# Batch 2 — official cert-manager Helm chart v1.21.2. Pin
# quay.io/jetstack/cert-manager-webhook:v1.21.2. linux/amd64 only.
# Ladder (b): same upstream tag v1.21.2 rebuilt from public source with Go 1.26.9
# (upstream binary is go1.26.8) and golang.org/x/net@v0.60.0. Distroless/static-debian13
# has no apk/apt. USER 65532. linux/amd64 only.
# Digests from helm-pilot/batch2/digests.txt (crane v0.22.1, 2026-10-10T18:08:48Z):
#   index sha256:a60e2dac46dbb8a7f3df95c54ce941012f54c2fe022f0ee55aaa1ab40ed957ae
#   linux/amd64 sha256:b929259301ee75270ab4651d5e6bd4ba7b6624b1ce48ba767d064295a9312101
ARG GO_IMAGE=docker.io/library/golang:1.26.9@sha256:f1f0bcc2c524a3ced375fcb4d1ecb7aa371aa7070e112599aaca45cc02d0101b
ARG UPSTREAM=quay.io/jetstack/cert-manager-webhook@sha256:a60e2dac46dbb8a7f3df95c54ce941012f54c2fe022f0ee55aaa1ab40ed957ae
ARG REF=v1.21.2
FROM ${GO_IMAGE} AS build
ENV GOTOOLCHAIN=local CGO_ENABLED=0
COPY go-min-bump.sh /usr/local/bin/
ARG REF
ARG CERT_MANAGER_BUMPS="golang.org/x/net@v0.60.0"
RUN git clone --depth 1 --branch ${REF} https://github.com/cert-manager/cert-manager.git /src \
 && git -C /src rev-parse HEAD > /src/.upstream-commit
WORKDIR /src
RUN go-min-bump.sh ${CERT_MANAGER_BUMPS} > /root.bumps
WORKDIR /src/cmd/webhook
RUN go-min-bump.sh ${CERT_MANAGER_BUMPS} > /cert-manager.bumps
RUN go build -trimpath -ldflags "-s -w -X github.com/cert-manager/cert-manager/pkg/util.AppVersion=${REF} -X github.com/cert-manager/cert-manager/pkg/util.AppGitCommit=$(cat /src/.upstream-commit) -X github.com/cert-manager/cert-manager/pkg/util.AppGitState=dirty" -o /out .

FROM ${UPSTREAM}
USER root
COPY --from=build --chmod=0555 /out /app/cmd/webhook/webhook
COPY --from=build /root.bumps /cert-manager.bumps /src/.upstream-commit /usr/share/tp-hardened/
USER 65532:65532
LABEL org.opencontainers.image.version="v1.21.2" \
      io.thepeoples.hardened.upstream="quay.io/jetstack/cert-manager-webhook:v1.21.2@sha256:a60e2dac46dbb8a7f3df95c54ce941012f54c2fe022f0ee55aaa1ab40ed957ae" \
      io.thepeoples.hardened.replaces="quay.io/jetstack/cert-manager-webhook:v1.21.2@sha256:a60e2dac46dbb8a7f3df95c54ce941012f54c2fe022f0ee55aaa1ab40ed957ae" \
      io.thepeoples.hardened.ladder="b" \
      io.thepeoples.hardened.claim="package-fixable CRITICAL/HIGH cleared vs upstream digest; not FIPS/FedRAMP"