ARG IMAGE_NAME=redhat/ubi
ARG IMAGE_VERSION

FROM $IMAGE_NAME$IMAGE_VERSION

ARG IMAGE_VERSION

# Install helpers for the Bash scripts (`vim-common` for the `xxd` utility):
RUN dnf install -y vim-common bc

# Install the PKCS#11 engine for OpenSSL:
RUN dnf install -y openssl-pkcs11

# Add Fedora Extra Packages for Enterprise Linux (EPEL) (necessary for `gnupg-pkcs11-scd`):
RUN dnf -y install "https://dl.fedoraproject.org/pub/epel/epel-release-latest-$IMAGE_VERSION.noarch.rpm"

# Install `opensc` from CentOS Stream to install `pkcs11-tool` command (use download / `rpm -i --nodeps` workaround to fix issues with conflicting dependency versions):
RUN   if [ "$IMAGE_VERSION" = "8" ]; then CENTOS_STREAM_REPO="centosstream,https://vault.centos.org/8-stream/BaseOS/x86_64/os/"; \
    elif [ "$IMAGE_VERSION" = "9" ]; then CENTOS_STREAM_REPO="centosstream,https://mirror.stream.centos.org/9-stream/BaseOS/x86_64/os/"; \
    else echo "RedHat $IMAGE_VERSION currently not supported"; exit 1; fi; \
    dnf download opensc --repofrompath $CENTOS_STREAM_REPO && rpm -i opensc-*.rpm --nodeps && rm -f opensc-*.rpm

# Install dependencies for GPG signing (`gnupg-pkcs11-scd` requires EPEL):
RUN dnf install -y gnupg2 gnupg-pkcs11-scd

# Install `rpm-sign` dependency from CentOS Stream (use download / `rpm -i --nodeps` workaround to fix the issue that rpm-sign's *exact version* dependency conflicts with `rpm-build`):
RUN   if [ "$IMAGE_VERSION" = "8" ]; then CENTOS_STREAM_REPO="centosstream,https://vault.centos.org/8-stream/BaseOS/x86_64/os/"; \
    elif [ "$IMAGE_VERSION" = "9" ]; then CENTOS_STREAM_REPO="centosstream,https://mirror.stream.centos.org/9-stream/BaseOS/x86_64/os/"; \
    else echo "RedHat $IMAGE_VERSION currently not supported"; exit 1; fi; \
    dnf download rpm-sign --repofrompath $CENTOS_STREAM_REPO && rpm -i rpm-sign-*.rpm --nodeps && rm -f rpm-sign-*.rpm

# Install dependencies for Jar signing and (GPG based) Maven signing (requires EPEL):
RUN dnf install -y java-latest-openjdk-devel maven
