FROM ubuntu:26.04
ARG DEBIAN_FRONTEND=noninteractive

# System dependent

ARG TZ
ENV TZ=${TZ}

ARG USE_GCT_SRC=0

# Ubuntu 26.04/OpenSSL 3.x workaround
#
# GSI-OpenSSH 10.0p1c still references openssl/fips.h.
# Ubuntu 26.04 ships OpenSSL 3.5 where this header no longer exists.
#
# Apply compatibility patch:
#   - remove openssl/fips.h includes
#   - include fips_mode_replacement.h where FIPS_mode() is used
#
# Verified on:
#   Ubuntu 26.04
#   GCT 6.2.20260123
#   GSI-OpenSSH 10.0p1c
RUN apt-get update \
    && apt-get -y install \
    unminimize \
    && yes | unminimize \
    && apt-get update \
    && apt-get -y upgrade \
    && apt-get -y install \
    systemd \
    language-pack-en \
    language-pack-ja \
    sudo \
    openssh-server \
    rsync \
    rsyslog \
    build-essential \
    libssl-dev \
    libldap2-dev \
    libpq-dev \
    pkg-config \
    postgresql \
    postgresql-client \
    libfuse-dev \
    fuse \
    autofs \
    libacl1-dev \
    ruby \
    git \
    curl \
    python3 \
    python3-docopt \
    python3-schema \
    python3-tqdm \
    flake8 \
    && if [ ${USE_GCT_SRC} -eq 1 ]; then \
      apt-get -y install zlib1g-dev libedit-dev libpam0g-dev file \
      && cd /root \
      && GCT=gct-6.2.1767880040 \
      && GCT_PKG=${GCT}.tar.gz \
      && GCT_URL=https://repo.gridcf.org/gct6/sources/${GCT_PKG} \
      && curl -fO ${GCT_URL} \
      && curl -fO ${GCT_URL}.sha512 \
      && sha512sum -c ${GCT_PKG}.sha512 \
      && tar xf ${GCT_PKG} \
      && cd ${GCT} \
      && sed -i 's;#SHELL = @SH@;SHELL = /bin/bash;' \
         gsi_openssh/source/Makefile.in \
      && cd gsi_openssh/source \
      && find . -type f \( -name '*.c' -o -name '*.h' \) -exec sed -i '/openssl\/fips.h/d' {} + \
      && sed -i '/#include <openssl\/evp.h>/a #include "fips_mode_replacement.h"' kex-names.c \
      && sed -i '/#include <openssl\/evp.h>/a #include "fips_mode_replacement.h"' sshd-auth.c \
      && cd ../.. \
      && ./configure \
        --sysconfdir=/etc \
        --prefix=/usr/local \
      && make -j 4 \
      globus_proxy_utils \
      globus_gsi_cert_utils \
      globus_gssapi_gsi \
      globus_simple_ca \
      gsi-openssh \
      myproxy \
      && make install \
      && apt-get -y install automake autoconf libtool \
    ; else \
      apt-get -y install \
      libglobus-gssapi-gsi-dev \
      libglobus-gss-assist-dev \
      globus-simple-ca \
      globus-gsi-cert-utils-progs \
      globus-proxy-utils \
      myproxy \
      && apt-get -y install zlib1g-dev libedit-dev libpam0g-dev file \
      && GSISSH=gsi-openssh-10.0p1c \
      && GSISSH_PKG=${GSISSH}.tar.gz \
      && GSISSH_URL=https://repo.gridcf.org/gct6/sources/${GSISSH_PKG} \
      && curl -fLO ${GSISSH_URL} \
      && curl -fLO ${GSISSH_URL}.sha512 \
      && sha512sum -c ${GSISSH_PKG}.sha512 \
      && tar xf ${GSISSH_PKG} \
      && cd ${GSISSH} \
      && find . -type f \( -name '*.c' -o -name '*.h' \) -exec sed -i '/openssl\/fips.h/d' {} + \
      && sed -i '/#include <openssl\/evp.h>/a #include "fips_mode_replacement.h"' kex-names.c \
      && sed -i '/#include <openssl\/evp.h>/a #include "fips_mode_replacement.h"' sshd-auth.c \
      && ./configure --prefix=/usr/local --with-gsi --without-zlib-version-check \
      && make KEYCATLIBS="-lpam" -j 4 \
      && make install-nokeys \
    ; fi \
    && apt-get -y install krb5-kdc krb5-admin-server \
    krb5-user libkrb5-3 libkrb5-dev \
    && apt-get -y install sasl2-bin libsasl2-modules-db libsasl2-dev \
    libsasl2-modules libsasl2-modules-gssapi-mit jq \
    && apt-get -y install g++ cmake libsqlite3-dev \
    libcurl4-openssl-dev uuid-dev golang-go \
    && apt-get -y install \
    docbook-utils docbook-xsl xsltproc \
    ncat ldnsutils iproute2 net-tools bind9-dnsutils telnet tcpdump \
    manpages manpages-ja man-db \
    gdb valgrind strace inotify-tools \
    vim nano emacs-nox less \
    && CODENAME=$(lsb_release -cs) \
    && DDEBS="/etc/apt/sources.list.d/ddebs.list" \
    && DEB_URL="deb http://ddebs.ubuntu.com" \
    && REPO="main restricted universe multiverse" \
    && echo "${DEB_URL} ${CODENAME} ${REPO}" >> ${DDEBS} \
    && echo "${DEB_URL} ${CODENAME}-updates ${REPO}" >> ${DDEBS} \
    && echo "${DEB_URL} ${CODENAME}-proposed ${REPO}" >> ${DDEBS} \
    && apt-get -y install \
    ubuntu-dbgsym-keyring software-properties-common \
    && apt-get update \
    && apt-get -y install \
    libfuse2t64-dbgsym \
    valgrind-dbgsym \
    && sudo systemctl disable unattended-upgrades

# Delete ubuntu user
RUN userdel ubuntu

# System independent (see setup-univ.sh)

ARG GFDOCKER_USERNAME_PREFIX
ARG GFDOCKER_TENANTNAME_PREFIX
ARG GFDOCKER_PRIMARY_USER
ARG GFDOCKER_PRIMARY_UID
ARG GFDOCKER_TENANT_ADMIN_USER
ARG GFDOCKER_TENANT_ADMIN_UID
ARG GFDOCKER_NUM_GFMDS
ARG GFDOCKER_NUM_GFSDS
ARG GFDOCKER_NUM_USERS
ARG GFDOCKER_NUM_TENANTS
ARG GFDOCKER_HOSTNAME_PREFIX_GFMD
ARG GFDOCKER_HOSTNAME_PREFIX_GFSD
ARG GFDOCKER_HOSTNAME_SUFFIX
ARG GFDOCKER_USE_SAN_FOR_GFSD
COPY --chown=${GFDOCKER_PRIMARY_UID}:${GFDOCKER_PRIMARY_UID} . /work/gfarm
COPY --chown=${GFDOCKER_TENANT_ADMIN_UID}:${GFDOCKER_TENANT_ADMIN_UID} \
	. /work/gfarm2
RUN "/work/gfarm/docker/dev/common/setup-univ.sh"

CMD ["/sbin/init"]
