# Build image for Anthropic's OSS Scanner (https://github.com/anthropics/oss-scanner).
#
# anthropics/oss-scanner's projects/openmetadata/project.yaml reads this file and
# threat_model.md by path. Moving or renaming them, changing the build context or /src, or
# excluding sources in the root .dockerignore breaks the enrolment; see
# ADR:2026-10-09-oss-scanner-build-image-paths-are-a-cross-repo-contract.
#
# The scanner builds this file with the repository checkout as the build context, then
# audits /src as root with NO network access. Anything needed to compile the server or run
# its unit tests must therefore be downloaded here, at build time.
#
# Scope: the OpenMetadata server, i.e. openmetadata-service and openmetadata-mcp plus the
# modules they depend on (common, openmetadata-spec and the shaded search clients). The UI,
# the Python ingestion framework and the k8s operator are in /src as source only; see
# threat_model.md next to this file.
#
# The JDK base and Maven pins match docker/olivaw/Dockerfile; bump them together.
FROM eclipse-temurin:21-jdk-jammy@sha256:dbfd085220ae632a0830166e443747d1ee89e9038d92e3b48c3e5e9d8292b9a7

# CVE-2026-91403 (ADR:2026-10-23-image-jdks-distrust-compromised-cas-by-deleting-roots):
# eMudhra's compromised intermediates chain to three emSign roots (ECC G3, ECC C3, C1). Oracle JDK
# 21.0.13.0.3 also removes emSign G1, G2 and Comodo's AAA Certificate Services from cacerts, so
# this step drops those too.
# This base is pinned by digest, so it keeps them until the digest moves to a Temurin that ships
# none of them; drop them here by SHA-256 and fail the build if any is still trusted.
# Roots, not the advisory's intermediate fingerprints in blocked.certs: an ECDSA signature
# re-encoded as (r, n-s) gives an intermediate a new fingerprint that still verifies.
RUN set -eu; \
    roots='86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B BC4D809B15189D78DB3E1D8CF4F9726A795DA1643CA5F1358E1DDB0EDC0D7EB3 125609AA301DA0A249B97A8239CB6A34216F44DCAC9F3954B14292F2E8C8608F 40F6AF0346A99AA1CD1D555A4E9CCE62C7F9634603EE406615833DC8C8D00367 1AA0C2709E831BD6E3B5129A00BA41F7EEEF020872F1E6504BF0F6C3F24F3AF3 D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF4'; \
    certs=$(keytool -list -v -cacerts -storepass changeit); \
    printf '%s\n' "$certs" \
      | awk -v roots="$roots" 'BEGIN { split(roots, r, " "); for (i in r) want[r[i]] = 1 } /^Alias name:/ { alias = substr($0, 13) } /SHA256:/ { gsub(":", "", $2); if ($2 in want) print alias }' \
      | while IFS= read -r alias; do keytool -delete -cacerts -storepass changeit -alias "$alias"; done; \
    certs=$(keytool -list -v -cacerts -storepass changeit); \
    if printf '%s\n' "$certs" | tr -d ':' | grep -qE "$(echo $roots | tr ' ' '|')"; then \
      echo "a root CA this step removes is still trusted" >&2; exit 1; \
    fi

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

ARG MAVEN_VERSION=3.9.9
ARG MAVEN_SHA512=a555254d6b53d267965a3404ecb14e53c3827c09c3b94b5678835887ab404556bfaf78dcfe03ba76fa2508649dca8531c74bca4d5846513522404d48e8c4ac8b

ENV DEBIAN_FRONTEND=noninteractive \
    MAVEN_HOME=/opt/maven \
    PATH=/opt/maven/bin:$PATH

# git: openmetadata-service's buildnumber-maven-plugin reads the commit from /src/.git.
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl git \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

RUN curl -fsSL --retry 3 --retry-all-errors \
        "https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz" \
        -o /tmp/maven.tar.gz \
    && echo "${MAVEN_SHA512}  /tmp/maven.tar.gz" | sha512sum --check --strict - \
    && mkdir -p "${MAVEN_HOME}" \
    && tar -xzf /tmp/maven.tar.gz -C "${MAVEN_HOME}" --strip-components=1 \
    && rm /tmp/maven.tar.gz \
    && mvn --version

# Scanner contract: the checkout lives inside the image, at /src.
COPY . /src
WORKDIR /src

# Build and install the server modules (and, through -am, common, openmetadata-spec and the
# shaded search clients) into /root/.m2, so that one module can be rebuilt and tested offline
# without -am, e.g.
#   mvn -o -pl openmetadata-service test -Dtest=JwtFilterTest
# Test classes are compiled here, not run.
RUN mvn -B -ntp -DskipTests install -pl openmetadata-service,openmetadata-mcp -am

# -DskipTests never resolves surefire's JUnit provider, so run the security unit tests once:
# that downloads it for offline use and proves the test setup works. Test failures are
# reported but do not fail the build; a broken test setup does.
RUN mvn -B -ntp -pl openmetadata-service surefire:test \
        -Dtest='org/openmetadata/service/security/**/*Test' \
        -Dsurefire.failIfNoSpecifiedTests=false \
        -Dmaven.test.failure.ignore=true
