FROM eclipse-temurin:21-jdk

# secs4java8 (kenta-shimizu) is a second independent SECS/HSMS
# implementation in Java.  We use it as a third-party peer to
# cross-validate our C++ server against — distinct author, distinct
# language ecosystem, distinct interpretation of the SEMI standards.
# If both libraries agree on wire bytes, that's much stronger evidence
# of spec-correctness than either alone.

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
        git \
        ca-certificates \
        bash \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /opt

# Pin to a tagged release if/when one becomes available; until then,
# pin to a known-working commit via depth=1 + checkout.  Replace with
# a SHA in CI for full reproducibility.
RUN git clone --depth 1 https://github.com/kenta-shimizu/secs4java8.git secs4java8
WORKDIR /opt/secs4java8

# secs4java8 ships a compile.sh that builds Export.jar.  Run it once
# at image build so the harness can just include the resulting jar.
RUN bash compile.sh

# The harness source lives outside this image and is mounted at /work
# when the container runs (so editing the harness doesn't require a
# rebuild).
WORKDIR /work