# shadow-rs development image — Debian Trixie (13)
#
# PAM: libpam0g-dev (Linux-PAM)
# SELinux: libselinux1-dev
# Default shell: /bin/bash
# Shadow-utils package: login + passwd
# Note: Trixie is now the default Debian for the Rust Docker image.

# Pinned: an unpinned tag lands a new toolchain on main with no PR signal,
# and clippy gains lints between releases. Renovate proposes the bump.
FROM rust:1.98-trixie

RUN apt-get update && apt-get install -y --no-install-recommends \
    libpam0g-dev \
    # uidmap: GNU newuidmap/newgidmap, for tests/gnu-compat.sh
    uidmap \
    libselinux1-dev \
    libaudit-dev \
    pkg-config \
    && rm -rf /var/lib/apt/lists/*

RUN rustup component add clippy rustfmt
# Two throwaway PAM services so the PAM wrapper can be tested against a stack
# whose answer is known. Without them the only coverage is the end-to-end image
# authenticating a real account, which cannot exercise a *refusal* without
# depending on a wrong password being wrong.
RUN printf 'auth required pam_permit.so\naccount required pam_permit.so\npassword required pam_permit.so\nsession required pam_permit.so\n' > /etc/pam.d/shadow-rs-test-permit \
    && printf 'auth required pam_deny.so\naccount required pam_deny.so\npassword required pam_deny.so\nsession required pam_deny.so\n' > /etc/pam.d/shadow-rs-test-deny


# cargo-deny: pinned, checksum-verified prebuilt binary. The static musl build
# runs on glibc too, so every image shares one asset. Installing the binary
# (instead of `cargo install cargo-deny`) skips a multi-minute source compile.
ARG CARGO_DENY_VERSION=0.19.8
ARG CARGO_DENY_SHA256=70e769ae3872e34d45132b17040859175e11401dc12dddb0303e0b8c7d088f3f
RUN curl -LsSf "https://github.com/EmbarkStudios/cargo-deny/releases/download/${CARGO_DENY_VERSION}/cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl.tar.gz" -o /tmp/cargo-deny.tar.gz \
    && echo "${CARGO_DENY_SHA256}  /tmp/cargo-deny.tar.gz" | sha256sum -c - \
    && tar zxf /tmp/cargo-deny.tar.gz -C /tmp \
    && install -m 0755 "/tmp/cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl/cargo-deny" /usr/local/cargo/bin/cargo-deny \
    && rm -rf /tmp/cargo-deny.tar.gz "/tmp/cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl" \
    && cargo-deny --version

RUN useradd -m -s /bin/bash testuser \
    && useradd -m -s /bin/sh testuser2 \
    && groupadd testgroup \
    && usermod -aG testgroup testuser

WORKDIR /workspace
CMD ["/bin/bash"]