From 83471be571c19a2a977fb044fc086a2836a847a4 Mon Sep 17 00:00:00 2001
From: Sergei Petrosian <spetrosi@redhat.com>
Date: Thu, 6 Aug 2026 17:05:43 +0200
Subject: [PATCH] fix: Update sr_fingerprint task calls to use new structured
 parameters

The sr_fingerprint module was rewritten to accept structured parameters
(status, role_name, role_path, etc.) instead of a free-form sr_message.
Update the role tasks and tests to match the new module interface.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 tasks/main.yml          | 10 +++++++---
 tasks/set_vars.yml      | 10 +++++++---
 tests/tests_default.yml | 42 +++++++++++++++++++++++++++++++++++------
 vars/main.yml           |  2 ++
 4 files changed, 52 insertions(+), 12 deletions(-)

diff --git a/tasks/main.yml b/tasks/main.yml
index 3d4bb7e..b76432a 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -155,6 +155,10 @@
 
     - name: Record role success fingerprint
       sr_fingerprint:
-        sr_message: >-
-          success system_role:aide ansible_version={{ ansible_version.full }}
-          {{ ansible_facts['distribution'] }}-{{ ansible_facts['distribution_version'] }}
+        status: success
+        role_name: aide
+        role_path: "{{ role_path }}"
+        ansible_play_hosts_all: "{{ ansible_play_hosts_all }}"
+        distribution: "{{ ansible_facts['distribution'] }}"
+        distribution_version: "{{ ansible_facts['distribution_version'] }}"
+        write_log_file: "{{ __aide_write_log_file }}"
diff --git a/tasks/set_vars.yml b/tasks/set_vars.yml
index 76fbcca..3e0734d 100644
--- a/tasks/set_vars.yml
+++ b/tasks/set_vars.yml
@@ -7,9 +7,13 @@
 
 - name: Record role begin fingerprint
   sr_fingerprint:
-    sr_message: >-
-      begin system_role:aide ansible_version={{ ansible_version.full }}
-      {{ ansible_facts['distribution'] }}-{{ ansible_facts['distribution_version'] }}
+    status: begin
+    role_name: aide
+    role_path: "{{ role_path }}"
+    ansible_play_hosts_all: "{{ ansible_play_hosts_all }}"
+    distribution: "{{ ansible_facts['distribution'] }}"
+    distribution_version: "{{ ansible_facts['distribution_version'] }}"
+    write_log_file: "{{ __aide_write_log_file }}"
 
 - name: Determine if system is ostree and set flag
   when: not __aide_is_ostree is defined
diff --git a/tests/tests_default.yml b/tests/tests_default.yml
index 91b3782..02f16c6 100644
--- a/tests/tests_default.yml
+++ b/tests/tests_default.yml
@@ -15,22 +15,52 @@
 
     - name: Run the role
       include_tasks: tasks/run_role_with_clear_facts.yml
+      vars:
+        __aide_write_log_file: true
 
     # look for the exact module invocation, not some other message that might contain the string
-    - name: Check system journal contains role fingerprints
+    - name: Get fingerprint entries from journal
       ansible.builtin.shell:
         executable: /bin/bash
         cmd: >-
           set -eo pipefail;
           journalctl --since "{{ __journal_start_time }}" --no-pager |
-          grep -v " Invoked with" | grep "sr_fingerprint.*begin system_role:aide" ||
-          { echo ERROR: BEGIN fingerprint not found; exit 1; };
-          journalctl --since "{{ __journal_start_time }}" --no-pager |
-          grep -v " Invoked with" | grep "sr_fingerprint.*success system_role:aide" ||
-          { echo ERROR: SUCCESS fingerprint not found; exit 1; }
+          grep -v " Invoked with" |
+          grep "sr_fingerprint.*role_name=aide"
+      register: __register_journal_fingerprints
       changed_when: false
       when: __register_dev_log.stat.exists
 
+    - name: Check that the log file was written
+      ansible.builtin.slurp:
+        path: /var/log/sysroles.jsonl
+      register: __register_log_file
+
+    - name: Verify log file and journal fingerprints
+      when: __register_dev_log.stat.exists
+      vars:
+        __journal_lines: "{{ __register_journal_fingerprints.stdout_lines }}"
+        __journal_begin: "{{ __journal_lines | select('search', 'status=begin') | list }}"
+        __journal_success: "{{ __journal_lines | select('search', 'status=success') | list }}"
+        __begin_date: "{{ (__journal_begin[0] | regex_search('date=([^ ]+)', '\\1'))[0] }}"
+        __success_date: "{{ (__journal_success[0] | regex_search('date=([^ ]+)', '\\1'))[0] }}"
+        __file_content: "{{ __register_log_file.content | b64decode }}"
+      block:
+        - name: Print contents of logs
+          debug:
+            var: item
+          loop:
+            - "{{ __file_content }}"
+            - "{{ __journal_lines }}"
+
+        - name: Assert content is correct
+          ansible.builtin.assert:
+            that:
+              - __journal_begin | length > 0
+              - __journal_success | length > 0
+              - __begin_date in __file_content
+              - __success_date in __file_content
+
     - name: Check if the file exists
       ansible.builtin.stat:
         path: /etc/aide.conf
diff --git a/vars/main.yml b/vars/main.yml
index 3dd3e9a..618aea1 100644
--- a/vars/main.yml
+++ b/vars/main.yml
@@ -23,6 +23,8 @@ __aide_required_facts:
 __aide_required_facts_subsets: "{{ ['!all', '!min'] +
   __aide_required_facts }}"
 
+__aide_write_log_file: false
+
 # BEGIN - DO NOT EDIT THIS BLOCK - rh distros variables
 # Ansible distribution identifiers that the role treats like RHEL
 __aide_rh_distros: