# Same upstream Dex v2.46.0: rebuild Dex, entrypoint and gomplate with Go 1.27.3.
# Go 1.27.3 includes the crypto/x509 fix for CVE-2026-111943 / GO-2026-6809.
# Go vulndb confirms affected Go 1.27.1 / x/net <0.60.0; no VEX suppression.
ARG GO_IMAGE=docker.io/library/golang:1.27.3-alpine3.24@sha256:f2c872bcee949b7be9c490efd02b48a8a2fbf947cdf533f1c58525ec9d8170fd
ARG UPSTREAM=ghcr.io/dexidp/dex@sha256:933fcd3f523338c847b88ef84a7145fb2fcb7b9917f08418612afeaaa2001777
FROM oci.thepeoples.io/hardened/dex@sha256:d29c33a9868c203a32ec3f7987325bbe8036d8989d6bcce5147c22a55ae8adca AS original
FROM ${GO_IMAGE} AS dex-build
RUN apk add --no-cache git make gcc musl-dev
ENV GOTOOLCHAIN=local CGO_ENABLED=1
COPY go-min-bump.sh /usr/local/bin/
ARG DEX_REF=v2.46.0
ARG DEX_BUMPS="golang.org/x/net@v0.60.0"
RUN git clone --depth 1 --branch ${DEX_REF} https://github.com/dexidp/dex.git /dex && cd /dex \
 && git rev-parse HEAD > /dex.upstream-commit \
 && go-min-bump.sh ${DEX_BUMPS} > /dex.bumps \
 && VERSION=${DEX_REF} make release-binary \
 && /go/bin/dex version
# Binary reachability is evidence; it never silently suppresses scanner findings.
RUN go install golang.org/x/vuln/cmd/govulncheck@v1.8.0
COPY --from=original /usr/local/bin/dex /usr/local/bin/docker-entrypoint /usr/local/bin/gomplate /original/
RUN mkdir /reachability; for b in dex docker-entrypoint gomplate; do \
      govulncheck -mode=binary -json /original/$b > /reachability/original-$b.json; \
    done
RUN for b in dex docker-entrypoint; do \
      govulncheck -mode=binary -json /go/bin/$b > /reachability/rebuilt-$b.json; \
    done

FROM ${GO_IMAGE} AS gomplate
RUN apk add --no-cache git
ENV GOTOOLCHAIN=local CGO_ENABLED=0
COPY go-min-bump.sh /usr/local/bin/
ARG GOMPLATE_REF=v5.2.0
ARG GOMPLATE_BUMPS="github.com/go-git/go-git/v5@v5.19.2 golang.org/x/crypto@v0.56.0 google.golang.org/grpc@v1.83.2 go.opentelemetry.io/otel/sdk@v1.45.0 golang.org/x/net@v0.60.0"
RUN git clone --depth 1 --branch ${GOMPLATE_REF} https://github.com/hairyhenderson/gomplate.git /g && cd /g \
 && go-min-bump.sh ${GOMPLATE_BUMPS} > /gomplate.bumps \
 && go build -trimpath -ldflags "-w -s -X github.com/hairyhenderson/gomplate/v5/version.Version=${GOMPLATE_REF#v} -X github.com/hairyhenderson/gomplate/v5/version.GitCommit=$(git rev-parse --short HEAD)" -o /gomplate ./cmd/gomplate \
 && /gomplate --version

FROM ${UPSTREAM}
# tpio.2: + ladder (c) apk patch layer (grype on tp.1: alpine libssl3/libcrypto3 3.5.8-r0 + zlib 1.3.2-r0 HIGH)
USER root
RUN apk upgrade --no-cache --available && rm -rf /var/cache/apk/* && apk list --installed > /etc/tp-hardened.apk-manifest
USER dex:dex
COPY --from=dex-build --chmod=0755 /go/bin/dex /go/bin/docker-entrypoint /usr/local/bin/
COPY --from=dex-build /dex/go.mod /dex/go.sum /usr/local/src/dex/
COPY --from=dex-build /dex/api/v2/go.mod /dex/api/v2/go.sum /usr/local/src/dex/api/v2/
COPY --from=dex-build /dex.bumps /dex.upstream-commit /usr/share/tp-hardened/
COPY --from=dex-build /reachability/ /usr/share/tp-hardened/reachability/
COPY --from=gomplate --chmod=0755 /gomplate /usr/local/bin/gomplate
COPY --from=gomplate /gomplate.bumps /usr/share/tp-hardened/gomplate.bumps
LABEL org.opencontainers.image.version="v2.46.0" \
      io.thepeoples.hardened.upstream="ghcr.io/dexidp/dex:v2.46.0@sha256:933fcd3f523338c847b88ef84a7145fb2fcb7b9917f08418612afeaaa2001777" \
      io.thepeoples.hardened.replaces="ghcr.io/dexidp/dex:v2.46.0@sha256:933fcd3f523338c847b88ef84a7145fb2fcb7b9917f08418612afeaaa2001777" \
      io.thepeoples.hardened.ladder="b+c" \
      io.thepeoples.hardened.claim="package-fixable CRITICAL/HIGH cleared vs upstream digest; not FIPS/FedRAMP"