private temporary directory, and leaves the default release installed: ```sh tests/integration diff --git a/defaults/main.yml b/defaults/main.yml index 770f20b..7403290 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -5,3 +5,4 @@ seriatim_source_dir: /usr/local/src/seriatim seriatim_binary_path: /usr/local/bin/seriatim seriatim_manage_build_dependencies: true seriatim_go_snap_channel: 1.26/stable +seriatim_go_binary: /snap/bin/go diff --git a/meta/argument_specs.yml b/meta/argument_specs.yml index 0ca9d48..1b96f1a 100644 --- a/meta/argument_specs.yml +++ b/meta/argument_specs.yml @@ -27,3 +27,7 @@ argument_specs: type: str required: true description: Go Snap channel to install. + seriatim_go_binary: + type: path + required: true + description: Go executable used to build Seriatim. diff --git a/tasks/main.yml b/tasks/main.yml index 680cc0d..82056d0 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -8,13 +8,16 @@ fail_msg: Seriatim supports Ubuntu 26.04 on x86_64 or aarch64. - name: Install Git + become: true ansible.builtin.apt: name: git state: present update_cache: true + cache_valid_time: 3600 when: seriatim_manage_build_dependencies - name: Install Go + become: true community.general.snap: name: go channel: "{{ seriatim_go_snap_channel }}" @@ -23,6 +26,7 @@ when: seriatim_manage_build_dependencies - name: Create installation parent directories + become: true ansible.builtin.file: path: "{{ item }}" state: directory @@ -34,6 +38,7 @@ - "{{ seriatim_binary_path | dirname }}" - name: Check out Seriatim source + become: true ansible.builtin.git: repo: "{{ seriatim_repository_url }}" dest: "{{ seriatim_source_dir }}" @@ -46,20 +51,11 @@ path: "{{ seriatim_binary_path }}" register: seriatim_binary -- name: Read the installed Seriatim version - ansible.builtin.command: - argv: - - "{{ seriatim_binary_path }}" - - --version - register: seriatim_installed_version - changed_when: false - failed_when: false - when: seriatim_binary.stat.exists - - name: Build Seriatim + become: true ansible.builtin.command: argv: - - /snap/bin/go + - "{{ seriatim_go_binary }}" - build - -trimpath - -ldflags @@ -72,15 +68,13 @@ CGO_ENABLED: "0" GOTOOLCHAIN: local GOWORK: "off" - register: seriatim_build changed_when: true when: >- seriatim_checkout.changed or - not seriatim_binary.stat.exists or - seriatim_installed_version.rc | default(1) != 0 or - seriatim_installed_version.stdout | default('') != 'seriatim version ' ~ seriatim_version + not seriatim_binary.stat.exists - name: Converge installed metadata + become: true ansible.builtin.file: path: "{{ item.path }}" state: "{{ item.state }}" @@ -95,15 +89,3 @@ - path: "{{ seriatim_binary_path }}" state: file mode: "0755" - -- name: Validate the built Seriatim version # noqa no-handler - ansible.builtin.command: - argv: - - "{{ seriatim_binary_path }}" - - --version - register: seriatim_built_version - changed_when: false - failed_when: >- - seriatim_built_version.rc != 0 or - seriatim_built_version.stdout != 'seriatim version ' ~ seriatim_version - when: seriatim_build.changed diff --git a/tests/converge.yml b/tests/converge.yml index c29aa04..17912b7 100644 --- a/tests/converge.yml +++ b/tests/converge.yml @@ -2,6 +2,5 @@ - name: Converge Seriatim role hosts: seriatim gather_facts: true - become: true roles: - role: ansible-role-seriatim diff --git a/tests/integration b/tests/integration index 8d95640..c709b69 100755 --- a/tests/integration +++ b/tests/integration @@ -74,14 +74,21 @@ missing_binary_repeat_log="$test_tmp/missing-binary-repeat.log" run_converge "$missing_binary_repeat_log" require_clean_recap "$missing_binary_repeat_log" -sudo cp -- /bin/false "$binary_path" -wrong_version_log="$test_tmp/wrong-version.log" -run_converge "$wrong_version_log" -require_changed_recap "$wrong_version_log" -grep -A1 -E 'TASK .*Build Seriatim' "$wrong_version_log" | grep -q '^changed:' -wrong_version_repeat_log="$test_tmp/wrong-version-repeat.log" -run_converge "$wrong_version_repeat_log" -require_clean_recap "$wrong_version_repeat_log" +custom_go_binary="$test_tmp/go" +ln -s /snap/bin/go "$custom_go_binary" +sudo rm -f -- "$binary_path" +custom_go_log="$test_tmp/custom-go.log" +run_converge "$custom_go_log" \ + -e '{"seriatim_manage_build_dependencies": false}' \ + -e "seriatim_go_binary=$custom_go_binary" +require_changed_recap "$custom_go_log" +grep -A1 -E 'TASK .*Build Seriatim' "$custom_go_log" | grep -q '^changed:' +verify_release v1.5.0 "$default_commit" +custom_go_repeat_log="$test_tmp/custom-go-repeat.log" +run_converge "$custom_go_repeat_log" \ + -e '{"seriatim_manage_build_dependencies": false}' \ + -e "seriatim_go_binary=$custom_go_binary" +require_clean_recap "$custom_go_repeat_log" sudo chmod 0700 "$binary_path" metadata_log="$test_tmp/metadata.log" diff --git a/tests/unsupported.yml b/tests/unsupported.yml index 9f39b42..dd8b1e3 100644 --- a/tests/unsupported.yml +++ b/tests/unsupported.yml @@ -2,7 +2,6 @@ - name: Exercise Seriatim platform mutation guard hosts: seriatim gather_facts: false - become: true vars: ansible_facts: distribution: "{{ test_distribution }}"