# syntax=docker/dockerfile:1.7
#
# Reproducible build of the enclave binary (and the host daemon).
#
# Everything that influences the output is pinned:
#   * the Rust toolchain image, by digest;
#   * Debian packages (a C compiler is needed for `ring`), via snapshot.debian.org;
#   * crates, via Cargo.lock and --locked;
#   * paths and timestamps, via --remap-path-prefix and SOURCE_DATE_EPOCH.
# Build it with build/build-eif.sh; do not build it by hand.

FROM rust:1.97.1-slim-bookworm@sha256:2775a09d208ff0d7c1f50490c45b62db929e87ba1dcbc3f2132ac71a704bcdd3 AS builder

ARG DEBIAN_SNAPSHOT=20260801T000000Z
RUN set -eux; \
    printf 'deb [check-valid-until=no] https://snapshot.debian.org/archive/debian/%s bookworm main\n' "$DEBIAN_SNAPSHOT" > /etc/apt/sources.list.d/debian.sources.tmp; \
    rm -f /etc/apt/sources.list.d/debian.sources /etc/apt/sources.list; \
    mv /etc/apt/sources.list.d/debian.sources.tmp /etc/apt/sources.list; \
    apt-get -o Acquire::Check-Valid-Until=false update; \
    apt-get install -y --no-install-recommends gcc libc6-dev musl-tools cmake make; \
    rm -rf /var/lib/apt/lists/*

RUN rustup target add x86_64-unknown-linux-musl

WORKDIR /src
COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
COPY config ./config
COPY crates ./crates
COPY vendor ./vendor

ARG TLPROXY_GIT_SHA=unknown
ENV TLPROXY_GIT_SHA=$TLPROXY_GIT_SHA \
    SOURCE_DATE_EPOCH=0 \
    CARGO_INCREMENTAL=0 \
    CARGO_HOME=/cargo \
    RUSTFLAGS="--remap-path-prefix=/src=/build --remap-path-prefix=/cargo=/cargo-home --remap-path-prefix=/usr/local/rustup=/rustup -C target-feature=+crt-static"

RUN cargo build --release --locked --target x86_64-unknown-linux-musl \
        -p tlproxy-enclave -p tlproxy-host -p tlproxy-cli

RUN mkdir -p /out && \
    cp target/x86_64-unknown-linux-musl/release/tlproxy-enclave \
       target/x86_64-unknown-linux-musl/release/tlproxy-host \
       target/x86_64-unknown-linux-musl/release/tlproxy /out/ && \
    sha256sum /out/* > /out/SHA256SUMS

# All binaries, for `--output type=local`.
FROM scratch AS artifacts
COPY --from=builder /out/ /

# The enclave image: nothing but the static binary.
FROM scratch AS enclave
COPY --from=builder /out/tlproxy-enclave /tlproxy-enclave
ENTRYPOINT ["/tlproxy-enclave"]
