# Extend the qualified Go/Python image with software QEMU and verified guest bases.
FROM sha256:8d67dcbc40f144ff6a416b2c7cafd4f268f45a7d997e210b241804adb6d05120
USER 0:0
RUN apt-get update && apt-get install --yes --no-install-recommends \
      qemu-system-x86 qemu-utils ovmf cloud-image-utils socat openssh-client procps file \
    && rm -rf /var/lib/apt/lists/* \
    && dpkg-query -W > /usr/local/share/bootrecov-bootvm-packages.txt \
    && if test ! -f /usr/share/OVMF/OVMF_CODE.fd && test -f /usr/share/OVMF/OVMF_CODE_4M.fd; then \
         ln -s OVMF_CODE_4M.fd /usr/share/OVMF/OVMF_CODE.fd; \
         ln -s OVMF_VARS_4M.fd /usr/share/OVMF/OVMF_VARS.fd; fi
# Build operators supply official checksums; the final image pins every asset.
ARG BOOTVM_IMAGE_URL
ARG BOOTVM_IMAGE_SHA256
ARG ARCH_IMAGE_URL
ARG ARCH_IMAGE_SHA256
ARG DEBIAN_IMAGE_URL
ARG DEBIAN_IMAGE_SHA512
ARG FEDORA_IMAGE_URL
ARG FEDORA_IMAGE_SHA256
RUN test -n "$BOOTVM_IMAGE_URL" && test ${#BOOTVM_IMAGE_SHA256} -eq 64 \
    && test -n "$ARCH_IMAGE_URL" && test ${#ARCH_IMAGE_SHA256} -eq 64 \
    && test -n "$DEBIAN_IMAGE_URL" && test ${#DEBIAN_IMAGE_SHA512} -eq 128 \
    && test -n "$FEDORA_IMAGE_URL" && test ${#FEDORA_IMAGE_SHA256} -eq 64 \
    && mkdir -p /opt/bootrecov-vm \
    && cd /opt/bootrecov-vm \
    && curl --fail --show-error --location --proto '=https' --tlsv1.2 "$BOOTVM_IMAGE_URL" -o ubuntu-noble-server-cloudimg-amd64.img \
    && printf '%s  %s\n' "$BOOTVM_IMAGE_SHA256" ubuntu-noble-server-cloudimg-amd64.img | sha256sum --check --strict \
    && curl --fail --show-error --location --proto '=https' --tlsv1.2 "$ARCH_IMAGE_URL" -o Arch-Linux-x86_64-cloudimg.qcow2 \
    && printf '%s  %s\n' "$ARCH_IMAGE_SHA256" Arch-Linux-x86_64-cloudimg.qcow2 > Arch-Linux-x86_64-cloudimg.qcow2.SHA256 \
    && sha256sum --check --strict Arch-Linux-x86_64-cloudimg.qcow2.SHA256 \
    && curl --fail --show-error --location --proto '=https' --tlsv1.2 "$DEBIAN_IMAGE_URL" -o debian-12-genericcloud-amd64.qcow2 \
    && printf '%s  %s\n' "$DEBIAN_IMAGE_SHA512" debian-12-genericcloud-amd64.qcow2 | sha512sum --check --strict \
    && curl --fail --show-error --location --proto '=https' --tlsv1.2 "$FEDORA_IMAGE_URL" -o Fedora-Cloud-Base-Generic-44-1.7.x86_64.qcow2 \
    && printf '%s  %s\n' "$FEDORA_IMAGE_SHA256" Fedora-Cloud-Base-Generic-44-1.7.x86_64.qcow2 | sha256sum --check --strict \
    && sha256sum *.img *.qcow2 > bases.sha256 \
    && chmod -R a+rX /opt/bootrecov-vm
USER 7051508:1004
