FROM eclipse-temurin:21-jdk

# secs4java8 (kenta-shimizu) is a second independent SECS/HSMS
# implementation in Java.  We use it as a third-party peer to
# cross-validate our C++ server against — distinct author, distinct
# language ecosystem, distinct interpretation of the SEMI standards.
# If both libraries agree on wire bytes, that's much stronger evidence
# of spec-correctness than either alone.

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
        git \
        ca-certificates \
        bash \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /opt

# Pin to a tagged release if/when one becomes available; until then,
# pin to a known-working commit via depth=1 + checkout.  Replace with
# a SHA in CI for full reproducibility.
RUN git clone --depth 1 https://github.com/kenta-shimizu/secs4java8.git secs4java8
WORKDIR /opt/secs4java8

# secs4java8 ships a compile.sh that builds Export.jar.  Run it once
# at image build so the harness can just include the resulting jar.
RUN bash compile.sh

# Bake the harness into the image and compile it here.
#
# The previous arrangement bind-mounted the harness from the host at
# runtime, which fails when this script runs inside a CI container
# whose docker socket points at a daemon on a different filesystem —
# the host path interop/secs4j doesn't exist on the docker daemon's
# side, so `docker run -v $PWD/interop/secs4j:/work` mounts an empty
# directory and javac reports "file not found."  Copying the source
# in at build time avoids the docker-in-docker volume problem
# entirely.
WORKDIR /work
COPY Secs4jHostHarness.java /work/
RUN javac -cp /opt/secs4java8/Export.jar Secs4jHostHarness.java