Dockerfile.dapper

FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b

COPY ubuntu-apt.lock /licenses/ubuntu-apt.lock
COPY ubuntu-security-packages.lock /licenses/ubuntu-security-packages.lock
COPY scripts/install-ubuntu-security-updates /usr/local/libexec/pasturestack/install-ubuntu-security-updates
COPY --chmod=0755 scripts/prepare-snapshot-packages /usr/local/bin/prepare-snapshot-packages
ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb /tmp/ca-certificates.deb
ADD --checksum=sha256:2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc https://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_8.18.0-1ubuntu2.8_amd64.deb /tmp/curl.deb
ADD --checksum=sha256:8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3t64-gnutls_8.18.0-1ubuntu2.8_amd64.deb /tmp/libcurl3t64-gnutls.deb
ADD --checksum=sha256:7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266 https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4t64_8.18.0-1ubuntu2.8_amd64.deb /tmp/libcurl4t64.deb

ARG DAPPER_HOST_ARCH=amd64
ARG GO_VERSION=1.27.3
ARG GO_LINUX_AMD64_SHA256=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40
ARG GO_LINUX_ARM64_SHA256=a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49

ENV DEBIAN_FRONTEND=noninteractive
ENV HOST_ARCH=${DAPPER_HOST_ARCH} ARCH=${DAPPER_HOST_ARCH}

LABEL org.opencontainers.image.source="https://github.com/PastureStack/authentication-service" \
      org.opencontainers.image.description="PastureStack Authentication Service build environment." \
      org.opencontainers.image.licenses="Apache-2.0"

ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb /opt/pasturestack-ca-certificates.deb
RUN set -eux; \
    . /licenses/ubuntu-apt.lock; \
    rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; \
    rm -rf /tmp/ca-bootstrap; \
    mkdir -p /tmp/ca-bootstrap /etc/ssl/certs; \
    dpkg-deb --extract /tmp/ca-certificates.deb /tmp/ca-bootstrap; \
    find /tmp/ca-bootstrap/usr/share/ca-certificates -type f -name '*.crt' \
        | LC_ALL=C sort \
        | while IFS= read -r certificate; do sed -e '$a\' "${certificate}"; done \
        > /etc/ssl/certs/ca-certificates.crt; \
    test -s /etc/ssl/certs/ca-certificates.crt; \
    printf 'Types: deb\nURIs: https://snapshot.ubuntu.com/ubuntu/%s\nSuites: resolute resolute-updates resolute-backports resolute-security\nComponents: main universe\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\nSnapshot: no\n' \
        "${UBUNTU_APT_SNAPSHOT}" > /etc/apt/sources.list.d/pasturestack-snapshot.sources; \
    printf 'Acquire::Retries "5";\nAcquire::http::Timeout "30";\nAcquire::https::Timeout "30";\nAcquire::http::Pipeline-Depth "0";\nAcquire::https::CaInfo "/etc/ssl/certs/ca-certificates.crt";\nAcquire::https::Verify-Peer "true";\nAcquire::https::Verify-Host "true";\nAcquire::AllowInsecureRepositories "false";\nAPT::Get::AllowUnauthenticated "false";\n' > /etc/apt/apt.conf.d/80pasturestack-retries; \
    apt-get update; \
    prepare-snapshot-packages install -y --no-install-recommends \
        bash="${UBUNTU_APT_BASH_VERSION}" \
        ca-certificates="${UBUNTU_APT_CA_CERTIFICATES_BOOTSTRAP_VERSION}" \
        curl="${UBUNTU_APT_CURL_BOOTSTRAP_VERSION}" \
        file="${UBUNTU_APT_FILE_VERSION}" \
        gcc="${UBUNTU_APT_GCC_VERSION}" \
        git="${UBUNTU_APT_GIT_VERSION}" \
        libc6-dev="${UBUNTU_APT_LIBC6_DEV_VERSION}" \
        make="${UBUNTU_APT_MAKE_VERSION}" \
        tar="${UBUNTU_APT_TAR_VERSION}" \
        xz-utils="${UBUNTU_APT_XZ_UTILS_VERSION}"; \
    apt-get install --no-download -y --no-install-recommends \
        -o Dir::Cache::archives=/var/cache/apt/archives \
        bash="${UBUNTU_APT_BASH_VERSION}" \
        ca-certificates="${UBUNTU_APT_CA_CERTIFICATES_BOOTSTRAP_VERSION}" \
        curl="${UBUNTU_APT_CURL_BOOTSTRAP_VERSION}" \
        file="${UBUNTU_APT_FILE_VERSION}" \
        gcc="${UBUNTU_APT_GCC_VERSION}" \
        git="${UBUNTU_APT_GIT_VERSION}" \
        libc6-dev="${UBUNTU_APT_LIBC6_DEV_VERSION}" \
        make="${UBUNTU_APT_MAKE_VERSION}" \
        tar="${UBUNTU_APT_TAR_VERSION}" \
        xz-utils="${UBUNTU_APT_XZ_UTILS_VERSION}"; \
    printf 'Types: deb\nURIs: https://snapshot.ubuntu.com/ubuntu/%s\nSuites: resolute-updates resolute-security\nComponents: main\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\nSnapshot: no\n' \
        "${UBUNTU_APT_SECURITY_SNAPSHOT}" > /etc/apt/sources.list.d/pasturestack-security.sources; \
    apt-get update; \
    prepare-snapshot-packages install -y --no-install-recommends \
        linux-libc-dev="${UBUNTU_APT_LINUX_LIBC_DEV_VERSION}" \
        libssl3t64="${UBUNTU_APT_OPENSSL_VERSION}" \
        openssl="${UBUNTU_APT_OPENSSL_VERSION}" \
        openssl-provider-legacy="${UBUNTU_APT_OPENSSL_VERSION}"; \
    apt-get install --no-download -y --no-install-recommends \
        -o Dir::Cache::archives=/var/cache/apt/archives \
        linux-libc-dev="${UBUNTU_APT_LINUX_LIBC_DEV_VERSION}" \
        libssl3t64="${UBUNTU_APT_OPENSSL_VERSION}" \
        openssl="${UBUNTU_APT_OPENSSL_VERSION}" \
        openssl-provider-legacy="${UBUNTU_APT_OPENSSL_VERSION}"; \
    test "$(dpkg-query -W -f='${Version}' linux-libc-dev)" = "${UBUNTU_APT_LINUX_LIBC_DEV_VERSION}"; \
    for package in libssl3t64 openssl openssl-provider-legacy; do \
        test "$(dpkg-query -W -f='${Version}' "${package}")" = "${UBUNTU_APT_OPENSSL_VERSION}"; \
    done; \
    for package in curl libcurl3t64-gnutls libcurl4t64; do \
        test "$(dpkg-deb -f "/tmp/${package}.deb" Package)" = "${package}"; \
        test "$(dpkg-deb -f "/tmp/${package}.deb" Version)" = "${UBUNTU_APT_CURL_VERSION}"; \
        test "$(dpkg-deb -f "/tmp/${package}.deb" Architecture)" = amd64; \
    done; \
    dpkg -i /tmp/curl.deb /tmp/libcurl3t64-gnutls.deb /tmp/libcurl4t64.deb; \
    for package in curl libcurl3t64-gnutls libcurl4t64; do \
        test "$(dpkg-query -W -f='${Version}' "${package}")" = "${UBUNTU_APT_CURL_VERSION}"; \
    done; \
    dpkg -i /opt/pasturestack-ca-certificates.deb && \
    update-ca-certificates --fresh && \
    test "$(dpkg-query -W -f='${Version}' ca-certificates)" = '20260816ubuntu0.26.04.1' && \
    test ! -e /usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt && \
    rm -f /opt/pasturestack-ca-certificates.deb && \
    sh /usr/local/libexec/pasturestack/install-ubuntu-security-updates /licenses/ubuntu-security-packages.lock /etc/ssl/certs/ca-certificates.crt && \
    { \
        printf 'snapshot\t%s\n' "${UBUNTU_APT_SNAPSHOT}"; \
        printf 'security-snapshot\t%s\n' "${UBUNTU_APT_SECURITY_SNAPSHOT}"; \
        dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort; \
    } > /licenses/AUTHENTICATION-SERVICE-UBUNTU-APT-PACKAGES.tsv; \
    apt-get clean; \
    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/bin/pebble; \
    rm -f /bin/sh && ln -s /bin/bash /bin/sh

ENV GOPATH=/go \
    PATH=/go/bin:/usr/local/go/bin:${PATH} \
    SHELL=/bin/bash \
    GO111MODULE=on \
    GOPROXY=https://proxy.golang.org,direct \
    GOSUMDB=sum.golang.org \
    GOCACHE=/tmp/go-build-cache \
    GOTELEMETRY=off \
    XDG_CONFIG_HOME=/tmp/go-config \
    GIT_CONFIG_GLOBAL=/tmp/gitconfig

RUN case "${DAPPER_HOST_ARCH}" in \
        amd64) go_arch=amd64; go_sha="${GO_LINUX_AMD64_SHA256}" ;; \
        arm64) go_arch=arm64; go_sha="${GO_LINUX_ARM64_SHA256}" ;; \
        *) echo "unsupported DAPPER_HOST_ARCH=${DAPPER_HOST_ARCH}" >&2; exit 1 ;; \
    esac && \
    curl -fsSL -o /tmp/go.tgz "https://go.dev/dl/go${GO_VERSION}.linux-${go_arch}.tar.gz" && \
    echo "${go_sha}  /tmp/go.tgz" | sha256sum -c - && \
    tar -xzf /tmp/go.tgz -C /usr/local && \
    rm -f /tmp/go.tgz && \
    go version

ENV DAPPER_SOURCE=/go/src/github.com/PastureStack/authentication-service/
ENV DAPPER_OUTPUT="./bin ./dist"
ENV HOME=/tmp
WORKDIR ${DAPPER_SOURCE}

RUN git config --system --add safe.directory ${DAPPER_SOURCE} && \
    git config --system --add safe.directory /go/src/github.com/PastureStack/authentication-service && \
    mkdir -p /go /tmp/go-build-cache /tmp/go-config && \
    chown -R 65532:65532 /go /tmp/go-build-cache /tmp/go-config

USER 65532:65532

ENTRYPOINT ["./scripts/entry"]
CMD ["ci"]