content: # SPDX-License-Identifier: MIT
  
  # The image argument needs to be placed on top
  ARG BASE_IMAGE
  FROM ${BASE_IMAGE}
  
  ARG GOSEC_VERSION
  
  # The remaining arguments need to be placed after the `FROM`
  # See: https://ryandaniels.ca/blog/docker-dockerfile-arg-from-arg-trouble/
  
  LABEL org.opencontainers.image.source="https://github.com/mercedes-benz/sechub"
  LABEL org.opencontainers.image.title="SecHub GoSec+PDS Image"
  LABEL org.opencontainers.image.description="A container which combines GoSec with the SecHub Product Delegation Server (PDS)"
  LABEL maintainer="SecHub FOSS Team"
  
  # Build args
  ARG GO="go1.24.4.linux-amd64.tar.gz"
  
  # Environment variables in container
  ENV GOSEC_VERSION="${GOSEC_VERSION}"
  
  USER root
  
  # Copy mock folder
  COPY mocks "$MOCK_FOLDER"
  
  # Copy scripts
  COPY scripts "$SCRIPT_FOLDER"
  RUN chmod --recursive +x "$SCRIPT_FOLDER"
  
  # Copy PDS configfile
  COPY pds-config.json "$PDS_FOLDER/pds-config.json"
  
  RUN export DEBIAN_FRONTEND=noninteractive && \
      apt-get update && \
      apt-get --assume-yes upgrade && \
      apt-get --assume-yes install w3m wget && \
      apt-get --assume-yes clean
  
  # Install Go
  RUN cd "$DOWNLOAD_FOLDER" && \
      # Get checksum from Go download site
      GO_CHECKSUM=`w3m https://go.dev/dl/ | grep "$GO" | tail -1 | awk '{print $6}'` && \
      # create checksum file
      echo "$GO_CHECKSUM $GO" > "$GO.sha256sum" && \
      # download Go
      wget --no-verbose https://go.dev/dl/"${GO}" && \
      # verify that the checksum and the checksum of the file are same
      sha256sum --check "$GO.sha256sum" && \
      # extract Go
      tar --extract --file "$GO" --directory /usr/local/ && \
      # remove go tar.gz
      rm "$GO"* && \
      # add Go to path
      echo 'export PATH="/usr/local/go/bin:$PATH":' >> /root/.bashrc
  
  # Install GoSec
  RUN cd "$DOWNLOAD_FOLDER" && \
      # download gosec
      wget --no-verbose https://github.com/securego/gosec/releases/download/v${GOSEC_VERSION}/gosec_${GOSEC_VERSION}_linux_amd64.tar.gz && \
      # download checksum
      wget --no-verbose https://github.com/securego/gosec/releases/download/v${GOSEC_VERSION}/gosec_${GOSEC_VERSION}_checksums.txt && \
      # verify checksum
      sha256sum --check --ignore-missing "gosec_${GOSEC_VERSION}_checksums.txt" && \
      # create gosec folder
      mkdir --parents "$TOOL_FOLDER/gosec" && \
      # unpack GoSec into tools folder
      tar --extract --ungzip --file "gosec_${GOSEC_VERSION}_linux_amd64.tar.gz" --directory "$TOOL_FOLDER/gosec" && \
      # Cleanup download folder
      rm --recursive --force "$DOWNLOAD_FOLDER"/*
  
  # Set workspace
  WORKDIR "$WORKSPACE"
  
  # Switch from root to non-root user
  USER "$USER"
  