# Batch 2 — official External Secrets Operator Helm chart 2.12.0. Pin
# ghcr.io/external-secrets/external-secrets:v2.12.0. linux/amd64 only.
# One upstream image serves three chart roles: controller, webhook, and
# cert-controller (chart values image / webhook.image / certController.image).
# Ladder (b): same upstream tag v2.12.0 rebuilt from public source with Go 1.26.9
# (upstream binary is go1.26.6) and golang.org/x/net@v0.60.0. Distroless/static-debian13
# (USER 65534) has no apk/apt.
# Digests from helm-pilot/batch2/digests.txt (crane v0.22.1, 2026-10-10T18:08:48Z):
#   index sha256:7a3c4f7e038fa0f86a3172da19b9388f3f4d846e87e9994ee3474c5b72a9330d
#   linux/amd64 sha256:124cbfc50de67babf8c124e1785fd4ff15e743b659dfab38371c0cab7cb43bf9
ARG GO_IMAGE=docker.io/library/golang:1.26.9@sha256:f1f0bcc2c524a3ced375fcb4d1ecb7aa371aa7070e112599aaca45cc02d0101b
ARG UPSTREAM=ghcr.io/external-secrets/external-secrets@sha256:7a3c4f7e038fa0f86a3172da19b9388f3f4d846e87e9994ee3474c5b72a9330d
ARG REF=v2.12.0
FROM ${GO_IMAGE} AS build
ENV GOTOOLCHAIN=local CGO_ENABLED=0 GOWORK=off
COPY go-min-bump.sh /usr/local/bin/
ARG REF
ARG ESO_BUMPS="golang.org/x/net@v0.60.0"
RUN git clone --depth 1 --branch ${REF} https://github.com/external-secrets/external-secrets.git /src \
 && git -C /src rev-parse HEAD > /src/.upstream-commit
WORKDIR /src
RUN go-min-bump.sh ${ESO_BUMPS} > /eso.bumps \
 && go build -tags all_providers -trimpath -ldflags "-s -w -X main.Version=${REF}" -o /external-secrets main.go

FROM ${UPSTREAM}
USER root
COPY --from=build --chmod=0555 /external-secrets /bin/external-secrets
COPY --from=build /eso.bumps /src/.upstream-commit /usr/share/tp-hardened/
USER 65534
LABEL org.opencontainers.image.version="v2.12.0" \
      io.thepeoples.hardened.upstream="ghcr.io/external-secrets/external-secrets:v2.12.0@sha256:7a3c4f7e038fa0f86a3172da19b9388f3f4d846e87e9994ee3474c5b72a9330d" \
      io.thepeoples.hardened.replaces="ghcr.io/external-secrets/external-secrets:v2.12.0@sha256:7a3c4f7e038fa0f86a3172da19b9388f3f4d846e87e9994ee3474c5b72a9330d" \
      io.thepeoples.hardened.ladder="b" \
      io.thepeoples.hardened.claim="package-fixable CRITICAL/HIGH cleared vs upstream digest; not FIPS/FedRAMP"