I think this matches my problem the best so far:
- name: Verify package MD5
shell: |
package_md5=$(rpm -qp --queryformat='%{FILEMD5S}' '{{ item }}')
package_name=$(rpm -qp --queryformat='%{NAME}' '{{ item }}')
installed_md5=$(rpm -q --queryformat='%{FILEMD5S}' "$package_name")
[ "$installed_md5" = "$package_md5" ]
ignore_errors: true
register: verify_result
changed_when: no
failed_when: no
- name: Install package
shell: rpm -U '{{ item }}'
when: verify_result.rc != 0
item
is the path to a rpm file.
The first task gets the MD5 checksum and the name of the package from the rpm file and compares the checksum with the installed package with the same package name. If the checksum doesn't match (and only then), the second task will install the rpm package.