83471be571
The sr_fingerprint module was rewritten to accept structured parameters (status, role_name, role_path, etc.) instead of a free-form sr_message. Update the role tasks and tests to match the new module interface. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
73 lines
2.6 KiB
YAML
73 lines
2.6 KiB
YAML
# SPDX-License-Identifier: MIT
|
|
---
|
|
- name: Ensure that the role runs with default parameters
|
|
hosts: all
|
|
tasks:
|
|
- name: See if /dev/log exists for the fingerprint check
|
|
ansible.builtin.stat:
|
|
path: /dev/log
|
|
register: __register_dev_log
|
|
|
|
- name: Set the start time for the journal search
|
|
ansible.builtin.set_fact:
|
|
__journal_start_time: "{{ ansible_facts['date_time']['date'] ~ ' ' ~ ansible_facts['date_time']['time'] }}"
|
|
when: __register_dev_log.stat.exists
|
|
|
|
- name: Run the role
|
|
include_tasks: tasks/run_role_with_clear_facts.yml
|
|
vars:
|
|
__aide_write_log_file: true
|
|
|
|
# look for the exact module invocation, not some other message that might contain the string
|
|
- name: Get fingerprint entries from journal
|
|
ansible.builtin.shell:
|
|
executable: /bin/bash
|
|
cmd: >-
|
|
set -eo pipefail;
|
|
journalctl --since "{{ __journal_start_time }}" --no-pager |
|
|
grep -v " Invoked with" |
|
|
grep "sr_fingerprint.*role_name=aide"
|
|
register: __register_journal_fingerprints
|
|
changed_when: false
|
|
when: __register_dev_log.stat.exists
|
|
|
|
- name: Check that the log file was written
|
|
ansible.builtin.slurp:
|
|
path: /var/log/sysroles.jsonl
|
|
register: __register_log_file
|
|
|
|
- name: Verify log file and journal fingerprints
|
|
when: __register_dev_log.stat.exists
|
|
vars:
|
|
__journal_lines: "{{ __register_journal_fingerprints.stdout_lines }}"
|
|
__journal_begin: "{{ __journal_lines | select('search', 'status=begin') | list }}"
|
|
__journal_success: "{{ __journal_lines | select('search', 'status=success') | list }}"
|
|
__begin_date: "{{ (__journal_begin[0] | regex_search('date=([^ ]+)', '\\1'))[0] }}"
|
|
__success_date: "{{ (__journal_success[0] | regex_search('date=([^ ]+)', '\\1'))[0] }}"
|
|
__file_content: "{{ __register_log_file.content | b64decode }}"
|
|
block:
|
|
- name: Print contents of logs
|
|
debug:
|
|
var: item
|
|
loop:
|
|
- "{{ __file_content }}"
|
|
- "{{ __journal_lines }}"
|
|
|
|
- name: Assert content is correct
|
|
ansible.builtin.assert:
|
|
that:
|
|
- __journal_begin | length > 0
|
|
- __journal_success | length > 0
|
|
- __begin_date in __file_content
|
|
- __success_date in __file_content
|
|
|
|
- name: Check if the file exists
|
|
ansible.builtin.stat:
|
|
path: /etc/aide.conf
|
|
register: file_check
|
|
|
|
- name: Assert that the file exists
|
|
ansible.builtin.assert:
|
|
that: file_check.stat.exists
|
|
fail_msg: The file does not exist.
|