# Batch 2 — official cert-manager Helm chart v1.21.2. Pin
# quay.io/jetstack/cert-manager-startupapicheck:v1.21.2. linux/amd64 only.
# Ladder (b): same upstream tag v1.21.2 rebuilt from public source with Go 1.26.9
# (upstream binary is go1.26.8) and golang.org/x/net@v0.60.0. Distroless/static-debian13
# has no apk/apt. USER 65532. linux/amd64 only.
# Digests from helm-pilot/batch2/digests.txt (crane v0.22.1, 2026-10-10T18:08:48Z):
#   index sha256:46e75b6866359ffb5d82624f41e3ed1c70b2994982702ced547ce5edb418a8f5
#   linux/amd64 sha256:ed347b0ab607058f139b83f41567109456b9776330b63da8086a120afb7f1729
ARG GO_IMAGE=docker.io/library/golang:1.26.9@sha256:f1f0bcc2c524a3ced375fcb4d1ecb7aa371aa7070e112599aaca45cc02d0101b
ARG UPSTREAM=quay.io/jetstack/cert-manager-startupapicheck@sha256:46e75b6866359ffb5d82624f41e3ed1c70b2994982702ced547ce5edb418a8f5
ARG REF=v1.21.2
FROM ${GO_IMAGE} AS build
ENV GOTOOLCHAIN=local CGO_ENABLED=0
COPY go-min-bump.sh /usr/local/bin/
ARG REF
ARG CERT_MANAGER_BUMPS="golang.org/x/net@v0.60.0"
RUN git clone --depth 1 --branch ${REF} https://github.com/cert-manager/cert-manager.git /src \
 && git -C /src rev-parse HEAD > /src/.upstream-commit
WORKDIR /src
RUN go-min-bump.sh ${CERT_MANAGER_BUMPS} > /root.bumps
WORKDIR /src/cmd/startupapicheck
RUN go-min-bump.sh ${CERT_MANAGER_BUMPS} > /cert-manager.bumps
RUN go build -trimpath -ldflags "-s -w -X github.com/cert-manager/cert-manager/pkg/util.AppVersion=${REF} -X github.com/cert-manager/cert-manager/pkg/util.AppGitCommit=$(cat /src/.upstream-commit) -X github.com/cert-manager/cert-manager/pkg/util.AppGitState=dirty" -o /out .

FROM ${UPSTREAM}
USER root
COPY --from=build --chmod=0555 /out /startupapicheck
COPY --from=build /root.bumps /cert-manager.bumps /src/.upstream-commit /usr/share/tp-hardened/
USER 65532:65532
LABEL org.opencontainers.image.version="v1.21.2" \
      io.thepeoples.hardened.upstream="quay.io/jetstack/cert-manager-startupapicheck:v1.21.2@sha256:46e75b6866359ffb5d82624f41e3ed1c70b2994982702ced547ce5edb418a8f5" \
      io.thepeoples.hardened.replaces="quay.io/jetstack/cert-manager-startupapicheck:v1.21.2@sha256:46e75b6866359ffb5d82624f41e3ed1c70b2994982702ced547ce5edb418a8f5" \
      io.thepeoples.hardened.ladder="b" \
      io.thepeoples.hardened.claim="package-fixable CRITICAL/HIGH cleared vs upstream digest; not FIPS/FedRAMP"