# tpio.3: package-only update on the published v3.5.4-tpio.2 image.
# CVE-2026-92392 is libcurl3t64-gnutls 8.18.0-1ubuntu2.7; Ubuntu fixed it in 8.18.0-1ubuntu2.8.
# Argo CD, helm, kustomize, and git-lfs binaries stay the tpio.2 source rebuild.
ARG BASE_IMAGE=oci.thepeoples.io/hardened/argocd:v3.5.4-tpio.2@sha256:0f0d36559c94d41c544d65c6ead8bd2aa7f29a9d04d9721af9dd29c2558bc2d8
FROM ${BASE_IMAGE}
USER root
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update \
 && apt-get -y --only-upgrade dist-upgrade \
 && v=$(dpkg-query -W -f '${Version}' libcurl3t64-gnutls) \
 && dpkg --compare-versions "$v" ge 8.18.0-1ubuntu2.8 \
 && echo "libcurl3t64-gnutls $v" \
 && dpkg-query -W -f '${Package} ${Version}\n' > /usr/share/tp-hardened/tpio3.dpkg-manifest \
 && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
USER 999
LABEL io.thepeoples.hardened.package-layer="apt dist-upgrade on v3.5.4-tpio.2; libcurl3t64-gnutls>=8.18.0-1ubuntu2.8"