ARG BASE_IMAGE=artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9

FROM ${BASE_IMAGE} AS image
ARG DISTRO=alma9
COPY distros/${DISTRO}/ /tmp/distro/
# DL3041: versions are pinned by the estate dnf repos, not here. SC2086: $PACKAGES is a
# word list on purpose. DL4006: the only pipe ends in sha256sum, whose status is the
# pipeline's, and set -e catches it. zchunk is off because artifactapi ignores Range requests.
# hadolint ignore=DL3041,DL4006,SC2086
RUN set -eux; \
    . /tmp/distro/distro.env; \
    rm -f /etc/yum.repos.d/*.repo; \
    curl -fsSL -o /tmp/ca.rpm "$CA_RPM_URL"; \
    echo "$CA_RPM_SHA256  /tmp/ca.rpm" | sha256sum -c -; \
    rpm -i /tmp/ca.rpm; \
    cp /tmp/distro/yum.repos.d/*.repo /etc/yum.repos.d/; \
    sed -i '/^\[main\]/a zchunk=False' /etc/dnf/dnf.conf; \
    dnf makecache; \
    dnf update -y; \
    dnf install -y $PACKAGES; \
    dnf clean all; \
    rm -rf /var/cache/dnf /tmp/ca.rpm /tmp/distro
CMD ["/bin/bash"]