2026-09-08 23:45:08 +00:00
|
|
|
# Feature 0003 Remediation Review
|
2026-09-07 18:51:14 +00:00
|
|
|
|
2026-09-08 23:53:06 +00:00
|
|
|
Status: resolved
|
2026-09-07 18:51:14 +00:00
|
|
|
|
2026-09-08 23:45:08 +00:00
|
|
|
Reviewed implementation commits:
|
2026-09-07 18:51:14 +00:00
|
|
|
|
2026-09-08 23:45:08 +00:00
|
|
|
- `287fc4a Install and configure Notarius`
|
|
|
|
|
- `733a194 Add focused Notarius integration coverage`
|
|
|
|
|
|
2026-09-08 23:53:06 +00:00
|
|
|
Remediation commit:
|
|
|
|
|
|
|
|
|
|
- `eb4f511 Correct Notarius metadata and dependency coverage`
|
2026-09-08 23:45:08 +00:00
|
|
|
|
|
|
|
|
## Finding 1: Correct the Galaxy License Metadata
|
|
|
|
|
|
|
|
|
|
Severity: medium
|
|
|
|
|
|
2026-09-08 23:53:06 +00:00
|
|
|
`ansible-role-notarius/meta/main.yml` declared `license: BSD-3-Clause`, while
|
|
|
|
|
the retained repository license is CC0 1.0 Universal.
|
2026-09-08 23:45:08 +00:00
|
|
|
|
2026-09-08 23:53:06 +00:00
|
|
|
### Resolution
|
2026-09-08 23:45:08 +00:00
|
|
|
|
2026-09-08 23:53:06 +00:00
|
|
|
The Galaxy license identifier is now `CC0-1.0`, consistent with the repository
|
|
|
|
|
license.
|
2026-09-08 23:45:08 +00:00
|
|
|
|
|
|
|
|
## Finding 2: Remove the Redundant Build Change Override
|
|
|
|
|
|
2026-09-08 23:53:06 +00:00
|
|
|
Status: withdrawn
|
2026-09-08 23:45:08 +00:00
|
|
|
|
2026-09-08 23:53:06 +00:00
|
|
|
The initial review treated `changed_when: true` on the conditionally executed
|
|
|
|
|
build command as redundant. Validation after removing it failed ansible-lint's
|
|
|
|
|
`no-changed-when` production rule.
|
2026-09-08 23:45:08 +00:00
|
|
|
|
2026-09-08 23:53:06 +00:00
|
|
|
### Resolution
|
2026-09-08 23:45:08 +00:00
|
|
|
|
2026-09-08 23:53:06 +00:00
|
|
|
The directive remains in place. Unlike a desired-state module, the imperative
|
|
|
|
|
build command must explicitly declare its change semantics for lint. The
|
|
|
|
|
existing `when` expression still determines whether the command runs, and
|
|
|
|
|
`changed_when: true` accurately reports that every executed build changes the
|
2026-09-09 13:20:46 +00:00
|
|
|
binary. The distinction is now documented in `docs/ansible.md`.
|
2026-09-08 23:45:08 +00:00
|
|
|
|
|
|
|
|
## Finding 3: Make the Dependency-Opt-Out Test Prove the Selected Go Binary
|
2026-09-08 02:09:23 +00:00
|
|
|
|
2026-09-08 04:42:11 +00:00
|
|
|
Severity: low
|
2026-09-08 02:09:23 +00:00
|
|
|
|
2026-09-08 23:53:06 +00:00
|
|
|
The original integration test pointed `notarius_go_binary` at a symlink to
|
|
|
|
|
`/snap/bin/go`, so it did not prove that the configured path was actually
|
|
|
|
|
invoked.
|
|
|
|
|
|
|
|
|
|
### Resolution
|
|
|
|
|
|
|
|
|
|
The test now supplies a wrapper in its private temporary directory. The
|
|
|
|
|
wrapper records its invocation before delegating to `/snap/bin/go`, and the
|
|
|
|
|
suite asserts that the record exists after the dependency-opt-out build.
|
|
|
|
|
|
|
|
|
|
## Final Validation
|
|
|
|
|
|
|
|
|
|
The complete `tests/integration` suite passed after remediation with Ansible
|
|
|
|
|
Core 2.21.3 and ansible-lint 26.8.0. Production-profile lint passed, every
|
|
|
|
|
selected build and configuration behavior remained valid, all required repeat
|
|
|
|
|
runs were clean, and the suite restored Notarius `v0.6.0` with the minimal
|
|
|
|
|
`version: 4` configuration.
|
|
|
|
|
|
|
|
|
|
`git diff --check` also passed. No unresolved Feature 0003 findings remain.
|
