# syntax=docker/dockerfile:1
#
# aptly-deb-builder — turns a source tree into a signed-and-pushable .deb in
# one command (aptly-release). Ships both packaging paths:
#   - nfpm, for projects with no debian/ directory (a plain YAML descriptor)
#   - the real Debian toolchain, for projects that already have a debian/ dir
#
# renovate: datasource=github-releases depName=goreleaser/nfpm
ARG NFPM_VERSION=2.47.0
ARG NFPM_SHA256_AMD64=3f1cf344bd0b57373ca55636a78c08b0491f7293d609a456a9ac3b0b150fda97
ARG NFPM_SHA256_ARM64=27419eb382695a7942be8ad52259f3ec1854fad001b3ae4baed34ce39a223b97
ARG RUNTIME_IMAGE=debian:trixie-slim

FROM ${RUNTIME_IMAGE}
ARG TARGETARCH
ARG NFPM_VERSION
ARG NFPM_SHA256_AMD64
ARG NFPM_SHA256_ARM64

LABEL org.opencontainers.image.title="aptly-deb-builder" \
      org.opencontainers.image.description="Package, build and push .deb packages into an aptly repository in one step" \
      org.opencontainers.image.source="https://git.morlana.online/f.weber/aptly-containerized" \
      org.opencontainers.image.licenses="MIT"

# hadolint ignore=DL3008
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates curl jq gnupg \
      build-essential debhelper devscripts dpkg-dev fakeroot equivs \
    && rm -rf /var/lib/apt/lists/*

SHELL ["/bin/bash", "-o", "pipefail", "-c"]
RUN set -eux; \
    case "${TARGETARCH}" in \
      amd64) sha256="${NFPM_SHA256_AMD64}" ;; \
      arm64) sha256="${NFPM_SHA256_ARM64}" ;; \
      *) echo "unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
    esac; \
    curl -fsSL -o /tmp/nfpm.deb "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_${TARGETARCH}.deb"; \
    echo "${sha256}  /tmp/nfpm.deb" | sha256sum -c -; \
    dpkg -i /tmp/nfpm.deb; \
    rm -f /tmp/nfpm.deb

COPY rootfs/usr/local/bin/aptly-pack rootfs/usr/local/bin/aptly-push rootfs/usr/local/bin/aptly-release /usr/local/bin/
COPY rootfs/usr/local/bin/lib/ /usr/local/bin/lib/

WORKDIR /work
ENTRYPOINT []
CMD ["bash"]