ARG GO_IMAGE=docker.io/library/golang:1.27.2-alpine3.24@sha256:85dc1069ac644ea3c527b177303a406eb3358192816cd7f9e5848eb658851673
ARG UPSTREAM=ghcr.io/oliver006/redis_exporter@sha256:6ca518a72f30f7f576ef92963de1b91d3c3f5fd3aeac949f878bfda183587820
FROM ${GO_IMAGE} AS build
LABEL io.thepeoples.hardened.build-owner="hardened-batch3-slice3"
ARG SOURCE_URL=https://codeload.github.com/oliver006/redis_exporter/tar.gz/589a1cd930d62ba449a5207179ab44252e359c66
ARG SOURCE_SHA256=4837e788905bb5262c391baa055171b3a8ed5bccdde0b7f1b20ce169b0deacae
ARG SOURCE_COMMIT=589a1cd930d62ba449a5207179ab44252e359c66
ARG VERSION=v1.93.0
ARG BUILD_DATE=2026-10-01T05:13:49Z
ARG GO_BUMPS=""
ENV GOTOOLCHAIN=local CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOMAXPROCS=4
WORKDIR /src
RUN wget -q -O /tmp/upstream.tar.gz "${SOURCE_URL}" \
 && printf '%s  %s\n' "${SOURCE_SHA256}" /tmp/upstream.tar.gz | sha256sum -c - \
 && tar -xzf /tmp/upstream.tar.gz --strip-components=1 -C /src
RUN mkdir -p /out/records /out/source \
 && cp go.mod /out/records/upstream.go.mod \
 && cp go.sum /out/records/upstream.go.sum \
 && if [ -n "${GO_BUMPS}" ]; then go get ${GO_BUMPS}; fi \
 && go mod download \
 && go mod verify \
 && go build -p 4 -mod=readonly -buildvcs=false -trimpath -ldflags "-s -w -X main.BuildVersion=${VERSION} -X main.BuildCommitSha=${SOURCE_COMMIT} -X main.BuildDate=${BUILD_DATE}" -o /out/exporter . \
 && go version -m /out/exporter > /out/records/go-version-m.txt \
 && go list -m -json all > /out/records/modules.json \
 && printf '%s\n' "${SOURCE_COMMIT}" > /out/records/upstream-commit \
 && printf '%s\n' "${GO_BUMPS}" > /out/records/bumps \
 && cp go.mod go.sum LICENSE /out/records/ \
 && mkdir /out/licenses && cp LICENSE /out/licenses/ \
 && if [ -f NOTICE ]; then cp NOTICE /out/records/ && cp NOTICE /out/licenses/; fi \
 && go mod vendor \
 && tar -czf /out/source/vendor.tar.gz vendor \
 && cp /tmp/upstream.tar.gz /out/source/upstream.tar.gz \
 && cp -R /out/records /out/source/records \
 && cd /out/source && sha256sum upstream.tar.gz vendor.tar.gz records/* > SHA256SUMS
FROM scratch AS source
LABEL io.thepeoples.hardened.build-owner="hardened-batch3-slice3"
COPY --from=build /out/source/ /
FROM ${UPSTREAM}
COPY --from=build --chmod=0755 /out/exporter /redis_exporter
COPY --from=build /out/records/go-version-m.txt /out/records/modules.json /out/records/upstream-commit /out/records/bumps /usr/share/tp-hardened/redis-exporter/
COPY --from=build /out/licenses/ /usr/share/tp-hardened/redis-exporter/licenses/
USER 59000:59000
LABEL org.opencontainers.image.version="v1.93.0" \
      org.opencontainers.image.source="https://github.com/oliver006/redis_exporter" \
      org.opencontainers.image.revision="589a1cd930d62ba449a5207179ab44252e359c66" \
      io.thepeoples.hardened.upstream="ghcr.io/oliver006/redis_exporter:v1.93.0@sha256:6ca518a72f30f7f576ef92963de1b91d3c3f5fd3aeac949f878bfda183587820" \
      io.thepeoples.hardened.ladder="b" \
      io.thepeoples.hardened.toolchain="go1.27.2" \
      io.thepeoples.hardened.source-status="export vendor and base sources before publication"