FROM --platform=linux/amd64 ubuntu:20.04@sha256:33a5cc25d22c45900796a1aca487ad7a7cb09f09ea00b779e3b2026b4fc2faba
RUN apt update -y && apt install make python3 curl unzip jq -y
# cosign is pinned (and checksum verified) so the install tests always run with a cosign that can verify
# sigstore bundles (releases >= v1.53.0 need v2.5.0 or newer)
ARG COSIGN_VERSION=v3.1.3
ARG COSIGN_SHA256=4629c757b7618056f8ddd7e2625ae9fdd94c0372a65049520bc7d9df9efc7f71
RUN curl -sSfL -o /usr/local/bin/cosign "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-amd64" && \
    echo "${COSIGN_SHA256}  /usr/local/bin/cosign" | sha256sum -c - && \
    chmod +x /usr/local/bin/cosign