# syntax=docker/dockerfile:1.7.0-labs
ARG TAG=24.04
ARG HASH=sha256:98ff7968124952e719a8a69bb3cccdd217f5fe758108ac4f21ad22e1df44d237
FROM ubuntu:${TAG}@${HASH} AS build

### Build stage

# Ubuntu archive state that all apt packages are installed from; bump it to pick up package updates
ARG UBUNTU_SNAPSHOT=20261021T000000Z
ARG GHC=9.6.3
ARG CABAL=3.10.2.0
ARG GHCUP_VER=0.2.6.2
ARG GHCUP_HASH_AMD64=9ed5da5449b48043a0d17e767c05d2ef585e25a639bb934329496c6d2fad9cf8
ARG GHCUP_HASH_ARM64=65a5f05120288ee4f1a81d28825374b6af317456a351a586adfce90c6dc29e3b
ARG GHCUP_METADATA=https://raw.githubusercontent.com/haskell/ghcup-metadata/ff5a77f2ee34afd9c49b970a45abfb7dac01cb8a/ghcup-0.1.0.yaml
ARG JAVA_VER=17.0.21.0.10
ARG JAVA_HASH_AMD64=8e7577ddeb5b17a13c73a6fe80b592f6e70299cd19f54d06976986b0bc7ada87
ARG JAVA_HASH_ARM64=c400e8ae70ee9565c23667bc3b4dd0fe5f7c403629ebb2cf9648c1d756b6b926

ENV TZ=Etc/UTC \
    DEBIAN_FRONTEND=noninteractive

ARG USER_UID=1000
ARG USER_GID=1000
ARG USER_NAME=builder

# The base image has no CA certificates, so they are fetched without TLS peer verification;
# apt still verifies every index against the GPG-signed InRelease files.
RUN sed -i -E "s#http://(archive|security|ports)\.ubuntu\.com/ubuntu(-ports)?/?#https://snapshot.ubuntu.com/ubuntu/${UBUNTU_SNAPSHOT}/#" \
        $(grep -rlsE 'http://(archive|security|ports)\.ubuntu\.com' /etc/apt/sources.list /etc/apt/sources.list.d) && \
    apt-get -o Acquire::https::Verify-Peer=false update --error-on=any && \
    apt-get -o Acquire::https::Verify-Peer=false install -y ca-certificates

# Install curl, git and and simplex-chat dependencies
RUN apt-get update --error-on=any && \
    apt-get install -y curl \
                       libpq-dev \
                       git \
                       strip-nondeterminism \
                       sqlite3 \
                       libsqlite3-dev \
                       build-essential \
                       libgmp3-dev \
                       zlib1g-dev \
                       llvm \
                       cmake \
                       llvm-dev \
                       libnuma-dev \
                       libssl-dev \
                       desktop-file-utils \
                       patchelf \
                       ca-certificates \
                       zip \
                       wget \
                       fuse3 \
                       file \
                       appstream \
                       gpg \
                       zipalign \
                       apksigner \
                       python3 \
                       python3-venv \
                       xz-utils \
                       unzip &&\
    ln -s /bin/fusermount /bin/fusermount3 || :

# Install Java Coretto
# Required, because official Java in Ubuntu
# depends on libjpeg.so.8 and liblcms2.so.2 which are NOT copied into final
# /usr/lib/runtime/lib directory and I do not have time to figure out gradle.kotlin
# to fix this :(
RUN export JAVA_FILENAME='java-corretto.deb' \
           JAVA_VER_MAJOR=$(printf "${JAVA_VER}" | awk -F. '{print $1}') \
           JAVA_VER_DEB="${JAVA_VER}-1" && \
    case "$(uname -m)" in \
        x86_64)  export JAVA_ARCH='amd64' JAVA_HASH="$JAVA_HASH_AMD64" ;; \
        aarch64) export JAVA_ARCH='arm64' JAVA_HASH="$JAVA_HASH_ARM64" ;; \
        *) echo "unknown arch $(uname -m)" && exit 1 ;; \
    esac && \
    curl --proto '=https' --tlsv1.2 -sSf \
         "https://corretto.aws/downloads/resources/${JAVA_VER}/java-${JAVA_VER_MAJOR}-amazon-corretto-jdk_${JAVA_VER_DEB}_${JAVA_ARCH}.deb" \
         -o "${JAVA_FILENAME}" && \
    if echo "${JAVA_HASH}  ${JAVA_FILENAME}" | sha256sum -c -; then \
        if apt install -y ./"${JAVA_FILENAME}"; then \
            rm ./"${JAVA_FILENAME}"; \
        else \
            echo "Failed to install Java Corretto" && exit 1; \
        fi \
    else \
        echo "Checksum mismatch" && exit 1; \
    fi

RUN userdel -r ubuntu || :
RUN groupadd -g ${USER_GID} ${USER_NAME} || :; useradd -u ${USER_UID} -g ${USER_GID} --create-home --shell /bin/bash ${USER_NAME} || :
RUN mkdir /nix /out && chown ${USER_NAME}:${USER_NAME} /nix /out
USER ${USER_NAME}
WORKDIR /home/${USER_NAME}

# Setup basic env variables (required)
ENV HOME="/home/${USER_NAME}" USER="${USER_NAME}"
# Adjust PATH
ENV PATH="$HOME/.cabal/bin:$HOME/.ghcup/bin:$PATH"

# Install ghcup, GHC and cabal
RUN case "$(uname -m)" in \
        x86_64)  export GHCUP_HASH="$GHCUP_HASH_AMD64" ;; \
        aarch64) export GHCUP_HASH="$GHCUP_HASH_ARM64" ;; \
        *) echo "unknown arch $(uname -m)" && exit 1 ;; \
    esac && \
    mkdir -p "$HOME/.ghcup/bin" && \
    curl --proto '=https' --tlsv1.2 -sSf \
         "https://downloads.haskell.org/~ghcup/${GHCUP_VER}/$(uname -m)-linux-ghcup-${GHCUP_VER}" \
         -o "$HOME/.ghcup/bin/ghcup" && \
    echo "${GHCUP_HASH}  $HOME/.ghcup/bin/ghcup" | sha256sum -c - && \
    chmod +x "$HOME/.ghcup/bin/ghcup" && \
    ghcup config set url-source "${GHCUP_METADATA}" && \
    ghcup install ghc "${GHC}" --set && \
    ghcup install cabal "${CABAL}" --set

#=====================
# Install Android SDK
#=====================
ARG SDK_VERSION=13114758
ARG SDK_HASH=7ec965280a073311c339e571cd5de778b9975026cfcbe79f2b1cdcb1e15317ee

ENV SDK_VERSION="$SDK_VERSION" \
    ANDROID_HOME="$HOME"

RUN curl -L -o tools.zip "https://dl.google.com/android/repository/commandlinetools-linux-${SDK_VERSION}_latest.zip" && \
    echo "${SDK_HASH}  tools.zip" | sha256sum -c - && \
    unzip tools.zip && rm tools.zip && \
    mv cmdline-tools tools && mkdir "$ANDROID_HOME/cmdline-tools" && mv tools "$ANDROID_HOME/cmdline-tools/" && \
    ln -s "$ANDROID_HOME/cmdline-tools/tools" "$ANDROID_HOME/cmdline-tools/latest"

ENV PATH="$PATH:$ANDROID_HOME/cmdline-tools/latest/bin:$ANDROID_HOME/cmdline-tools/tools/bin"

# https://askubuntu.com/questions/885658/android-sdk-repositories-cfg-could-not-be-loaded
RUN mkdir -p "$HOME/.android" "$HOME/.gradle" && \
    touch "$HOME/.android/repositories.cfg" && \
    echo 'org.gradle.console=plain' > "$HOME/.gradle/gradle.properties" &&\
    yes | sdkmanager --licenses >/dev/null

ENV PATH="$PATH:$ANDROID_HOME/platform-tools:$ANDROID_HOME/build-tools"

# Android reproducibility scripts
RUN python3 -m venv "$HOME/.venv"
RUN printf '%s\n' \
        'apksigcopier==1.1.1 --hash=sha256:0834bb7d6f3607bb0994cf8cd2e26b8f0c9d481e13b75872e0fa9cec052e519b' \
        'repro-apk==0.3.0 --hash=sha256:09091a5e6d725d73ad418aa98ec72d0737452d3ce3803b56dd5c270b887fceb9' \
        'click==8.5.0 --hash=sha256:255bc9599cf7748b4b1a446ccc735421bd08a2ae529a8b88597d3de5664ee360' \
        > /tmp/requirements.txt && \
    "$HOME/.venv/bin/pip" install --require-hashes --only-binary=:all: -r /tmp/requirements.txt && \
    rm /tmp/requirements.txt

ENV PATH="$HOME/.venv/bin:$PATH"

WORKDIR /project