# The image every tool container runs from (M3b spec, section 7; the brief's authority contract 4).
# Built from this repository's source by Nix on the host that runs brokerd, loaded with
# `podman load`, and named by digest in brokerd.toml's `[runner] image`. Nothing is pulled at call
# time.
#
#   nix-build deploy/tools-image.nix     # from the repository root; result is an image tarball
#   podman load < result
#   podman image inspect --format '{{.Digest}}' localhost/boxmaker-tools:latest
#
# Contents: /bin/toolkit (static, musl), busybox with every applet (so /bin/sh is busybox's),
# /bin/curl (static), the CA bundle. No package manager, no compiler, nothing else.
{ pkgs ? import <nixpkgs> { } }:
let
  static = pkgs.pkgsStatic;
  src = pkgs.lib.cleanSourceWith {
    src = ../.;
    # Only what the build reads: no target/, no .state/, no docs.
    filter = path: type:
      let rel = pkgs.lib.removePrefix (toString ../. + "/") (toString path);
      in rel == "Cargo.toml" || rel == "Cargo.lock"
        || rel == "crates" || pkgs.lib.hasPrefix "crates/" rel;
  };
  toolkit = static.rustPlatform.buildRustPackage {
    pname = "boxmaker-toolkit";
    version = "0.1.0";
    inherit src;
    cargoLock.lockFile = ../Cargo.lock;
    cargoBuildFlags = [ "-p" "toolkit" ];
    doCheck = false; # the tests run in `make gate`, on the development machine
  };
  root = pkgs.runCommand "boxmaker-tools-root" { } ''
    mkdir -p $out/bin $out/etc/ssl/certs $out/tmp $out/run/egress
    # busybox first: `cp -a` keeps the store's read-only modes, so make the copies writable after.
    cp -a ${static.busybox}/bin/. $out/bin/
    chmod -R u+w $out/bin
    cp ${toolkit}/bin/toolkit $out/bin/toolkit
    cp ${static.curl.bin}/bin/curl $out/bin/curl
    cp ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs/ca-certificates.crt
  '';
in
pkgs.dockerTools.buildLayeredImage {
  name = "boxmaker-tools";
  tag = "latest";
  contents = [ root ];
  config.WorkingDir = "/tmp";
}