# syntax=docker/dockerfile:1
#
# WHP release-signing key ceremony image (docs/go-port/key-ceremony-docker.md).
# Build from the REPO ROOT (the context is cut down by Dockerfile.dockerignore):
#
#   docker build -f scripts/key-ceremony/Dockerfile -t whp-ceremony:local .
#
# Everything that matters is pinned:
#   * both base images by digest (manifest-list digests recorded 2026-11-07 from Docker Hub;
#     re-record through the pkg-cache like scripts/pam-build-image.pin, review before use)
#   * Debian packages by exact version (from the pinned base's trixie archive; a Debian point
#     update can retire a version: the build then FAILS, it never silently takes another one)
#   * the Bitwarden CLI by release version AND sha256 (fetched over TLS, checked, unzipped)
#   * the whp binary is built from this checkout with the repo's Go pin, vendored, offline
#     (GOPROXY=off), -trimpath: optionally checked against a sha256 you computed elsewhere
#     (--build-arg WHP_SHA256=...)
#
# Base image: official Debian by digest. Docker Hardened Images (dhi.io, needs docker login) were not
# verifiable from here; see docs/go-port/key-ceremony-docker.md "Base image". --build-arg BASE_IMAGE=... swaps it.
#
# Nothing secret is ever in this image, its build args or its environment.

ARG GO_IMAGE=golang:1.27.3@sha256:e519d3b0a5b285e5aa53ab9eef02bc6bbb9cb04608389b743a136a9ce75f0d1e
ARG BASE_IMAGE=debian:trixie-slim@sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2

# ---- stage 1: whp, from the repo --------------------------------------------
FROM ${GO_IMAGE} AS whp-build
ARG WHP_SHA256=""
WORKDIR /src/panel
COPY panel/ /src/panel/
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOAMD64=v1 GOFLAGS="-trimpath -mod=vendor" GOPROXY=off \
      go build -ldflags "-s -w -X main.version=ceremony" -o /out/whp ./cmd/whp \
 && sha256sum /out/whp | tee /out/whp.sha256 \
 && if [ -n "$WHP_SHA256" ]; then echo "$WHP_SHA256  /out/whp" | sha256sum -c - ; fi

# ---- stage 2: the Bitwarden CLI, checksum verified ---------------------------
FROM ${BASE_IMAGE} AS bw-fetch
ARG BW_VERSION=2026.10.1
ARG BW_SHA256=eb09c3715291c21cf744819b873a255c1247b1b8b45bae138621a644ec7ad8f5
RUN apt-get update -qq \
 && apt-get install -y --no-install-recommends ca-certificates curl unzip=6.0-29+deb13u1 \
 && curl -fsSL --proto '=https' --tlsv1.2 -o /bw.zip \
      "https://github.com/bitwarden/clients/releases/download/cli-v${BW_VERSION}/bw-linux-${BW_VERSION}.zip" \
 && echo "${BW_SHA256}  /bw.zip" | sha256sum -c - \
 && unzip -q /bw.zip -d /out && chmod 0755 /out/bw && test "$(/out/bw --version)" = "${BW_VERSION}"

# ---- stage 3: the ceremony image ----------------------------------------------
FROM ${BASE_IMAGE}
ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8
RUN apt-get update -qq \
 && apt-get install -y --no-install-recommends \
      gnupg=2.4.7-21+deb13u1 gpg-agent=2.4.7-21+deb13u1+b5 scdaemon=2.4.7-21+deb13u1+b5 \
      pcscd=2.3.3-1 pinentry-tty=1.3.1-2 yubikey-manager=5.6.1+repack1-1 \
      jq=1.7.1-6+deb13u4 ca-certificates=20250419+deb13u1 \
 && rm -rf /var/lib/apt/lists/* /var/cache/apt/* \
 && useradd --no-create-home --shell /usr/sbin/nologin ceremony-unused
COPY --from=whp-build /out/whp /usr/local/bin/whp
COPY --from=whp-build /out/whp.sha256 /usr/share/whp-ceremony/whp.sha256
COPY --from=bw-fetch /out/bw /usr/local/bin/bw
COPY scripts/key-ceremony/ceremony.sh /usr/local/bin/ceremony
COPY scripts/key-ceremony/scdaemon.conf /usr/share/whp-ceremony/scdaemon.conf
COPY scripts/key-ceremony/gpg-agent.conf /usr/share/whp-ceremony/gpg-agent.conf
COPY scripts/key-ceremony/tests/mock-bw.sh /usr/share/whp-ceremony/mock-bw.sh
RUN chmod 0755 /usr/local/bin/ceremony /usr/share/whp-ceremony/mock-bw.sh
# All state lives in tmpfs mounted at run time (docker run --tmpfs /dev/shm ...); the
# image has no volume and no secret. The entrypoint refuses to run on a non-tmpfs /dev/shm.
WORKDIR /dev/shm
ENTRYPOINT ["/usr/local/bin/ceremony"]
CMD ["help"]
