# OpenBao v2.7.1 with the Ember UI rebuilt from the same official release tarball.
ARG NODE_IMAGE=docker.io/library/node:20.20.0-alpine3.23@sha256:09e2b3d9726018aecf269bd35325f46bf75046a643a66d28360ec71132750ec8
ARG GO_IMAGE=docker.io/library/golang:1.27.3-alpine3.24@sha256:f2c872bcee949b7be9c490efd02b48a8a2fbf947cdf533f1c58525ec9d8170fd
FROM ${NODE_IMAGE} AS ui
LABEL io.thepeoples.hardened.build-owner="hardened-batch4"
ARG SOURCE_URL=https://github.com/openbao/openbao/archive/refs/tags/v2.7.1.tar.gz
ARG SOURCE_SHA256=4d69328fa9110734f7740547f5aa7fc77f32141eaab9f7e965abb4f748c4a81a
ENV CI= PNPM_HOME=/root/.local/share/pnpm NODE_OPTIONS=--max-old-space-size=4096
WORKDIR /src
RUN apk add --no-cache git python3 make g++ wget ca-certificates \
 && corepack enable \
 && corepack prepare pnpm@10.34.4 --activate
RUN mkdir -p /sources /out/records \
 && wget -q -O /sources/openbao.tar.gz "${SOURCE_URL}" \
 && printf '%s  %s\n' "${SOURCE_SHA256}" /sources/openbao.tar.gz | sha256sum -c - \
 && tar -xzf /sources/openbao.tar.gz --strip-components=1 -C /src
WORKDIR /src/ui
RUN --mount=type=cache,id=hardened-pnpm,target=/root/.local/share/pnpm/store \
    pnpm install --frozen-lockfile \
 && pnpm build \
 && test -s /src/internal/http/web_ui/index.html \
 && cp package.json pnpm-lock.yaml /out/records/ \
 && node --version > /out/records/node-version.txt \
 && pnpm --version > /out/records/pnpm-version.txt

FROM ${GO_IMAGE} AS build
LABEL io.thepeoples.hardened.build-owner="hardened-batch4"
ARG SOURCE_URL=https://github.com/openbao/openbao/archive/refs/tags/v2.7.1.tar.gz
ARG SOURCE_SHA256=4d69328fa9110734f7740547f5aa7fc77f32141eaab9f7e965abb4f748c4a81a
ARG SOURCE_COMMIT=a5db72cef75c24b920ade02065b18dd8eb666bac
ARG SOURCE_DATE=2026-10-01T13:32:54Z
ARG VERSION=v2.7.1
# VERSION names the source tarball. Do not pass it as GitDescribe: GetVersion()
# prefers GitDescribe over fullVersion, FullVersionNumber prefixes "v", and
# plugin catalog then rejects vv2.7.1+builtin.bao (POST /sys/init 400).
ARG GO_BUMPS="golang.org/x/net@v0.60.0"
ENV GOTOOLCHAIN=local CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOMAXPROCS=4
WORKDIR /src
RUN mkdir -p /sources \
 && wget -q -O /sources/openbao.tar.gz "${SOURCE_URL}" \
 && printf '%s  %s\n' "${SOURCE_SHA256}" /sources/openbao.tar.gz | sha256sum -c - \
 && tar -xzf /sources/openbao.tar.gz --strip-components=1 -C /src
COPY --from=ui /src/internal/http/web_ui/ /src/internal/http/web_ui/
COPY --from=ui /out/records/ /out/records/ui/
RUN --mount=type=cache,id=hardened-go-build,target=/root/.cache/go-build \
    --mount=type=cache,id=hardened-go-mod,target=/go/pkg/mod \
    mkdir -p /out/records /out/source \
      /out/rootfs/etc \
      /out/rootfs/tmp \
      /out/rootfs/openbao/config \
      /out/rootfs/openbao/file \
      /out/rootfs/openbao/logs \
      /out/rootfs/openbao/data \
      /out/rootfs/home/openbao \
 && test -s /src/internal/http/web_ui/index.html \
 && cp go.mod /out/records/upstream.go.mod \
 && cp go.sum /out/records/upstream.go.sum \
 && if [ -n "${GO_BUMPS}" ]; then GOFLAGS=-mod=mod go get ${GO_BUMPS}; fi \
 && go mod download && go mod verify && go mod vendor \
 && go build -p 4 -mod=vendor -buildvcs=false -trimpath \
      -tags "openbao,ui" \
      -ldflags "-s -w -X github.com/openbao/openbao/v2/internal/version.GitCommit=${SOURCE_COMMIT} -X github.com/openbao/openbao/v2/internal/version.CommitDate=${SOURCE_DATE} -X github.com/openbao/openbao/v2/internal/version.fullVersion=2.7.1" \
      -o /out/bao . \
 && go version -m /out/bao > /out/records/go-version-m.txt \
 && cp vendor/modules.txt /out/records/vendor-modules.txt \
 && cp go.mod /out/records/effective.go.mod \
 && cp go.sum /out/records/effective.go.sum \
 && cp LICENSE /out/records/ \
 && printf '%s\n' "${SOURCE_COMMIT}" > /out/records/upstream-commit \
 && printf '%s\n' "${GO_BUMPS}" > /out/records/bumps \
 && printf 'openbao,ui\n' > /out/records/tags \
 && printf 'nonroot:x:65532:65532:nonroot:/openbao:/sbin/nologin\n' > /out/rootfs/etc/passwd \
 && printf 'nonroot:x:65532:\n' > /out/rootfs/etc/group \
 && chmod 1777 /out/rootfs/tmp \
 && cp /sources/openbao.tar.gz /out/source/openbao-${VERSION}.tar.gz \
 && cp -R /out/records /out/source/records \
 && tar -czf /out/source/vendor.tar.gz vendor \
 && cd /out/source && find records -type f -exec sha256sum {} \; > SHA256SUMS \
 && sha256sum *.tar.gz >> SHA256SUMS

FROM scratch AS source
LABEL io.thepeoples.hardened.build-owner="hardened-batch4"
COPY --from=build /out/source/ /

FROM scratch
ARG GO_IMAGE
ARG NODE_IMAGE
COPY --from=build --chown=65532:65532 /out/rootfs/ /
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=build --chmod=0755 /out/bao /usr/bin/bao
COPY --from=build /out/records/ /usr/share/tp-hardened/openbao/
USER 65532:65532
WORKDIR /openbao
ENV HOME=/openbao
EXPOSE 8200 8201
ENTRYPOINT ["/usr/bin/bao"]
CMD ["server", "-dev", "-dev-no-store-token"]
LABEL org.opencontainers.image.version="v2.7.1" \
      org.opencontainers.image.source="https://github.com/openbao/openbao" \
      org.opencontainers.image.revision="a5db72cef75c24b920ade02065b18dd8eb666bac" \
      org.opencontainers.image.licenses="MPL-2.0" \
      io.thepeoples.hardened.upstream="quay.io/openbao/openbao:2.7.1@sha256:6d2b93856e3fcf7b18ad855a0b51eaba474dc8b79cf554379ea32034797d2acf" \
      io.thepeoples.hardened.ladder="b+minimize" \
      io.thepeoples.hardened.toolchain="${GO_IMAGE}" \
      io.thepeoples.hardened.ui-toolchain="${NODE_IMAGE}" \
      io.thepeoples.hardened.source-status="upstream OpenBao release tarball plus this Containerfile, Ember UI rebuild, and recorded module changes"