---
- name: Verify Seriatim installation
  hosts: seriatim
  gather_facts: true
  become: true
  vars:
    seriatim_expected_commit: 0fc92f364316c874d366b00cdc884a33e1900b25
    seriatim_expected_version: v1.5.0
    seriatim_verify_source_dir: /usr/local/src/seriatim
    seriatim_verify_binary_path: /usr/local/bin/seriatim
    seriatim_verify_state_dir: /usr/local/src/seriatim.ansible-build-state
  tasks:
    - name: Inspect Seriatim source directory
      ansible.builtin.stat:
        path: "{{ seriatim_verify_source_dir }}"
      register: seriatim_verify_source_stat

    - name: Inspect installed Seriatim binary
      ansible.builtin.stat:
        path: "{{ seriatim_verify_binary_path }}"
        checksum_algorithm: sha256
      register: seriatim_verify_binary_stat

    - name: Inspect Seriatim build state directory
      ansible.builtin.stat:
        path: "{{ seriatim_verify_state_dir }}"
      register: seriatim_verify_state_stat

    - name: Inspect Seriatim build state files
      ansible.builtin.stat:
        path: "{{ seriatim_verify_state_dir }}/{{ item }}"
      loop:
        - build-inputs.json
        - fingerprint.sha256
        - binary.sha256
      register: seriatim_verify_state_file_stats

    - name: Resolve installed Seriatim source commit
      ansible.builtin.command:
        argv:
          - /usr/bin/git
          - -C
          - "{{ seriatim_verify_source_dir }}"
          - rev-parse
          - HEAD
      register: seriatim_verify_commit
      changed_when: false

    - name: Inspect installed Seriatim source cleanliness
      ansible.builtin.command:
        argv:
          - /usr/bin/git
          - -C
          - "{{ seriatim_verify_source_dir }}"
          - status
          - --porcelain
          - --untracked-files=all
          - --ignored
      register: seriatim_verify_source_status
      changed_when: false

    - name: Read installed Seriatim version
      ansible.builtin.command:
        argv:
          - "{{ seriatim_verify_binary_path }}"
          - --version
      register: seriatim_verify_version
      changed_when: false

    - name: Read stored Seriatim build inputs
      ansible.builtin.slurp:
        src: "{{ seriatim_verify_state_dir }}/build-inputs.json"
      register: seriatim_verify_inputs

    - name: Read stored Seriatim fingerprint
      ansible.builtin.slurp:
        src: "{{ seriatim_verify_state_dir }}/fingerprint.sha256"
      register: seriatim_verify_fingerprint

    - name: Read stored Seriatim checksum
      ansible.builtin.slurp:
        src: "{{ seriatim_verify_state_dir }}/binary.sha256"
      register: seriatim_verify_checksum

    - name: Require valid Seriatim installation state
      ansible.builtin.assert:
        that:
          - ansible_facts.distribution == 'Ubuntu'
          - ansible_facts.distribution_version is version('26.04', '==')
          - ansible_facts.architecture in ['x86_64', 'aarch64']
          - seriatim_verify_source_stat.stat.isdir
          - seriatim_verify_source_stat.stat.pw_name == 'root'
          - seriatim_verify_source_stat.stat.gr_name == 'root'
          - seriatim_verify_binary_stat.stat.isreg
          - seriatim_verify_binary_stat.stat.pw_name == 'root'
          - seriatim_verify_binary_stat.stat.gr_name == 'root'
          - seriatim_verify_binary_stat.stat.mode == '0755'
          - seriatim_verify_state_stat.stat.isdir
          - seriatim_verify_state_stat.stat.pw_name == 'root'
          - seriatim_verify_state_stat.stat.gr_name == 'root'
          - seriatim_verify_state_stat.stat.mode == '0755'
          - seriatim_verify_state_file_stats.results | map(attribute='stat.isreg') | unique | list == [true]
          - seriatim_verify_state_file_stats.results | map(attribute='stat.pw_name') | unique | list == ['root']
          - seriatim_verify_state_file_stats.results | map(attribute='stat.gr_name') | unique | list == ['root']
          - seriatim_verify_state_file_stats.results | map(attribute='stat.mode') | unique | list == ['0644']
          - seriatim_verify_commit.stdout == seriatim_expected_commit
          - seriatim_verify_source_status.stdout == ''
          - seriatim_verify_version.stdout == 'seriatim version ' ~ seriatim_expected_version
          - (seriatim_verify_inputs.content | b64decode | trim | hash('sha256')) == (seriatim_verify_fingerprint.content | b64decode | trim)
          - seriatim_verify_binary_stat.stat.checksum == (seriatim_verify_checksum.content | b64decode | trim)
        fail_msg: Installed Seriatim source, binary, or build state is inconsistent.