Containerfile.toolchain

# Containerfile.toolchain — complete runtime image for Traust.
#
# Everything a consumer needs in one image: pinned scanner binaries, Python
# stack (traust-engine + contracts + traust-ledger + traust), and
# harness skill data. SCI k8s jobs and CI runners pull this and go.
#
# Build (always use the wrapper — it reads pins from external-tools.yaml
# and pre-builds Python wheels from sibling repos):
#   ./scripts/build-toolchain-image.sh
#   ./scripts/build-toolchain-image.sh --tag myregistry/harness-toolchain:v0.331
#   ./scripts/build-toolchain-image.sh --no-db
#
# Use in a k8s Job (SCI):
#   image: registry.internal/harness-toolchain:v0.331
#   args: ["doctor", "--profile", "secure-code-audit"]
#
# Use locally:
#   podman run --rm -v $PWD:/workspace:Z harness-toolchain:latest \
#     doctor --profile secure-code-audit

FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:a21d19f72557aa893a0f6ca1177bb1ffd91df6015e60470a116c50a6a05efcd9 AS base

ARG TARGETARCH

# Versions pinned from config/external-tools.yaml — bump here when pins advance.
ARG OPENGREP_VERSION=1.25.0
ARG GITLEAKS_VERSION=8.30.1
ARG SYFT_VERSION=1.48.0
ARG GRYPE_VERSION=0.115.0
ARG OSV_SCANNER_VERSION=2.4.0
ARG COSIGN_VERSION=3.1.1
ARG GOVULNCHECK_VERSION=1.6.0
ARG SKOPEO_VERSION=1.23.0
ARG YARA_VERSION=4.5.8
ARG PIP_AUDIT_VERSION=2.10.1

LABEL name="harness-toolchain" \
      summary="Traust — complete runtime image" \
      description="All-in-one image: pinned scanner binaries (grype, osv-scanner, \
govulncheck, opengrep, gitleaks, syft, cosign, skopeo, yara, pip-audit), the full \
Python stack (traust-engine, contracts, traust-ledger, traust), and \
skill data. Pull, mount a target, run a profile." \
      vendor="Red Hat, Inc."

# System deps for yara build and general tooling
RUN microdnf install -y \
      git tar gzip unzip findutils \
      python3.11 python3.11-pip \
      skopeo \
    && microdnf clean all

# Install Go (needed for govulncheck)
ARG GO_VERSION=1.23.0
RUN curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${TARGETARCH}.tar.gz" \
    | tar -C /usr/local -xz
ENV PATH="/usr/local/go/bin:/root/go/bin:/root/.opengrep/cli/latest:${PATH}"

# --- Direct binary downloads from upstream GitHub releases ---

# opengrep (install script handles arch detection; -v pins version)
RUN curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh \
    | bash -s -- -v "v${OPENGREP_VERSION}"

# gitleaks
RUN ARCH=$([ "$TARGETARCH" = "arm64" ] && echo "arm64" || echo "x64") && \
    curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_${ARCH}.tar.gz" \
    | tar -C /usr/local/bin -xz gitleaks

# syft
RUN curl -fsSL "https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/syft_${SYFT_VERSION}_linux_${TARGETARCH}.tar.gz" \
    | tar -C /usr/local/bin -xz syft

# grype
RUN curl -fsSL "https://github.com/anchore/grype/releases/download/v${GRYPE_VERSION}/grype_${GRYPE_VERSION}_linux_${TARGETARCH}.tar.gz" \
    | tar -C /usr/local/bin -xz grype

# osv-scanner
RUN ARCH=$([ "$TARGETARCH" = "arm64" ] && echo "arm64" || echo "amd64") && \
    curl -fsSL "https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_${ARCH}" \
      -o /usr/local/bin/osv-scanner && chmod +x /usr/local/bin/osv-scanner

# cosign
RUN ARCH=$([ "$TARGETARCH" = "arm64" ] && echo "arm64" || echo "amd64") && \
    curl -fsSL "https://github.com/sigstore/cosign/releases/download/v${COSIGN_VERSION}/cosign-linux-${ARCH}" \
      -o /usr/local/bin/cosign && chmod +x /usr/local/bin/cosign

# govulncheck
RUN GOBIN=/usr/local/bin go install "golang.org/x/vuln/cmd/govulncheck@v${GOVULNCHECK_VERSION}"

# --- Hybrid tools ---

# yara (from EPEL or build — using prebuilt RPM)
RUN microdnf install -y yara 2>/dev/null \
    || (curl -fsSL "https://github.com/VirusTotal/yara/releases/download/v${YARA_VERSION}/yara-${YARA_VERSION}.tar.gz" \
        | tar -C /tmp -xz && cd /tmp/yara-${YARA_VERSION} \
        && ./bootstrap.sh && ./configure && make -j$(nproc) && make install \
        && rm -rf /tmp/yara-*) \
    || true

# pip-audit
RUN python3.11 -m pip install --no-cache-dir "pip-audit==${PIP_AUDIT_VERSION}"

# joern is too large for the base image (JVM + ~800MB). Skills that need it
# should extend this image or use the impact profile separately.

# --- Python stack: harness engine + contracts + traust-ledger + harness CLI ---
# The build script pre-builds pure-Python wheels from sibling repos into _build/wheels/.
# Native deps (from requirements.txt) are installed from PyPI inside the container.
COPY requirements.txt /tmp/requirements.txt
RUN python3.11 -m pip install --no-cache-dir -r /tmp/requirements.txt && rm /tmp/requirements.txt
COPY _build/wheels/ /tmp/wheels/
RUN python3.11 -m pip install --no-cache-dir --no-deps --no-index --find-links /tmp/wheels \
      /tmp/wheels/*.whl \
    && rm -rf /tmp/wheels

# --- Harness skill data ---
COPY harnessing/ /harness/harnessing/
COPY config/     /harness/config/
# Deployment config (corpus-config, product map, …) is mounted, never baked in.
ENV TRAUST_CONFIG_HOME=/harness/deploy-config
COPY docs/       /harness/docs/
COPY VERSION     /harness/

ENV HARNESS_ROOT=/harness

# --- Populate vuln DBs (can be skipped at build time with --build-arg SKIP_DB=1) ---
ARG SKIP_DB=0
ENV OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY=/root/.cache/osv-scanner
RUN if [ "$SKIP_DB" = "0" ]; then \
      grype db update || true; \
      osv-scanner scan source --offline-vulnerabilities --download-offline-databases -r /tmp || true; \
    fi

# --- Smoke test: verify all tools resolve ---
RUN opengrep --version && \
    gitleaks version && \
    syft --version && \
    grype --version && \
    osv-scanner --version && \
    cosign version && \
    govulncheck -version && \
    skopeo --version && \
    echo "All tools verified on PATH"

USER 1001
WORKDIR /workspace

ENTRYPOINT ["python3.11", "-m", "traust.cli.toolchain"]
CMD ["doctor", "--profile", "secure-code-audit"]