112 lines
4.5 KiB
YAML
112 lines
4.5 KiB
YAML
---
|
|
- name: Verify Seriatim installation
|
|
hosts: seriatim
|
|
gather_facts: true
|
|
become: true
|
|
vars:
|
|
seriatim_expected_commit: 0fc92f364316c874d366b00cdc884a33e1900b25
|
|
seriatim_expected_version: v1.5.0
|
|
seriatim_verify_source_dir: /usr/local/src/seriatim
|
|
seriatim_verify_binary_path: /usr/local/bin/seriatim
|
|
seriatim_verify_state_dir: /usr/local/src/seriatim.ansible-build-state
|
|
tasks:
|
|
- name: Inspect Seriatim source directory
|
|
ansible.builtin.stat:
|
|
path: "{{ seriatim_verify_source_dir }}"
|
|
register: seriatim_verify_source_stat
|
|
|
|
- name: Inspect installed Seriatim binary
|
|
ansible.builtin.stat:
|
|
path: "{{ seriatim_verify_binary_path }}"
|
|
checksum_algorithm: sha256
|
|
register: seriatim_verify_binary_stat
|
|
|
|
- name: Inspect Seriatim build state directory
|
|
ansible.builtin.stat:
|
|
path: "{{ seriatim_verify_state_dir }}"
|
|
register: seriatim_verify_state_stat
|
|
|
|
- name: Inspect Seriatim build state files
|
|
ansible.builtin.stat:
|
|
path: "{{ seriatim_verify_state_dir }}/{{ item }}"
|
|
loop:
|
|
- build-inputs.json
|
|
- fingerprint.sha256
|
|
- binary.sha256
|
|
register: seriatim_verify_state_file_stats
|
|
|
|
- name: Resolve installed Seriatim source commit
|
|
ansible.builtin.command:
|
|
argv:
|
|
- /usr/bin/git
|
|
- -C
|
|
- "{{ seriatim_verify_source_dir }}"
|
|
- rev-parse
|
|
- HEAD
|
|
register: seriatim_verify_commit
|
|
changed_when: false
|
|
|
|
- name: Inspect installed Seriatim source cleanliness
|
|
ansible.builtin.command:
|
|
argv:
|
|
- /usr/bin/git
|
|
- -C
|
|
- "{{ seriatim_verify_source_dir }}"
|
|
- status
|
|
- --porcelain
|
|
- --untracked-files=all
|
|
- --ignored
|
|
register: seriatim_verify_source_status
|
|
changed_when: false
|
|
|
|
- name: Read installed Seriatim version
|
|
ansible.builtin.command:
|
|
argv:
|
|
- "{{ seriatim_verify_binary_path }}"
|
|
- --version
|
|
register: seriatim_verify_version
|
|
changed_when: false
|
|
|
|
- name: Read stored Seriatim build inputs
|
|
ansible.builtin.slurp:
|
|
src: "{{ seriatim_verify_state_dir }}/build-inputs.json"
|
|
register: seriatim_verify_inputs
|
|
|
|
- name: Read stored Seriatim fingerprint
|
|
ansible.builtin.slurp:
|
|
src: "{{ seriatim_verify_state_dir }}/fingerprint.sha256"
|
|
register: seriatim_verify_fingerprint
|
|
|
|
- name: Read stored Seriatim checksum
|
|
ansible.builtin.slurp:
|
|
src: "{{ seriatim_verify_state_dir }}/binary.sha256"
|
|
register: seriatim_verify_checksum
|
|
|
|
- name: Require valid Seriatim installation state
|
|
ansible.builtin.assert:
|
|
that:
|
|
- ansible_facts.distribution == 'Ubuntu'
|
|
- ansible_facts.distribution_version is version('26.04', '==')
|
|
- ansible_facts.architecture in ['x86_64', 'aarch64']
|
|
- seriatim_verify_source_stat.stat.isdir
|
|
- seriatim_verify_source_stat.stat.pw_name == 'root'
|
|
- seriatim_verify_source_stat.stat.gr_name == 'root'
|
|
- seriatim_verify_binary_stat.stat.isreg
|
|
- seriatim_verify_binary_stat.stat.pw_name == 'root'
|
|
- seriatim_verify_binary_stat.stat.gr_name == 'root'
|
|
- seriatim_verify_binary_stat.stat.mode == '0755'
|
|
- seriatim_verify_state_stat.stat.isdir
|
|
- seriatim_verify_state_stat.stat.pw_name == 'root'
|
|
- seriatim_verify_state_stat.stat.gr_name == 'root'
|
|
- seriatim_verify_state_stat.stat.mode == '0755'
|
|
- seriatim_verify_state_file_stats.results | map(attribute='stat.isreg') | unique | list == [true]
|
|
- seriatim_verify_state_file_stats.results | map(attribute='stat.pw_name') | unique | list == ['root']
|
|
- seriatim_verify_state_file_stats.results | map(attribute='stat.gr_name') | unique | list == ['root']
|
|
- seriatim_verify_state_file_stats.results | map(attribute='stat.mode') | unique | list == ['0644']
|
|
- seriatim_verify_commit.stdout == seriatim_expected_commit
|
|
- seriatim_verify_source_status.stdout == ''
|
|
- seriatim_verify_version.stdout == 'seriatim version ' ~ seriatim_expected_version
|
|
- (seriatim_verify_inputs.content | b64decode | trim | hash('sha256')) == (seriatim_verify_fingerprint.content | b64decode | trim)
|
|
- seriatim_verify_binary_stat.stat.checksum == (seriatim_verify_checksum.content | b64decode | trim)
|
|
fail_msg: Installed Seriatim source, binary, or build state is inconsistent.
|