# cert-manager-webhook-linode from the official v0.4.1 release archive. No vendor/.
ARG GO_IMAGE=docker.io/library/golang:1.27.2-alpine3.24@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d
FROM ${GO_IMAGE} AS build
LABEL io.thepeoples.hardened.build-owner="hardened-batch4"
ARG SOURCE_URL=https://github.com/linode/cert-manager-webhook-linode/archive/refs/tags/v0.4.1.tar.gz
ARG SOURCE_SHA256=a5123a6382aa2c6e6591f1a19248e47b957bd5dc87badc2beefac4c274f20d68
ARG SOURCE_COMMIT=444640b7724c69f6f3031a2096e255dcf91678e8
ARG VERSION=v0.4.1
ARG GO_BUMPS="golang.org/x/net@v0.60.0 golang.org/x/crypto@v0.57.0 google.golang.org/grpc@v1.83.2 github.com/google/cel-go@v0.29.0 go.opentelemetry.io/otel@v1.45.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.45.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.45.0 go.opentelemetry.io/otel/sdk@v1.45.0"
ENV GOTOOLCHAIN=local CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOMAXPROCS=4
WORKDIR /src
RUN wget -q -O /tmp/upstream.tar.gz "${SOURCE_URL}" \
 && printf '%s  %s\n' "${SOURCE_SHA256}" /tmp/upstream.tar.gz | sha256sum -c - \
 && tar -xzf /tmp/upstream.tar.gz --strip-components=1 -C /src
# Stable cache IDs share caches across builds, rather than retaining a cache per slice.
RUN --mount=type=cache,id=hardened-go-build,target=/root/.cache/go-build \
    --mount=type=cache,id=hardened-go-mod,target=/go/pkg/mod \
    mkdir -p /out/records /out/source /out/rootfs/tmp /out/rootfs/etc \
 && cp go.mod /out/records/upstream.go.mod \
 && cp go.sum /out/records/upstream.go.sum \
 && if [ -n "${GO_BUMPS}" ]; then \
      GOFLAGS=-mod=mod go get ${GO_BUMPS} \
      && go mod download && go mod verify && go mod vendor; \
    else \
      go mod download && go mod verify && go mod vendor; \
    fi \
 && go build -p 4 -mod=vendor -buildvcs=false -trimpath \
      -tags 'netgo osusergo' \
      -ldflags "-s -w" \
      -o /out/webhook . \
 && go version -m /out/webhook > /out/records/go-version-m.txt \
 && cp vendor/modules.txt /out/records/vendor-modules.txt \
 && cp go.mod /out/records/effective.go.mod \
 && cp go.sum /out/records/effective.go.sum \
 && cp LICENSE /out/records/ \
 && printf '%s\n' "${SOURCE_COMMIT}" > /out/records/upstream-commit \
 && printf '%s\n' "${GO_BUMPS}" > /out/records/bumps \
 && printf 'nonroot:x:65532:65532:nonroot:/:/sbin/nologin\n' > /out/rootfs/etc/passwd \
 && printf 'nonroot:x:65532:\n' > /out/rootfs/etc/group \
 && chmod 1777 /out/rootfs/tmp \
 && cp /tmp/upstream.tar.gz /out/source/cert-manager-webhook-linode-${VERSION}.tar.gz \
 && cp -R /out/records /out/source/records \
 && tar -czf /out/source/vendor.tar.gz vendor \
 && cd /out/source && sha256sum *.tar.gz records/* > SHA256SUMS

FROM scratch AS source
LABEL io.thepeoples.hardened.build-owner="hardened-batch4"
COPY --from=build /out/source/ /

FROM scratch
ARG GO_IMAGE
COPY --from=build --chown=65532:65532 /out/rootfs/ /
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=build --chmod=0755 /out/webhook /bin/webhook
COPY --from=build /out/records/ /usr/share/tp-hardened/cert-manager-webhook-linode/
USER 65532:65532
WORKDIR /
EXPOSE 443
ENTRYPOINT ["/bin/webhook"]
LABEL org.opencontainers.image.version="v0.4.1" \
      org.opencontainers.image.source="https://github.com/linode/cert-manager-webhook-linode" \
      org.opencontainers.image.revision="444640b7724c69f6f3031a2096e255dcf91678e8" \
      org.opencontainers.image.licenses="Apache-2.0" \
      io.thepeoples.hardened.upstream="docker.io/linode/cert-manager-webhook-linode:v0.4.1@sha256:cd566aa5554a20ed3a0c4be1c71c075823162a97e7404a7bc8e1c1f4a6ec3315" \
      io.thepeoples.hardened.ladder="b+minimize" \
      io.thepeoples.hardened.toolchain="${GO_IMAGE}" \
      io.thepeoples.hardened.source-status="upstream release tarball plus this Containerfile and recorded module changes"