content: # syntax=docker/dockerfile:experimental
  # Copyright 2021 Integritee AG
  #
  # Licensed under the Apache License, Version 2.0 (the "License");
  # you may not use this file except in compliance with the License.
  # You may obtain a copy of the License at
  #
  #           http://www.apache.org/licenses/LICENSE-2.0
  #
  # Unless required by applicable law or agreed to in writing, software
  # distributed under the License is distributed on an "AS IS" BASIS,
  # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  # See the License for the specific language governing permissions and
  # limitations under the License.
  
  # This is a multi-stage docker file, where the first stage is used
  # for building and the second deploys the built application.
  
  ### Cached Builder Stage
  ##################################################
  # A builder stage that uses sccache to speed up local builds with docker
  # Installation and setup of sccache should be moved to the integritee-dev image, so we don't
  # always need to compile and install sccache on CI (where we have no caching so far).
  FROM integritee/integritee-dev:0.2.2 AS builder
  LABEL maintainer="zoltan@integritee.network"
  
  # set environment variables
  ENV SGX_SDK /opt/sgxsdk
  ENV PATH "$PATH:${SGX_SDK}/bin:${SGX_SDK}/bin/x64:/opt/rust/bin"
  ENV PKG_CONFIG_PATH "${PKG_CONFIG_PATH}:${SGX_SDK}/pkgconfig"
  ENV LD_LIBRARY_PATH "${LD_LIBRARY_PATH}:${SGX_SDK}/sdk_libs"
  ENV CARGO_NET_GIT_FETCH_WITH_CLI true
  
  # Default SGX MODE is software mode
  ARG SGX_MODE=SW
  ENV SGX_MODE=$SGX_MODE
  
  ARG SGX_PRODUCTION=0
  ENV SGX_PRODUCTION=$SGX_PRODUCTION
  
  
  ENV WORKHOME=/home/ubuntu/work
  ENV HOME=/home/ubuntu
  
  RUN rustup default stable
  RUN cargo install --version 0.4.1 sccache --locked
  
  ENV SCCACHE_CACHE_SIZE="20G"
  ENV SCCACHE_DIR=$HOME/.cache/sccache
  ENV RUSTC_WRAPPER="/opt/rust/bin/sccache"
  
  ARG WORKER_MODE_ARG
  ARG ADDITIONAL_FEATURES_ARG
  ENV WORKER_MODE=$WORKER_MODE_ARG
  ENV ADDITIONAL_FEATURES=$ADDITIONAL_FEATURES_ARG
  
  ARG FINGERPRINT=none
  
  ARG SGX_COMMERCIAL_KEY=enclave-runtime/Enclave_private.pem
  ENV SGX_COMMERCIAL_KEY ${SGX_COMMERCIAL_KEY}
  
  ARG SGX_PASSFILE
  ENV SGX_PASSFILE ${SGX_PASSFILE}
  
  WORKDIR $WORKHOME/worker
  
  COPY . .
  
  RUN --mount=type=cache,id=cargo-registry-cache,target=/opt/rust/registry/cache,sharing=private \
  	--mount=type=cache,id=cargo-registry-index,target=/opt/rust/registry/index,sharing=private \
  	--mount=type=cache,id=cargo-git,target=/opt/rust/git/db,sharing=private \
  	--mount=type=cache,id=cargo-sccache-${WORKER_MODE}${ADDITIONAL_FEATURES},target=/home/ubuntu/.cache/sccache \
  	echo ${FINGERPRINT} && make && make identity && sccache --show-stats
  
  ### Base Runner Stage
  ### The runner needs the aesmd service for the `SGX_MODE=HW`.
  ######################################################
  FROM oasisprotocol/aesmd:master AS runner
  ENV SGX_SDK /opt/sgxsdk
  ENV LD_LIBRARY_PATH "${SGX_SDK}/sdk_libs"
  RUN apt-get install -y \
  	libsgx-aesm-ecdsa-plugin \
  	libsgx-ae-qve \
  	libsgx-aesm-quote-ex-plugin \
  	libsgx-dcap-default-qpl \
  	libsgx-dcap-ql \
  	libsgx-dcap-quote-verify \
  	libsgx-epid \
  	libsgx-headers \
  	libsgx-quote-ex \
  	libsgx-ra-network \
  	libsgx-ra-uefi \
  	libsgx-uae-service
  
  ### Deployed CLI client
  ##################################################
  FROM runner AS deployed-client
  LABEL maintainer="zoltan@integritee.network"
  
  ARG SCRIPT_DIR=/usr/local/worker-cli
  ARG LOG_DIR=/usr/local/log
  
  ENV SCRIPT_DIR ${SCRIPT_DIR}
  ENV LOG_DIR ${LOG_DIR}
  
  COPY --from=builder /home/ubuntu/work/worker/bin/integritee-cli /usr/local/bin
  COPY ./cli/*.sh /usr/local/worker-cli/
  
  RUN chmod +x /usr/local/bin/integritee-cli ${SCRIPT_DIR}/*.sh
  RUN mkdir ${LOG_DIR}
  
  RUN ldd /usr/local/bin/integritee-cli && \
  	/usr/local/bin/integritee-cli --version
  
  ENTRYPOINT ["/usr/local/bin/integritee-cli"]
  
  
  ### Deployed worker service
  ##################################################
  FROM runner AS deployed-worker
  LABEL maintainer="zoltan@integritee.network"
  
  WORKDIR /usr/local/bin
  
  COPY --from=builder /opt/sgxsdk /opt/sgxsdk
  COPY --from=builder /home/ubuntu/work/worker/bin/* ./
  COPY --from=builder /home/ubuntu/work/worker/extract_identity ./
  COPY --from=builder /lib/x86_64-linux-gnu/libsgx* /lib/x86_64-linux-gnu/
  COPY --from=builder /lib/x86_64-linux-gnu/libdcap* /lib/x86_64-linux-gnu/
  
  RUN chmod +x /usr/local/bin/integritee-service
  RUN chmod +x /usr/local/bin/extract_identity
  RUN ls -al /usr/local/bin
  
  # checks
  ENV SGX_SDK /opt/sgxsdk
  ENV SGX_ENCLAVE_SIGNER $SGX_SDK/bin/x64/sgx_sign
  ENV LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/intel/sgx-aesm-service/aesm:$SGX_SDK/sdk_libs
  ENV AESM_PATH=/opt/intel/sgx-aesm-service/aesm
  
  COPY ./docker/entrypoint.sh /entrypoint.sh
  RUN chmod +x /entrypoint.sh
  
  
  RUN ldd /usr/local/bin/integritee-service && \
  	/usr/local/bin/integritee-service --version
  
  ENTRYPOINT ["/entrypoint.sh"]
  