# syntax=docker/dockerfile:1.16.0@sha256:e2dd261f92e4b763d789984f6eab84be66ab4f5f08052316d8eb8f173593acf7
# check=error=true

#
# Base image for final stages
# Should not contain any components that are not needed (or helpful) at runtime
# Build time dependencies that are used in multiple images can be added to `stackable-devel` (or a derivative like `java-devel`) instead
#

FROM local-image/stackable-devel AS rust-binaries

ARG CONFIG_UTILS_VERSION
ARG CONTAINERDEBUG_VERSION
ARG CERT_TOOLS_VERSION

RUN  /stackable/.bashrc

echo -e "if [ -f ~/.bashrc ]; then\n\tsource ~/.bashrc\nfi" >> /stackable/.profile

chown ${STACKABLE_USER_UID}:0 /stackable/.bashrc
chown ${STACKABLE_USER_UID}:0 /stackable/.profile

cp /root/.curlrc /stackable/.curlrc
chown ${STACKABLE_USER_UID}:0 /stackable/.curlrc

# CVE-2023-37920: Remove "e-Tugra" root certificates
# e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems
# Until they are removed by default from ca-certificates, we should remove them manually
EXPECTED_CERTS_PACKAGE="ca-certificates-2025.2.80_v9.0.305-91.el9.noarch"
ACTUAL_CERTS_PACKAGE="$(rpm -qa ca-certificates)"
if [ "$ACTUAL_CERTS_PACKAGE" != "$EXPECTED_CERTS_PACKAGE" ]; then
  echo "The ca-certificates package was updated to $ACTUAL_CERTS_PACKAGE. Please check if the e-Tugra root certificates are present. \
When they have been removed, manually blacklisting them should be removed"
  echo "Let me help you by running trust list --filter=ca-anchors | grep 'E-Tugra'"
  trust list --filter=ca-anchors | grep 'E-Tugra'
  echo "If the cert appears above, please update the expected package: EXPECTED_CERTS_PACKAGE=\"$ACTUAL_CERTS_PACKAGE\""
  exit 1;
fi
EOF

COPY stackable-base/stackable/ca-cert-blocklist/ /etc/pki/ca-trust/source/blocklist/
RUN