Dockerfile.elixir-runtime-validation-runner

# syntax=docker/dockerfile:1.7

ARG HYDRATOR_LOCAL_ALIAS
ARG FINAL_BASE_LOCAL_ALIAS

FROM ${HYDRATOR_LOCAL_ALIAS} AS hydrator

ARG SOURCE_SHA
ARG SOURCE_STATUS_SHA256
ARG MIX_EXS_SHA256
ARG MIX_LOCK_SHA256
ARG CONFIG_SHA256
ARG DOCKERFILE_SHA256
ARG HELPER_SHA256
ARG SCHEMA_SHA256
ARG HYDRATOR_IMAGE_ID
ARG HYDRATOR_ROOTFS_SHA256
ARG FINAL_BASE_IMAGE_ID
ARG FINAL_BASE_ROOTFS_SHA256
ARG ELIXIR_VERSION
ARG ERLANG_VERSION
ARG OTP_RELEASE
ARG HEX_VERSION
ARG REBAR_VERSION
ARG TOOLCHAIN_PROFILE
ARG INPUT_BUNDLE_SHA256
ARG INVOCATION_ID

ENV MIX_ENV=test \
    MIX_HOME=/hydrate/.mix \
    HEX_HOME=/hydrate/.hex \
    MIX_REBAR3=/usr/local/bin/rebar3

WORKDIR /hydrate

COPY mix.exs mix.lock ./
COPY config ./config
COPY .tamandua-config-files.sha256 /hydrate/provenance/config-files.sha256
COPY .tamandua-input-provenance.json /hydrate/provenance/input-provenance.json

RUN --network=none set -eu; \
    test "$(sha256sum mix.exs | cut -d' ' -f1)" = "${MIX_EXS_SHA256}"; \
    test "$(sha256sum mix.lock | cut -d' ' -f1)" = "${MIX_LOCK_SHA256}"; \
    (cd config && sha256sum -c /hydrate/provenance/config-files.sha256); \
    test ! -e /hydrate/lib; test ! -e /hydrate/priv; test ! -e /hydrate/test; \
    mkdir -p "${MIX_HOME}/archives" "${HEX_HOME}"; \
    cp -a "/root/.mix/archives/hex-${HEX_VERSION}" "${MIX_HOME}/archives/"; \
    test -x "${MIX_REBAR3}"

# The only networked command. Resolution remains constrained by the current locked dependency graph.
RUN --network=default set -eu; \
    lock_before="$(sha256sum mix.lock | cut -d' ' -f1)"; \
    if ! mix deps.get --only test --check-locked; then \
      printf '%s\n' 'TAMANDUA_HYDRATOR_DEPS_GET_FAILED_V1' >&2; \
      exit 41; \
    fi; \
    printf '%s\n' 'TAMANDUA_HYDRATOR_DEPS_GET_OK_V1'; \
    if test "$(sha256sum mix.lock | cut -d' ' -f1)" != "${lock_before}"; then \
      printf '%s\n' 'TAMANDUA_HYDRATOR_LOCK_CHANGED_V1' >&2; \
      exit 42; \
    fi

RUN --network=none set -eu; \
    mix deps.compile; \
    mix deps.loadpaths --no-compile; \
    test "$(sha256sum mix.lock | cut -d' ' -f1)" = "${MIX_LOCK_SHA256}"

RUN --network=none set -eu; \
    test "$(elixir --version | awk '/^Elixir / { print $2 }')" = "${ELIXIR_VERSION}"; \
    test "$(erl -noshell -eval 'io:format("~s", [erlang:system_info(otp_release)]), halt().' 2>/dev/null)" = "${OTP_RELEASE}"; \
    erlang_root="$(erl -noshell -eval 'io:format("~s", [code:root_dir()]), halt().' 2>/dev/null)"; \
    test "$(cat "${erlang_root}/releases/${OTP_RELEASE}/OTP_VERSION")" = "${ERLANG_VERSION}"; \
    mix hex.info | grep -E "^Hex:[[:space:]]+${HEX_VERSION}$" >/dev/null; \
    "${MIX_REBAR3}" version | grep -F "${REBAR_VERSION}" >/dev/null; \
    mix deps.loadpaths --no-compile; \
    test "$(sha256sum mix.lock | cut -d' ' -f1)" = "${MIX_LOCK_SHA256}"; \
    { elixir --version; mix --version; "${MIX_REBAR3}" version; cc --version | head -n 1; ld --version | head -n 1; } \
      > /hydrate/provenance/toolchain.txt; \
    find deps _build/test -type f -exec sha256sum '{}' + | LC_ALL=C sort \
      > /hydrate/provenance/hydrated-files.sha256; \
    test -s /hydrate/provenance/hydrated-files.sha256; \
    printf '%s\n' "${TOOLCHAIN_PROFILE}" > /hydrate/provenance/toolchain-profile.txt

FROM ${FINAL_BASE_LOCAL_ALIAS} AS final

ARG SOURCE_SHA
ARG SOURCE_STATUS_SHA256
ARG MIX_EXS_SHA256
ARG MIX_LOCK_SHA256
ARG CONFIG_SHA256
ARG DOCKERFILE_SHA256
ARG HELPER_SHA256
ARG SCHEMA_SHA256
ARG HYDRATOR_IMAGE_ID
ARG HYDRATOR_ROOTFS_SHA256
ARG FINAL_BASE_IMAGE_ID
ARG FINAL_BASE_ROOTFS_SHA256
ARG ELIXIR_VERSION
ARG ERLANG_VERSION
ARG OTP_RELEASE
ARG HEX_VERSION
ARG REBAR_VERSION
ARG TOOLCHAIN_PROFILE
ARG INPUT_BUNDLE_SHA256
ARG INVOCATION_ID

LABEL org.opencontainers.image.title="Tamandua Elixir-only runtime validation runner" \
      org.opencontainers.image.revision="${SOURCE_SHA}" \
      io.tamandua.validation.profile="elixir-only-current-lock-v1" \
      io.tamandua.validation.invocation="${INVOCATION_ID}" \
      io.tamandua.validation.source.status.sha256="${SOURCE_STATUS_SHA256}" \
      io.tamandua.validation.input.mix-exs.sha256="${MIX_EXS_SHA256}" \
      io.tamandua.validation.input.mix-lock.sha256="${MIX_LOCK_SHA256}" \
      io.tamandua.validation.input.config.sha256="${CONFIG_SHA256}" \
      io.tamandua.validation.input.dockerfile.sha256="${DOCKERFILE_SHA256}" \
      io.tamandua.validation.input.helper.sha256="${HELPER_SHA256}" \
      io.tamandua.validation.input.schema.sha256="${SCHEMA_SHA256}" \
      io.tamandua.validation.input.bundle.sha256="${INPUT_BUNDLE_SHA256}" \
      io.tamandua.validation.hydrator.id="${HYDRATOR_IMAGE_ID}" \
      io.tamandua.validation.hydrator.rootfs.sha256="${HYDRATOR_ROOTFS_SHA256}" \
      io.tamandua.validation.final-base.id="${FINAL_BASE_IMAGE_ID}" \
      io.tamandua.validation.final-base.rootfs.sha256="${FINAL_BASE_ROOTFS_SHA256}" \
      io.tamandua.validation.toolchain.profile="${TOOLCHAIN_PROFILE}" \
      io.tamandua.validation.tool.elixir="${ELIXIR_VERSION}" \
      io.tamandua.validation.tool.erlang="${ERLANG_VERSION}" \
      io.tamandua.validation.tool.otp="${OTP_RELEASE}" \
      io.tamandua.validation.tool.hex="${HEX_VERSION}" \
      io.tamandua.validation.tool.rebar="${REBAR_VERSION}"

ENV MIX_ENV=test \
    MIX_HOME=/opt/tamandua/.mix \
    HEX_HOME=/opt/tamandua/.hex \
    MIX_REBAR3=/usr/local/bin/rebar3

WORKDIR /app
COPY --from=hydrator /hydrate/mix.exs /hydrate/mix.lock ./
COPY --from=hydrator /hydrate/config ./config
COPY --from=hydrator /hydrate/deps ./deps
COPY --from=hydrator /hydrate/_build/test ./_build/test
COPY --from=hydrator /hydrate/.mix /opt/tamandua/.mix
COPY --from=hydrator /hydrate/provenance /opt/tamandua/provenance

RUN --network=none set -eu; \
    test ! -e lib; test ! -e priv; test ! -e test; \
    ! command -v psql >/dev/null 2>&1; \
    test -z "$(find / -xdev -type f -name psql -print -quit)"; \
    test "$(sha256sum mix.exs | cut -d' ' -f1)" = "${MIX_EXS_SHA256}"; \
    test "$(sha256sum mix.lock | cut -d' ' -f1)" = "${MIX_LOCK_SHA256}"; \
    (cd config && sha256sum -c /opt/tamandua/provenance/config-files.sha256); \
    mix deps.loadpaths --no-compile; \
    find deps _build/test -type f -exec sha256sum '{}' + | LC_ALL=C sort \
      | cmp -s - /opt/tamandua/provenance/hydrated-files.sha256; \
    nif_count="$(find _build/test -type f \( -name '*.so' -o -name '*.nif' \) -exec printf x ';' | wc -c)"; \
    test "${nif_count}" -gt 0; \
    find _build/test -type f \( -name '*.so' -o -name '*.nif' \) \
      -exec sh -c 'for nif do ldd "$nif" || exit 1; done' sh '{}' + \
      > /tmp/nif-ldd.txt; \
    test -s /tmp/nif-ldd.txt; \
    ! grep -F 'not found' /tmp/nif-ldd.txt

ENTRYPOINT ["/bin/sh", "-c"]
CMD ["MIX_ENV=test mix deps.loadpaths --no-compile"]