# Batch 2 — official Traefik Helm chart 41.7.1. linux/amd64 only.
# Approved cluster pin was v3.6.12; v3.6.x cannot clear C/H (traefik/v3 CVEs
# only fixed in 3.7.13+; 3.6 security support ended 2026-08-16). Ladder (a)
# therefore follows the brief's "upstream v3 latest stable": v3.7.14
# (GitHub 2026-10-06). Then (c) apk upgrade and (b) rebuild the traefik
# binary from the same tag with Go 1.26.9 (upstream go1.26.8) and
# golang.org/x/net@v0.60.0.
# Index digest from podman pull linux/amd64 2026-10-10T20:33Z:
#   index sha256:575fa15b135078fe5e50aa847987d96dbddd7b093c172429618404df73f3fa7c
#   linux/amd64 sha256:5902d68e00708015736416b62faa49d23a2e1d4415649e5831d20b79ba301508
ARG GO_IMAGE=docker.io/library/golang:1.26.9@sha256:f1f0bcc2c524a3ced375fcb4d1ecb7aa371aa7070e112599aaca45cc02d0101b
ARG UPSTREAM=docker.io/library/traefik@sha256:575fa15b135078fe5e50aa847987d96dbddd7b093c172429618404df73f3fa7c
ARG REF=v3.7.14
FROM ${GO_IMAGE} AS build
ENV GOTOOLCHAIN=local CGO_ENABLED=0 GOWORK=off GOCACHE=/tmp/go-cache
COPY go-min-bump.sh /usr/local/bin/
ARG REF
ARG TRAEFIK_BUMPS="golang.org/x/net@v0.60.0"
RUN git clone --depth 1 --branch ${REF} https://github.com/traefik/traefik.git /src \
 && git -C /src rev-parse HEAD > /src/.upstream-commit
WORKDIR /src
RUN go-min-bump.sh ${TRAEFIK_BUMPS} > /traefik.bumps \
 && go build -trimpath -ldflags "-s -w -X github.com/traefik/traefik/v3/pkg/version.Version=${REF}" -o /traefik ./cmd/traefik \
 && rm -rf /tmp/go-cache

FROM ${UPSTREAM}
USER root
RUN apk upgrade --no-cache --available && rm -rf /var/cache/apk/* && apk list --installed > /etc/tp-hardened.apk-manifest
COPY --from=build --chmod=0755 /traefik /usr/local/bin/traefik
COPY --from=build /traefik.bumps /src/.upstream-commit /usr/share/tp-hardened/
LABEL org.opencontainers.image.version="v3.7.14" \
      io.thepeoples.hardened.upstream="docker.io/library/traefik:v3.7.14@sha256:575fa15b135078fe5e50aa847987d96dbddd7b093c172429618404df73f3fa7c" \
      io.thepeoples.hardened.replaces="docker.io/library/traefik:v3.7.14@sha256:575fa15b135078fe5e50aa847987d96dbddd7b093c172429618404df73f3fa7c" \
      io.thepeoples.hardened.ladder="a+b+c" \
      io.thepeoples.hardened.claim="package-fixable CRITICAL/HIGH cleared vs upstream digest; not FIPS/FedRAMP"