# Ladder (a)+(b, binary swap): dex v2.46.0 (newest upstream; its own dex binary + alpine 3.24.2 scan clean)
# + gomplate v5.2.0 (the version dex pins) rebuilt from source with Go 1.26.9 and min module bumps.
# Helm pilot: argo/argo-cd 10.10.1 pins ghcr.io/dexidp/dex:v2.46.0 (same upstream digest as below) -> no version skew.
ARG GO_IMAGE=docker.io/library/golang:1.26.9@sha256:f1f0bcc2c524a3ced375fcb4d1ecb7aa371aa7070e112599aaca45cc02d0101b
ARG UPSTREAM=ghcr.io/dexidp/dex@sha256:933fcd3f523338c847b88ef84a7145fb2fcb7b9917f08418612afeaaa2001777
FROM ${GO_IMAGE} AS gomplate
ENV GOTOOLCHAIN=local CGO_ENABLED=0
COPY go-min-bump.sh /usr/local/bin/
ARG GOMPLATE_REF=v5.2.0
ARG GOMPLATE_BUMPS="github.com/go-git/go-git/v5@v5.19.2 golang.org/x/crypto@v0.56.0 google.golang.org/grpc@v1.83.2"
RUN git clone --depth 1 --branch ${GOMPLATE_REF} https://github.com/hairyhenderson/gomplate.git /g && cd /g \
 && go-min-bump.sh ${GOMPLATE_BUMPS} > /gomplate.bumps \
 && go build -trimpath -ldflags "-w -s -X github.com/hairyhenderson/gomplate/v5/version.Version=${GOMPLATE_REF#v} -X github.com/hairyhenderson/gomplate/v5/version.GitCommit=$(git rev-parse --short HEAD)" -o /gomplate ./cmd/gomplate \
 && /gomplate --version

FROM ${UPSTREAM}
# tp.2: + ladder (c) apk patch layer (grype on tp.1: alpine libssl3/libcrypto3 3.5.8-r0 + zlib 1.3.2-r0 HIGH)
USER root
RUN apk upgrade --no-cache --available && rm -rf /var/cache/apk/* && apk list --installed > /etc/tp-hardened.apk-manifest
USER dex:dex
COPY --from=gomplate --chmod=0755 /gomplate /usr/local/bin/gomplate
COPY --from=gomplate /gomplate.bumps /usr/share/tp-hardened/gomplate.bumps
LABEL org.opencontainers.image.version="v2.46.0" \
      io.thepeoples.hardened.upstream="ghcr.io/dexidp/dex:v2.46.0@sha256:933fcd3f523338c847b88ef84a7145fb2fcb7b9917f08418612afeaaa2001777" \
      io.thepeoples.hardened.replaces="ghcr.io/dexidp/dex:v2.46.0@sha256:933fcd3f523338c847b88ef84a7145fb2fcb7b9917f08418612afeaaa2001777" \
      io.thepeoples.hardened.ladder="b+c" \
      io.thepeoples.hardened.claim="package-fixable CRITICAL/HIGH cleared vs upstream digest; not FIPS/FedRAMP"