FROM alpine as certs
RUN apk update && apk add ca-certificates

# note: using qemu with a multi-arch image results in redirects not working with wget
# so let docker pull the image that matches the hosts architecture first and then pull the correct asset
FROM busybox:1.36.1-musl

# cosign is pinned (and checksum verified) so the install tests always run with a cosign that can verify
# sigstore bundles (releases >= v1.53.0 need v2.5.0 or newer)
ARG COSIGN_VERSION=v3.1.3
ARG COSIGN_SHA256_AMD64=4629c757b7618056f8ddd7e2625ae9fdd94c0372a65049520bc7d9df9efc7f71
ARG COSIGN_SHA256_ARM64=c5d324e091826b0d7a78eb16fef316450b4eb9aaec045611c08ba06f5e73220a
RUN ARCH=$(uname -m) && \
    if [ "$ARCH" = "x86_64" ]; then \
        COSIGN_ARCH="amd64"; COSIGN_SHA256="${COSIGN_SHA256_AMD64}"; \
    elif [ "$ARCH" = "aarch64" ]; then \
        COSIGN_ARCH="arm64"; COSIGN_SHA256="${COSIGN_SHA256_ARM64}"; \
    else \
        echo "Unsupported architecture: $ARCH" && exit 1; \
    fi && \
    echo "Downloading cosign ${COSIGN_VERSION} for $COSIGN_ARCH" && \
    wget -O /bin/cosign https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-${COSIGN_ARCH} && \
    echo "${COSIGN_SHA256}  /bin/cosign" | sha256sum -c - && \
    chmod +x /bin/cosign

COPY --from=certs /etc/ssl/certs /etc/ssl/certs