Dockerfile.runtime

###############################################################################
# ADscan runtime image (single source of truth)
#
# Build targets:
# - runtime-pro: uses compiled binary from dist/adscan (PyArmor/PyInstaller flow)
# - runtime-lite: uses open-source Python sources (no PyArmor/PyInstaller)
#
# This file centralizes all shared runtime dependencies/tools so LITE and PRO
# never drift when adding system packages or tooling.
###############################################################################

# Global ARGs (usable in FROM): select where the John `run/` and FreeRDP
# `install/` artifacts come from. The build scripts override these to the
# `*_prebuilt` stage when they have seeded a host-cached, commit-keyed artifact
# into the build context (see the *_prebuilt stages + scripts/lib_build_mirror.sh).
# John's default `john_builder` fetches+compiles from GitHub. FreeRDP's default
# is the EMPTY `freerdp_none` stage — the multi-minute cmake compile then runs
# inline in runtime-common only when no prebuilt `install/` tree was seeded.
ARG JOHN_SOURCE_STAGE=john_builder
ARG FREERDP_SOURCE_STAGE=freerdp_none
ARG SLU_SOURCE_STAGE=slu_none
# hashcat source selector (host-side build mirror, same pattern as John). amd64
# ships the official prebuilt .7z at runtime, so on that arch the hashcat_builder
# stage is a NO-OP (empty install tree) and the runtime layer downloads the .7z;
# on arm64 there is NO upstream release, so hashcat_builder compiles it from
# source (SSE2->NEON via deps/sse2neon) and the runtime layer COPYs that tree.
ARG HASHCAT_SOURCE_STAGE=hashcat_builder

###############################################################################
# John the Ripper build stage (generic john binary + official converters)
###############################################################################
FROM debian:trixie-slim AS john_builder

ARG DEBIAN_FRONTEND=noninteractive
ARG JOHN_BLEEDING_JUMBO_COMMIT=d8f5b0138e6f9fe24ab453f886dcaa2abb2e5407
# TARGETARCH is auto-provided by BuildKit (amd64 / arm64) for both `docker build`
# and `docker buildx build`; the John compile below selects its Makefile.legacy
# target + SIMD from it so an arm64 leg builds a native NEON binary.
ARG TARGETARCH
SHELL ["/bin/bash", "-euo", "pipefail", "-c"]

RUN apt-get update -y && apt-get install -y --no-install-recommends \
      ca-certificates \
      curl \
      git \
      build-essential \
      automake \
      autoconf \
      libtool \
      pkg-config \
      zlib1g-dev \
      libbz2-dev \
      libpcap-dev \
      libssl-dev \
      libgmp-dev \
    && rm -rf /var/lib/apt/lists/*

# Resilient source acquisition. GitHub's CDN intermittently throttles hard; under
# that throttle a `git fetch` of the pinned commit transfers the pack slowly for
# minutes and then CORRUPTS at the end ("fetch-pack: invalid index-pack output" /
# over HTTP/2 "curl 92 stream CANCEL"), and git-pack cannot resume, so each retry
# restarts from 0% — observed burning ~800s PER attempt.
#
# So the PRIMARY path is the source tarball over a plain HTTP GET (codeload): no
# git-pack negotiation, so it does not corrupt under throttling — it is merely
# slow, and `gzip -t` rejects a truncated/throttled download so the retry only
# accepts a COMPLETE archive. git fetch (HTTP/1.1, low-speed abort) is the
# fallback for the rare case codeload is unavailable but the git endpoint works.
# git config is global so it also covers the converter build below.
#
# arm64 note: this John commit has a Makefile.legacy defect on the linux-arm64le
# target. arm64le.h enables NEON (SIMD_COEF_32=4), so format plugins (wpapsk,
# zipmonster, ...) reference SIMDSHA1body/SIMDmd5body, but the linux-arm64le
# target omits simd-intrinsics.o from JOHN_OBJS (the linux-x86-64 target links
# it and is fine) -> "undefined reference to SIMDSHA1body" at the final link and
# the arm64 leg of a multi-arch build fails. The RUN below patches only that
# target's JOHN_OBJS to add simd-intrinsics.o before the legacy build. NEON is
# mandatory on every AArch64 CPU, so the resulting binary is still a portable
# fallback. The patch is scoped to the arm64le target and is a no-op if a future
# commit bump fixes it upstream (the pattern stops matching). amd64 is untouched.
RUN set -eux; \
  git config --global http.version HTTP/1.1; \
  git config --global http.lowSpeedLimit 1000; \
  git config --global http.lowSpeedTime 60; \
  mkdir -p /opt/adscan/tools/john; \
  fetched=0; \
  for attempt in 1 2 3 4 5; do \
    if curl --http1.1 -fSL --retry 3 --retry-all-errors --retry-delay 5 \
         "https://github.com/openwall/john/archive/${JOHN_BLEEDING_JUMBO_COMMIT}.tar.gz" \
         -o /tmp/john-src.tar.gz \
       && gzip -t /tmp/john-src.tar.gz; then \
      rm -rf /opt/adscan/tools/john; \
      mkdir -p /opt/adscan/tools/john; \
      tar -xzf /tmp/john-src.tar.gz -C /opt/adscan/tools/john --strip-components=1; \
      rm -f /tmp/john-src.tar.gz; \
      fetched=1; break; \
    fi; \
    echo "[john_builder] tarball attempt ${attempt} failed (incomplete/throttled), retrying in $((attempt * 5))s..." >&2; \
    rm -f /tmp/john-src.tar.gz; \
    sleep "$((attempt * 5))"; \
  done; \
  if [ "${fetched}" != "1" ]; then \
    echo "[john_builder] tarball exhausted; falling back to git fetch" >&2; \
    rm -rf /opt/adscan/tools/john; \
    mkdir -p /opt/adscan/tools/john; \
    git -C /opt/adscan/tools/john init -q; \
    git -C /opt/adscan/tools/john remote add origin https://github.com/openwall/john.git; \
    for attempt in 1 2 3; do \
      if git -C /opt/adscan/tools/john -c protocol.version=2 fetch \
           --depth=1 --no-tags \
           origin "${JOHN_BLEEDING_JUMBO_COMMIT}"; then \
        git -C /opt/adscan/tools/john checkout -q FETCH_HEAD; \
        fetched=1; break; \
      fi; \
      echo "[john_builder] git fetch attempt ${attempt} failed, retrying in $((attempt * 5))s..." >&2; \
      sleep "$((attempt * 5))"; \
    done; \
  fi; \
  [ "${fetched}" = "1" ] || { echo "[john_builder] giving up: both tarball and git fetch failed" >&2; exit 1; }; \
  jarch="${TARGETARCH:-$(dpkg --print-architecture)}"; \
  case "${jarch}" in \
    amd64) john_mk_target="linux-x86-64"; john_configure=(./configure --disable-native-tests --enable-simd=sse2) ;; \
    arm64) john_mk_target="linux-arm64le"; john_configure=(./configure --disable-native-tests) ;; \
    *) john_mk_target="generic"; john_configure=(./configure --disable-native-tests) ;; \
  esac; \
  echo "[john_builder] arch=${jarch} legacy-target=${john_mk_target}" >&2; \
  if [ "${jarch}" = "arm64" ]; then \
    echo "[john_builder] patching Makefile.legacy linux-arm64le: linking the missing simd-intrinsics.o (NEON SIMD bodies)" >&2; \
    sed -i '/^linux-arm64le:/,/^linux-arm32le-neon:/ s|JOHN_OBJS="$(JOHN_OBJS) c3_fmt.o"|JOHN_OBJS="$(JOHN_OBJS) c3_fmt.o simd-intrinsics.o"|' /opt/adscan/tools/john/src/Makefile.legacy; \
  fi; \
  ( \
    cd /opt/adscan/tools/john/src && \
    make -s -f Makefile.legacy clean && \
    make -sj"$(nproc)" -f Makefile.legacy "${john_mk_target}" && \
    cp /opt/adscan/tools/john/run/john /tmp/john-generic && \
    "${john_configure[@]}" >/dev/null && \
    make -s clean && \
    make -sj"$(nproc)" && \
    cp /tmp/john-generic /opt/adscan/tools/john/run/john-generic && \
    ln -sf /opt/adscan/tools/john/run/john-generic /opt/adscan/tools/john/run/john \
  ); \
  chmod +x /opt/adscan/tools/john/run/john /opt/adscan/tools/john/run/john-generic

###############################################################################
# John prebuilt-artifact stage (host-side build mirror — NO GitHub fetch)
#
# Selected via `--build-arg JOHN_SOURCE_STAGE=john_prebuilt` when the build
# script has seeded a host-cached, commit-keyed `run/` dir into the build
# context at `john-prebuilt/<arch>/run/` (see scripts/build_docker_lite_image.sh).
# The John binary is arch-specific ELF, so the seed is PER-ARCH: the COPY below
# selects the right one via ${TARGETARCH} (BuildKit-provided). For a single-arch
# `docker build`, TARGETARCH == the host arch, which is exactly the arch the seed
# was cached/compiled for; for a multi-platform buildx build, each leg COPYs its
# own arch's prebuilt (both seeded by build_mirror_ensure_arch).
# This reuses a known-good John binary instead of fetching + compiling from
# GitHub, which is the robust path when GitHub's CDN is degraded (it cannot even
# serve the source tarball completely). The host cache is keyed by the pinned
# commit, so a commit bump misses the cache and falls back to a real build.
# Cold cache / new commit → JOHN_SOURCE_STAGE defaults to `john_builder`, this
# stage is never referenced, and John is fetched + built from source as usual.
###############################################################################
FROM debian:trixie-slim AS john_prebuilt
ARG TARGETARCH
COPY john-prebuilt/${TARGETARCH}/run /opt/adscan/tools/john/run

# Resolve the selected John source (john_builder | john_prebuilt) to a fixed
# alias so the downstream COPY uses a static --from (no ARG in --from, which the
# Dockerfile parser rejects). Only the selected stage is built; the other is
# pruned from the graph — so john_prebuilt selection never triggers a GitHub
# fetch, and john_builder selection never requires a seeded artifact.
ARG JOHN_SOURCE_STAGE
FROM ${JOHN_SOURCE_STAGE} AS john_source

###############################################################################
# kerbrute build stage (cross-compiled Go binary — no arm64 upstream release)
#
# ropnop/kerbrute publishes only linux/amd64 (+ windows/darwin) release assets:
# `kerbrute_linux_arm64` 404s, which HARD-BREAKS the arm64 image build. kerbrute
# is pure Go with no cgo, so it cross-compiles trivially. This stage runs on the
# BUILD host's native arch (`--platform=$BUILDPLATFORM`) and emits a static
# binary for the TARGET arch via `GOOS/GOARCH` — so BOTH the amd64 and arm64 legs
# of a multi-arch build compile in ~30s each with NO QEMU (no emulated toolchain).
# Cheap + reproducible, so it does NOT need the host build-mirror; the builder
# stage alone is enough. Pinned to v1.0.3 to match the previous release download.
###############################################################################
FROM --platform=$BUILDPLATFORM golang:1.22-bookworm AS kerbrute_builder
ARG TARGETARCH
ARG KERBRUTE_VERSION=v1.0.3
SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
# HTTP/1.1 + low-speed abort hardens the clone against GitHub's HTTP/2 stream
# CANCEL / CDN throttle (same class the John builder guards against). The bare
# `.` build target is used deliberately: the Makefile's per-arch targets omit
# arm64, but `go build .` from the repo root works for every GOARCH.
RUN set -eux; \
  git config --global http.version HTTP/1.1; \
  git config --global http.lowSpeedLimit 1000; \
  git config --global http.lowSpeedTime 60; \
  for attempt in 1 2 3; do \
    if git clone --depth 1 --branch "${KERBRUTE_VERSION}" https://github.com/ropnop/kerbrute.git /src; then \
      break; \
    fi; \
    echo "[kerbrute_builder] clone attempt ${attempt} failed, retrying in $((attempt * 5))s..." >&2; \
    rm -rf /src; \
    sleep "$((attempt * 5))"; \
  done; \
  test -d /src; \
  mkdir -p /out; \
  cd /src; \
  GOOS=linux GOARCH="${TARGETARCH}" CGO_ENABLED=0 go build -ldflags "-s -w" -o /out/kerbrute .; \
  test -x /out/kerbrute

###############################################################################
# hashcat build stage (source-compiled — no arm64 upstream release)
#
# hashcat ships an OFFICIAL prebuilt binary for amd64 ONLY (the .7z carries an
# x86_64 hashcat.bin). On arm64 there is NO release, and hashcat is the SOLE
# engine for kerberoast(13100)/asrep(18200)/timeroast(31300)/NetNTLMv1(5500)/
# NetNTLMv2(5600)/NTLM(1000) — John only cracks file artifacts (office/keepass/
# zip/pfx), so an arm64 image without hashcat loses ALL online-hash cracking.
# hashcat 7.x ports SSE2->NEON via deps/sse2neon and builds cleanly from source
# with build-essential (~343s under QEMU), so we compile it for the target arch.
#
# amd64 CARVE-OUT: the runtime layer keeps the official .7z on amd64 (faster,
# known-good), so this stage produces an EMPTY install tree on amd64 (no compile)
# and only compiles on arm64. That keeps the amd64 path byte-identical while the
# unconditional `COPY --from=hashcat_source` in runtime-common resolves on both
# legs. The compiled-in -DSHARED_FOLDER points at the FINAL runtime path so the
# binary finds its OpenCL/ kernels + modules/ at /opt/adscan/tools/hashcat/install.
###############################################################################
FROM debian:trixie-slim AS hashcat_builder
ARG DEBIAN_FRONTEND=noninteractive
ARG HASHCAT_VERSION=7.1.2
ARG TARGETARCH
SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
RUN set -eux; \
  hcarch="${TARGETARCH:-$(dpkg --print-architecture)}"; \
  if [ "${hcarch}" != "arm64" ]; then \
    echo "[hashcat_builder] arch=${hcarch}: runtime ships the official .7z on this arch; producing an EMPTY install tree (no source build)" >&2; \
    mkdir -p /opt/adscan/tools/hashcat/install; \
    exit 0; \
  fi; \
  apt-get update -y && apt-get install -y --no-install-recommends \
      ca-certificates git build-essential \
    && rm -rf /var/lib/apt/lists/*; \
  git config --global http.version HTTP/1.1; \
  git config --global http.lowSpeedLimit 1000; \
  git config --global http.lowSpeedTime 60; \
  for attempt in 1 2 3; do \
    if git clone --depth 1 --branch "v${HASHCAT_VERSION}" https://github.com/hashcat/hashcat.git /src; then \
      break; \
    fi; \
    echo "[hashcat_builder] clone attempt ${attempt} failed, retrying in $((attempt * 5))s..." >&2; \
    rm -rf /src; \
    sleep "$((attempt * 5))"; \
  done; \
  test -d /src; \
  make -C /src -j"$(nproc)" PREFIX=/opt/adscan/tools/hashcat/install; \
  make -C /src install PREFIX=/opt/adscan/tools/hashcat/install; \
  test -x /opt/adscan/tools/hashcat/install/bin/hashcat

###############################################################################
# hashcat prebuilt-artifact stage (host-side build mirror — per arch)
#
# Selected via `--build-arg HASHCAT_SOURCE_STAGE=hashcat_prebuilt` when the build
# script seeded a host-cached, commit-keyed `install/` tree into the build
# context at `hashcat-prebuilt/<arch>/install/` (see lib_build_mirror.sh +
# build_docker_lite_image.sh). The hashcat binary is arch-specific ELF, so the
# seed is PER-ARCH: the COPY selects the right one via ${TARGETARCH}. On amd64
# the seeded tree is intentionally EMPTY (runtime uses the .7z); on arm64 it is
# the cached source-built tree. Cold cache / new version → HASHCAT_SOURCE_STAGE
# defaults to `hashcat_builder`, this stage is never referenced.
###############################################################################
FROM debian:trixie-slim AS hashcat_prebuilt
ARG TARGETARCH
COPY hashcat-prebuilt/${TARGETARCH}/install /opt/adscan/tools/hashcat/install

# Resolve the selected hashcat source (hashcat_builder | hashcat_prebuilt) to a
# fixed alias so the downstream COPY uses a static --from (no ARG in --from).
ARG HASHCAT_SOURCE_STAGE
FROM ${HASHCAT_SOURCE_STAGE} AS hashcat_source

###############################################################################
# FreeRDP source selector (host-side build mirror — skips the cmake compile)
#
# FreeRDP is a multi-minute cmake build whose dependencies are entangled with
# runtime-common's apt (X11/Wayland/codec -dev libs that ALSO provide the
# runtime libs xfreerdp links against). So instead of a self-contained builder
# stage like John, the compile stays INLINE in runtime-common and is made
# CONDITIONAL: runtime-common COPYs an `install/` tree from `freerdp_source`,
# and the inline step compiles only when that tree is absent.
#
#   FREERDP_SOURCE_STAGE=freerdp_none      → empty install/ → compile inline (default)
#   FREERDP_SOURCE_STAGE=freerdp_prebuilt  → COPY the host-seeded install/ → skip compile
#
# Only the selected stage is built; the other is pruned. So freerdp_prebuilt
# selection never requires a seeded artifact to be absent, and freerdp_none
# selection never requires the seeded dir to exist.
#
# Multi-arch note: unlike John (per-arch host mirror, seeded via
# build_mirror_ensure_arch), FreeRDP is EXCLUDED from per-arch multi-arch mirror
# caching BY DESIGN — its inline cmake compile is entangled with runtime-common's
# -dev libs, and a cross-arch builder stage would risk RDP runtime linkage drift
# (needs separate L3 RDP validation). So in a multi-platform build FreeRDP always
# compiles inline per-leg (freerdp_none). Deferred follow-up.
###############################################################################
FROM debian:trixie-slim AS freerdp_prebuilt
COPY freerdp-prebuilt/install /opt/adscan/tools/freerdp/install

FROM debian:trixie-slim AS freerdp_none
RUN mkdir -p /opt/adscan/tools/freerdp/install

ARG FREERDP_SOURCE_STAGE
FROM ${FREERDP_SOURCE_STAGE} AS freerdp_source

###############################################################################
# statistically-likely-usernames source selector (host-side mirror)
#
# Same conditional pattern as FreeRDP: runtime-common COPYs a usernames/ dir
# from slu_source and the Wordlists layer fetches the commit-pinned tarball only
# when that dir is absent. A bare `git clone` of this repo corrupts under GitHub
# throttle, so the mirror lets warm builds skip GitHub entirely.
#
#   SLU_SOURCE_STAGE=slu_none      → empty dir → tarball-fetch inline (default)
#   SLU_SOURCE_STAGE=slu_prebuilt  → COPY the host-seeded dir → skip fetch
###############################################################################
FROM debian:trixie-slim AS slu_prebuilt
COPY slu-prebuilt/usernames /usr/share/wordlists/statistically-likely-usernames

FROM debian:trixie-slim AS slu_none
RUN mkdir -p /usr/share/wordlists/statistically-likely-usernames

ARG SLU_SOURCE_STAGE
FROM ${SLU_SOURCE_STAGE} AS slu_source

###############################################################################
# Shared runtime base for both PRO and LITE images
###############################################################################
FROM debian:trixie-slim AS runtime-common

ARG DEBIAN_FRONTEND=noninteractive
ARG JOHN_BLEEDING_JUMBO_COMMIT=d8f5b0138e6f9fe24ab453f886dcaa2abb2e5407
ARG CREDSWEEPER_VERSION=1.15.1
ARG HASHCAT_VERSION=7.1.2
ARG LIGOLO_NG_VERSION=0.8.3
ARG FREERDP_VERSION=3.24.1
ARG FREERDP_COMMIT=b6e770ccba87c58ffd0a55366fef33361798e39c
ARG SLU_COMMIT=31132bd5da19787152a354e6adad18b2c8432e73
ARG ADSCAN_RUNTIME_CONTRACT_VERSION="1"
# Target architecture (amd64 / arm64), auto-provided by BuildKit for both
# `docker build` and `docker buildx build`. Arch-specific tool downloads below
# (ligolo proxy) and per-arch tools (hashcat: .7z on amd64 vs source-built on
# arm64; donut: amd64-only) branch on it so an arm64 image ships native binaries
# instead of amd64 ones. kerbrute + hashcat(arm64) are COPYed from cross/source
# builder stages, so they no longer 404 / skip on arm64.
ARG TARGETARCH
SHELL ["/bin/bash", "-euo", "pipefail", "-c"]

ENV ADSCAN_HOME=/opt/adscan \
    HOME=/opt/adscan \
    ADSCAN_RUNTIME_CONTRACT_VERSION=${ADSCAN_RUNTIME_CONTRACT_VERSION} \
    XDG_CONFIG_HOME=/opt/adscan/.config \
    NPM_CONFIG_UPDATE_NOTIFIER=false \
    PLAYWRIGHT_BROWSERS_PATH=/opt/adscan/ms-playwright \
    PATH="/opt/adscan/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

RUN mkdir -p /opt/adscan

# BuildKit apt cache mounts: keep downloaded .deb archives + apt lists in the
# builder cache (NOT the image — image stays the same size), so when this layer
# is invalidated (a package added/removed) apt reuses cached debs instead of
# re-downloading hundreds of MB. Removing docker-clean stops apt from purging the
# archive cache after install; the lists live in the mount so we do NOT rm them.
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    rm -f /etc/apt/apt.conf.d/docker-clean \
    && apt-get update -y && apt-get install -y --no-install-recommends \
      ca-certificates \
      curl \
      git \
      ripgrep \
      asciinema \
      jq \
      bat \
      gosu \
      sudo \
      libcap2-bin \
      util-linux \
      net-tools \
      iputils-ping \
      iproute2 \
      procps \
      unzip \
      p7zip-full \
      wget \
      rclone \
      xz-utils \
      bzip2 \
      python3 \
      python3-pip \
      python3-venv \
      python3-dev \
      chromium \
      chromium-driver \
      nodejs \
      npm \
      build-essential \
      automake \
      autoconf \
      libtool \
      pkg-config \
      make \
      cmake \
      ninja-build \
      clang \
      llvm \
      libclang-dev \
      libffi-dev \
      libssl-dev \
      zlib1g-dev \
      libbz2-dev \
      libreadline-dev \
      libsqlite3-dev \
      libncurses-dev \
      libncursesw5-dev \
      tk-dev \
      liblzma-dev \
      libgmp-dev \
      libkrb5-dev \
      libgssapi-krb5-2 \
      libsasl2-2 \
      libsasl2-modules-gssapi-mit \
      krb5-user \
      libssl3t64 \
      libldap2 \
      libldns-dev \
      nmap \
      pocl-opencl-icd \
      samba-common-bin \
      mono-devel \
      mingw-w64 \
      gcc-mingw-w64-x86-64 \
      tesseract-ocr \
      antiword \
      moreutils \
      graphviz \
      fontconfig \
      fonts-crosextra-carlito \
      fonts-crosextra-caladea \
      fonts-liberation \
      libx11-dev \
      libxext-dev \
      libxinerama-dev \
      libxcursor-dev \
      libxkbcommon-dev \
      libxkbfile-dev \
      libxrandr-dev \
      libxi-dev \
      libxrender-dev \
      libxv-dev \
      libxfixes-dev \
      libxdamage-dev \
      libxtst-dev \
      libfuse3-dev \
      libpam0g-dev \
      libasound2-dev \
      libcups2-dev \
      libpulse-dev \
      libjpeg-dev \
      libpng-dev \
      libavutil-dev \
      libavcodec-dev \
      libswscale-dev \
      libusb-1.0-0-dev \
      libpcsclite-dev \
      libsystemd-dev \
      libwayland-dev \
      wayland-protocols \
      libepoxy-dev \
      libicu-dev \
      libmagic1 \
      ntpsec-ntpdate \
      unbound \
      unbound-anchor \
      dns-root-data \
    && mkdir -p /etc/OpenCL/vendors \
    && printf '%s\n' 'libnvidia-opencl.so.1' > /etc/OpenCL/vendors/nvidia.icd \
    && rm -rf /var/lib/apt/lists/*

# Centralized resilient curl for every build-time download. Two failure classes
# are handled once here so no call site has to:
#   1. --http1.1 — GitHub's CDN intermittently cancels HTTP/2 streams mid-transfer
#      under load ("curl 92 stream CANCEL"), killing release/raw downloads
#      (mimikatz, Rubeus, kerbrute, ligolo, ...). HTTP/1.1 avoids that class.
#   2. --retry — GitHub-raw / sysinternals throttle hard mid-build (HTTP 403/429),
#      which with -f surfaces as a bare "curl exit 22" that fails the whole layer
#      on the FIRST hiccup. --retry rides it out; --retry-all-errors is required
#      because plain --retry only covers 5xx/408/429 (not the 403 GitHub-raw
#      sometimes returns), and --retry-connrefused covers a refused reconnect.
# Every call site writes to a file (-o / piped-after-download), so a retried
# request is safe (curl truncates + re-fetches). Per-file perf cost is negligible.
RUN printf '%s\n' \
  '#!/usr/bin/env bash' \
  'set -euo pipefail' \
  'adscan_curl_opts=(--http1.1 --retry 5 --retry-delay 3 --retry-connrefused --retry-all-errors)' \
  'if curl "${adscan_curl_opts[@]}" "$@"; then' \
  '  exit 0' \
  'else' \
  '  status=$?' \
  'fi' \
  'if [[ "$status" -ne 60 ]]; then' \
  '  exit "$status"' \
  'fi' \
  'echo "warning: curl TLS verification failed; retrying with insecure fallback (-k)" >&2' \
  'exec curl "${adscan_curl_opts[@]}" -k "$@"' \
  > /usr/local/bin/adscan-curl \
  && chmod +x /usr/local/bin/adscan-curl

# Install the browser revision expected by the Python Playwright package bundled
# into the PRO binary. The Debian chromium package remains installed as a
# fallback and for workflows that call Chromium directly.
RUN set -eux; \
  python3 -m venv /tmp/playwright-installer; \
  /tmp/playwright-installer/bin/python -m pip install --no-cache-dir --upgrade pip; \
  /tmp/playwright-installer/bin/python -m pip install --no-cache-dir playwright==1.60.0; \
  PLAYWRIGHT_BROWSERS_PATH=/opt/adscan/ms-playwright \
    /tmp/playwright-installer/bin/python -m playwright install chromium; \
  rm -rf /tmp/playwright-installer

# Codex CLI (official ChatGPT plan sign-in path for Plus/Pro subscriptions).
# Installed globally so `ask login codex` and `ask` can use `codex` directly.
RUN set -eux; \
  npm install --global @openai/codex; \
  codex --version

# Base runtime layout
RUN mkdir -p /opt/adscan/{bin,tools,tool_venvs,wordlists,logs,fonts} /workspaces \
  && fc-cache -f \
  && chmod -R 0777 /opt/adscan /workspaces

COPY wordlists/ /opt/adscan/wordlists/
# C# sources for Windows tool compilation (pss-dumper, rtlcp-dumper)
COPY src/windows_tools/ /workspace_build/src/windows_tools/

COPY --from=john_source /opt/adscan/tools/john/run /opt/adscan/tools/john/run

# kerbrute — cross-compiled in the kerbrute_builder stage for ${TARGETARCH}
# (ropnop publishes no arm64 release). Same path the runtime code resolves
# (/opt/adscan/tools/kerbrute/kerbrute); the External-tools RUN only chmods it.
COPY --from=kerbrute_builder /out/kerbrute /opt/adscan/tools/kerbrute/kerbrute

# hashcat source-built install tree (EMPTY on amd64 — that leg uses the official
# .7z downloaded in the External-tools RUN below; POPULATED on arm64, where there
# is no upstream release). The binary's -DSHARED_FOLDER is baked to this exact
# path so it finds its OpenCL/ kernels + modules/ at runtime.
COPY --from=hashcat_source /opt/adscan/tools/hashcat/install /opt/adscan/tools/hashcat/install

# Prebuilt FreeRDP install tree (empty when building from source — see the
# freerdp_source selector above). The External-tools RUN below compiles FreeRDP
# only when this tree is absent (no xfreerdp binary present).
COPY --from=freerdp_source /opt/adscan/tools/freerdp/install /opt/adscan/tools/freerdp/install

# Prebuilt statistically-likely-usernames dir (empty when not seeded). The
# Wordlists layer below tarball-fetches it only when this dir is empty.
COPY --from=slu_source /usr/share/wordlists/statistically-likely-usernames /usr/share/wordlists/statistically-likely-usernames

# Our maintained aardwolf (0.2.13) — needed EARLY (before the tool-venv layer)
# so NetExec's ``aardwolf>=0.2.8`` requirement is satisfied by THIS copy instead
# of a PyPI source build. debian:trixie ships Python 3.13, and upstream aardwolf
# has no cp313 wheel, so a PyPI install source-builds it — whose Rust extension
# (`librlers`) is FATAL there. Our vendor setup.py marks that RustExtension
# ``optional=True`` (skelsec fork), so it installs pure-Python when no Rust
# compiler is present (exactly how the main venv at the bottom already installs
# it). Pre-seeding it into the NetExec venv is what makes this layer build cold
# (the failure only surfaced in CI because the warm local layer cache hid it).
# Vendored skelsec auth chain needed to build the NetExec tool venv below.
# Forcing our vendor aardwolf (Rust-optional wheel) pulls its badauth dep, which
# in turn pulls asysocks>=0.2.18 + kerbad — a set PyPI does not always have
# published consistently at build time. We wheel all four from vendored source so
# the netexec venv resolves without depending on PyPI's skelsec publishing state.
COPY vendor/aardwolf /opt/adscan-src/vendor/aardwolf
COPY vendor/asysocks /opt/adscan-src/vendor/asysocks
COPY vendor/badauth /opt/adscan-src/vendor/badauth
COPY vendor/kerbad /opt/adscan-src/vendor/kerbad

# Install Python tool environments (mirrors `PipToolsConfig` from adscan.py)
# BuildKit cache mount persists pip's wheel cache ACROSS builds (in the builder
# cache, NOT the image — image stays small), so when this layer is invalidated
# (a version bump, or an earlier-layer change cascading down) the re-install
# reuses already-downloaded wheels instead of re-fetching from PyPI. pip resolves
# versions itself, so a changed pin fetches only the new wheel — no manual cache
# key needed. `--no-cache-dir` is dropped precisely so the mount is populated.
RUN --mount=type=cache,target=/var/cache/adscan-pip,sharing=locked \
  set -eux; \
  export PIP_CACHE_DIR=/var/cache/adscan-pip; \
  # Several tool deps are git+https clones from GitHub (NetExec,
  # MANSPIDER). This layer runs BEFORE the External-tools layer that sets the
  # global git HTTP/1.1 config, so without this its clones default to HTTP/2 and
  # hit the same "curl 92 stream CANCEL" / pack-corruption failures under GitHub
  # throttle that plagued the John fetch — failing the layer so it never caches.
  # Force HTTP/1.1 + abort a genuinely stalled transfer so pip_retry can retry.
  git config --global http.version HTTP/1.1; \
  git config --global http.lowSpeedLimit 1000; \
  git config --global http.lowSpeedTime 60; \
  pip_retry() { \
    local python_bin="$1"; shift; \
    local attempt=1; \
    local max_attempts=4; \
    until "$python_bin" -m pip install --retries 8 --timeout 120 "$@"; do \
      if [ "$attempt" -ge "$max_attempts" ]; then \
        echo "pip install failed after ${max_attempts} attempts: $*" >&2; \
        return 1; \
      fi; \
      echo "pip install failed (attempt ${attempt}/${max_attempts}) for: $*" >&2; \
      sleep $((attempt * 5)); \
      attempt=$((attempt + 1)); \
    done; \
  }; \
  python3 -m venv /opt/adscan/tool_venvs/impacket/venv; \
  pip_retry /opt/adscan/tool_venvs/impacket/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/impacket/venv/bin/python "impacket==0.13.1" "pycryptodome==3.23.0"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/netexec/venv; \
  pip_retry /opt/adscan/tool_venvs/netexec/venv/bin/python -U pip; \
  # NetExec pulls ``aardwolf>=0.2.8``. On this Python 3.13 base (debian:trixie)
  # upstream aardwolf has no cp313 wheel, so a plain install source-builds it and
  # its librlers Rust extension is FATAL (no Rust compiler in this layer). Our
  # vendor aardwolf 0.2.13 marks that RustExtension ``optional=True``, so it
  # builds a pure-Python wheel with no Rust. Build that wheel ONCE, install it,
  # then install NetExec with ``--find-links`` + ``--only-binary=aardwolf`` pointed
  # at it so pip is FORCED to take aardwolf from THIS wheel and can NEVER
  # source-build the Rust-fatal PyPI sdist (if no aardwolf wheel is found it errors
  # loudly instead of silently building). ``--only-binary`` is scoped to aardwolf
  # ONLY, so NetExec's own git deps (certipy, impacket, ...) still build normally.
  # A plain pre-seed install is NOT enough: pip re-resolves aardwolf during the
  # NetExec install and rebuilds the PyPI sdist across every retry — forcing
  # binary-only for aardwolf is what actually prevents that.
  # Vendor aardwolf depends on badauth, and badauth pulls asysocks>=0.2.18 +
  # kerbad — a skelsec set PyPI does NOT always have published consistently at
  # build time (badauth 0.1.6 shipped requiring an asysocks that lagged on PyPI,
  # so FRESH CI builds hit ResolutionImpossible while warm local caches passed).
  # Build the WHOLE forced chain (asysocks, kerbad, badauth, aardwolf) as wheels
  # from our vendored source and install from those --find-links, so the netexec
  # venv resolution is INDEPENDENT of PyPI's skelsec publishing state. Pre-install
  # the chain first so the NetExec resolve finds it satisfied instead of re-
  # fetching from PyPI. --only-binary stays scoped to aardwolf (only its sdist is
  # Rust-fatal); asysocks/kerbad/badauth are pure Python.
  mkdir -p /tmp/skelsec-wheels; \
  for _skelsec_lib in asysocks kerbad badauth aardwolf; do \
    /opt/adscan/tool_venvs/netexec/venv/bin/python -m pip wheel --no-deps \
      --wheel-dir /tmp/skelsec-wheels "/opt/adscan-src/vendor/${_skelsec_lib}"; \
  done; \
  pip_retry /opt/adscan/tool_venvs/netexec/venv/bin/python \
    --find-links /tmp/skelsec-wheels --only-binary=aardwolf \
    asysocks kerbad badauth aardwolf; \
  pip_retry /opt/adscan/tool_venvs/netexec/venv/bin/python \
    --find-links /tmp/skelsec-wheels --only-binary=aardwolf \
    "git+https://github.com/Pennyw0rth/NetExec.git@73ccf0d"; \
  rm -rf /tmp/skelsec-wheels; \
  \
  # TODO(arm64-extractous-cache): MANSPIDER pulls extractous>=0.3.0,<0.4.0, which
  # has NO linux/aarch64 wheel on PyPI for any version — so on the arm64 leg pip
  # source-builds it (GraalVM native-image, ~2h under QEMU) on EVERY build. The
  # amd64 leg installs the published manylinux wheel in seconds. To cache the arm64
  # build once (per the John/hashcat mirror pattern): add an `extractous_builder`
  # stage that `pip wheel "extractous>=0.3.0,<0.4.0" --wheel-dir /wheelhouse` for
  # TARGETARCH (arm64 → the 2h GraalVM build; amd64 → a no-op empty wheelhouse),
  # a per-arch `build_mirror_spec_extractous` (BM_SUBDIR=wheelhouse,
  # BM_INTEGRITY=<the extractous-*.whl>, BM_CTX_PER_ARCH=1), wire it into both build
  # scripts, COPY the wheelhouse here and pass `--find-links /wheelhouse` to the
  # install below so pip prefers the cached wheel. Deferred: the extractous
  # toolchain (GraalVM + Rust) is heavy to stand up correctly in an isolated
  # builder stage and the 2h build is impractical to validate here; the manspider
  # venv stays FULLY WORKING on arm64 today (it just source-builds extractous),
  # which is the invariant not to break. amd64 is unaffected (published wheel).
  python3 -m venv /opt/adscan/tool_venvs/manspider/venv; \
  pip_retry /opt/adscan/tool_venvs/manspider/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/manspider/venv/bin/python "git+https://github.com/ADScanPro/MANSPIDER@cedb138"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/credsweeper/venv; \
  pip_retry /opt/adscan/tool_venvs/credsweeper/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/credsweeper/venv/bin/python "credsweeper==${CREDSWEEPER_VERSION}"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/pypykatz/venv; \
  pip_retry /opt/adscan/tool_venvs/pypykatz/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/pypykatz/venv/bin/python "pypykatz==0.6.13"; \
  \
  # Volatility 3 — offline VM MEMORY-image credential carving (vm_artifact_service:
  # .vmem/.vmrs → windows.registry.hashdump/lsadump/cachedump). Invoked as a
  # subprocess tool (not bundled into the PRO PyInstaller binary). pycryptodome is
  # REQUIRED or vol3's credential plugins silently fail to register. `vol` is
  # symlinked onto PATH so vm_artifact_service._locate_volatility() finds it in
  # both PRO and LITE. (Windows symbol tables are fetched from the Microsoft symbol
  # server on first use and cached under ~/.cache/volatility3.)
  python3 -m venv /opt/adscan/tool_venvs/volatility3/venv; \
  pip_retry /opt/adscan/tool_venvs/volatility3/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/volatility3/venv/bin/python "volatility3>=2.5.0" "pycryptodome>=3.20"; \
  ln -sf /opt/adscan/tool_venvs/volatility3/venv/bin/vol /opt/adscan/bin/vol; \
  \
  chmod -R 0777 /opt/adscan/tool_venvs

# External tools (git/curl)
# Harden every git clone below against GitHub's intermittent HTTP/2 stream
# CANCEL / CDN throttling (same failure class as the John builder): force
# HTTP/1.1 and abort a genuinely stalled transfer in ~60s so it can retry.
# git config is global, so it persists to all later RUN layers' clones too.
RUN set -eux; \
  git config --global http.version HTTP/1.1; \
  git config --global http.lowSpeedLimit 1000; \
  git config --global http.lowSpeedTime 60; \
  mkdir -p /opt/adscan/tools; \
  effarch="${TARGETARCH:-$(dpkg --print-architecture)}"; \
  echo "[external-tools] target arch=${effarch}" >&2; \
  # hashcat is the SOLE engine for online-hash cracking — kerberoast(13100),
  # asrep(18200), timeroast(31300), NetNTLMv1(5500), NetNTLMv2(5600), NTLM(1000).
  # John the Ripper only covers FILE artifacts (office/keepass/zip/pfx), so hashcat
  # must ship on EVERY arch. amd64 uses the official prebuilt .7z (the x86_64
  # hashcat.bin — faster/known-good); arm64 has NO upstream release, so it ships a
  # source-built hashcat (compiled in the hashcat_builder stage, COPYed to
  # /opt/adscan/tools/hashcat/install above) driven by the PoCL CPU-OpenCL runtime.
  if [ "${effarch}" = "amd64" ]; then \
    if ! adscan-curl -fsSL "https://hashcat.net/files/hashcat-${HASHCAT_VERSION}.7z" -o /tmp/hashcat.7z; then \
      echo "warning: official hashcat download failed; falling back to SourceForge mirror" >&2; \
      wget --max-redirect=10 --no-check-certificate -O /tmp/hashcat.7z \
        "https://sourceforge.net/projects/hashcat.mirror/files/v${HASHCAT_VERSION}/hashcat-${HASHCAT_VERSION}.7z/download"; \
    fi; \
    7z x /tmp/hashcat.7z -o/opt/adscan/tools >/dev/null; \
    test -x "/opt/adscan/tools/hashcat-${HASHCAT_VERSION}/hashcat.bin"; \
    ln -sf "/opt/adscan/tools/hashcat-${HASHCAT_VERSION}/hashcat.bin" /opt/adscan/bin/hashcat; \
    /opt/adscan/bin/hashcat --version | grep -F "v${HASHCAT_VERSION}"; \
    rm -f /tmp/hashcat.7z; \
  else \
    # arm64: use the source-built install tree COPYed from hashcat_source and
    # install PoCL (the CPU OpenCL ICD hashcat dlopens on hosts with no GPU). Both
    # pocl-opencl-icd and ocl-icd-libopencl1 exist on debian:trixie arm64. This
    # adds ~300-400MB (LLVM JIT) to the arm64 image — inherent + acceptable.
    test -x /opt/adscan/tools/hashcat/install/bin/hashcat; \
    ln -sf /opt/adscan/tools/hashcat/install/bin/hashcat /opt/adscan/bin/hashcat; \
    apt-get update -y && apt-get install -y --no-install-recommends \
        pocl-opencl-icd ocl-icd-libopencl1; \
    apt-get clean && rm -rf /var/lib/apt/lists/*; \
    /opt/adscan/bin/hashcat --version | grep -F "v${HASHCAT_VERSION}"; \
  fi; \
  \
  git clone --depth 1 https://github.com/Greenwolf/ntlm_theft.git /opt/adscan/tools/ntlm_theft; \
  mkdir -p /opt/adscan/tools/firepwd; \
  adscan-curl -fsSL https://raw.githubusercontent.com/lclevy/firepwd/refs/heads/master/firepwd.py -o /opt/adscan/tools/firepwd/firepwd.py; \
  adscan-curl -fsSL https://raw.githubusercontent.com/lclevy/firepwd/refs/heads/master/requirements.txt -o /opt/adscan/tools/firepwd/requirements.txt; \
  python3 -m venv /opt/adscan/tool_venvs/firepwd/venv; \
  /opt/adscan/tool_venvs/firepwd/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/firepwd/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/firepwd/requirements.txt; \
  \
  mkdir -p /opt/adscan/tools/PKINITtools; \
  adscan-curl -fsSL https://raw.githubusercontent.com/dirkjanm/PKINITtools/refs/heads/master/gettgtpkinit.py -o /opt/adscan/tools/PKINITtools/gettgtpkinit.py; \
  adscan-curl -fsSL https://raw.githubusercontent.com/dirkjanm/PKINITtools/refs/heads/master/getnthash.py -o /opt/adscan/tools/PKINITtools/getnthash.py; \
  adscan-curl -fsSL https://raw.githubusercontent.com/dirkjanm/PKINITtools/refs/heads/master/requirements.txt -o /opt/adscan/tools/PKINITtools/requirements.txt; \
  python3 -m venv /opt/adscan/tool_venvs/PKINITtools/venv; \
  /opt/adscan/tool_venvs/PKINITtools/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/PKINITtools/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/PKINITtools/requirements.txt; \
  \
  # kerbrute is cross-compiled in the kerbrute_builder stage for ${TARGETARCH}
  # and COPYed to /opt/adscan/tools/kerbrute/kerbrute above (ropnop publishes no
  # arm64 release, which used to 404 the arm64 build). Just ensure it is exec.
  chmod +x /opt/adscan/tools/kerbrute/kerbrute; \
  \
  # ligolo-ng PROXY runs on the ADscan host, so it must match the host arch —
  # ligolo publishes native linux_amd64 + linux_arm64 proxy binaries. The layout
  # (proxy/linux-<arch>/) is exactly what ligolo_manager.get_ligolo_proxy_local_path
  # resolves from platform.machine(). The AGENT below stays windows-amd64: it is a
  # payload dropped on the Windows target, independent of the ADscan host arch.
  mkdir -p "/opt/adscan/tools/ligolo-ng/proxy/linux-${effarch}"; \
  adscan-curl -fsSL \
    "https://github.com/nicocha30/ligolo-ng/releases/download/v${LIGOLO_NG_VERSION}/ligolo-ng_proxy_${LIGOLO_NG_VERSION}_linux_${effarch}.tar.gz" \
    -o /tmp/ligolo_proxy.tar.gz; \
  tar -xzf /tmp/ligolo_proxy.tar.gz -C "/opt/adscan/tools/ligolo-ng/proxy/linux-${effarch}" proxy; \
  chmod +x "/opt/adscan/tools/ligolo-ng/proxy/linux-${effarch}/proxy"; \
  setcap cap_net_admin,cap_net_bind_service+ep "/opt/adscan/tools/ligolo-ng/proxy/linux-${effarch}/proxy"; \
  ln -sf "/opt/adscan/tools/ligolo-ng/proxy/linux-${effarch}/proxy" /opt/adscan/bin/ligolo-proxy; \
  rm -f /tmp/ligolo_proxy.tar.gz; \
  \
  mkdir -p /opt/adscan/tools/ligolo-ng/agent/windows-amd64; \
  adscan-curl -fsSL \
    "https://github.com/nicocha30/ligolo-ng/releases/download/v${LIGOLO_NG_VERSION}/ligolo-ng_agent_${LIGOLO_NG_VERSION}_windows_amd64.zip" \
    -o /tmp/ligolo_agent_windows_amd64.zip; \
  unzip -q /tmp/ligolo_agent_windows_amd64.zip agent.exe -d /opt/adscan/tools/ligolo-ng/agent/windows-amd64; \
  rm -f /tmp/ligolo_agent_windows_amd64.zip; \
  \
  # FreeRDP: reuse the host-seeded install/ tree when present (COPYed from
  # freerdp_source above), else clone + cmake-build from source. The compile is
  # the single most expensive step in this RUN (~minutes); the mirror skips it.
  if [ -x /opt/adscan/tools/freerdp/install/bin/xfreerdp ]; then \
    echo "using prebuilt FreeRDP from host mirror — skipping clone + cmake build"; \
  else \
    git clone --branch "${FREERDP_VERSION}" --depth 1 https://github.com/FreeRDP/FreeRDP.git /tmp/freerdp-src; \
    test "$(git -C /tmp/freerdp-src rev-parse HEAD)" = "${FREERDP_COMMIT}"; \
    cmake -S /tmp/freerdp-src -B /tmp/freerdp-build -G Ninja \
      -DCMAKE_BUILD_TYPE=Release \
      -DCMAKE_INSTALL_PREFIX=/opt/adscan/tools/freerdp/install \
      -DBUILD_TESTING=OFF \
      -DWITH_SERVER=OFF \
      -DWITH_X11=ON \
      -DWITH_WAYLAND=ON; \
    cmake --build /tmp/freerdp-build --parallel "$(nproc)"; \
    cmake --install /tmp/freerdp-build; \
    rm -rf /tmp/freerdp-src /tmp/freerdp-build; \
  fi; \
  ln -sf /opt/adscan/tools/freerdp/install/bin/xfreerdp /opt/adscan/bin/xfreerdp; \
  ln -sf /opt/adscan/tools/freerdp/install/bin/xfreerdp /opt/adscan/bin/xfreerdp3; \
  printf '%s\n' '/opt/adscan/tools/freerdp/install/lib' '/opt/adscan/tools/freerdp/install/lib64' \
    > /etc/ld.so.conf.d/adscan-freerdp.conf; \
  ldconfig; \
  /opt/adscan/bin/xfreerdp --version; \
  \
  chmod +x /opt/adscan/tools/john/run/john /opt/adscan/tools/john/run/john-generic; \
  for tool in john keepass2john keepass2john.py zip2john zip2john.py pfx2john pfx2john.py ansible2john ansible2john.py; do \
    if [ -e "/opt/adscan/tools/john/run/${tool}" ]; then \
      chmod +x "/opt/adscan/tools/john/run/${tool}" || true; \
      ln -sf "/opt/adscan/tools/john/run/${tool}" "/opt/adscan/bin/${tool}"; \
    fi; \
  done; \
  if [ -e "/opt/adscan/tools/john/run/john.conf" ]; then \
    ln -sf "/opt/adscan/tools/john/run/john.conf" "/opt/adscan/bin/john.conf"; \
  fi; \
  \
  git clone --depth 1 https://github.com/blechschmidt/massdns.git /opt/adscan/tools/massdns; \
  make -C /opt/adscan/tools/massdns; \
  chmod +x /opt/adscan/tools/massdns/bin/massdns; \
  ln -sf /opt/adscan/tools/massdns/bin/massdns /opt/adscan/bin/massdns; \
  \
  chmod -R 0777 /opt/adscan/tools /opt/adscan/tool_venvs

# SysWhispers4 – direct-syscall stub generator for evasion-compiled Windows binaries.
# mingw-w64 (already installed above) provides the x86_64-w64-mingw32-g++ cross-compiler
# required by the binary_ops Tier-2 pipeline.
RUN set -eux; \
  git clone --depth 1 https://github.com/JoasASantos/SysWhispers4.git /opt/adscan/tools/syswhispers4; \
  python3 -m venv /opt/adscan/tool_venvs/syswhispers4/venv; \
  /opt/adscan/tool_venvs/syswhispers4/venv/bin/python -m pip install --no-cache-dir -U pip; \
  if [ -f /opt/adscan/tools/syswhispers4/requirements.txt ]; then \
    /opt/adscan/tool_venvs/syswhispers4/venv/bin/python -m pip install --no-cache-dir \
      -r /opt/adscan/tools/syswhispers4/requirements.txt; \
  fi; \
  python3 /opt/adscan/tools/syswhispers4/syswhispers.py --help >/dev/null 2>&1 || true; \
  chmod -R 0777 /opt/adscan/tools/syswhispers4 /opt/adscan/tool_venvs/syswhispers4

# Donut – PE-to-shellcode converter for the Tier-3 in-memory loader pipeline.
# Installed to /opt/adscan/bin/ which is on PATH (see ENV above).
# CFLAGS=-w suppresses deprecation warnings that would fail on GCC 13+ with -Werror.
# donut's generator + its embedded x86/x64 loader stubs target amd64; upstream
# ships no arm64 build, so on arm64 the Tier-3 shellcode-loader pipeline is
# skipped (the rest of post-ex is unaffected). Flagged as an arm64 limitation.
RUN set -eux; \
  effarch="${TARGETARCH:-$(dpkg --print-architecture)}"; \
  if [ "${effarch}" = "amd64" ]; then \
    git clone --depth 1 https://github.com/TheWover/donut.git /tmp/donut_build; \
    make -C /tmp/donut_build CFLAGS="-w -O2"; \
    cp /tmp/donut_build/donut /opt/adscan/bin/donut; \
    chmod 0755 /opt/adscan/bin/donut; \
    rm -rf /tmp/donut_build; \
  else \
    echo "warning: donut has no ${effarch} build; skipping Tier-3 shellcode loader on this arch" >&2; \
  fi

# Windows attack binaries (binary_ops catalog – Tier 1 prebuilt cache).
# Stored at /opt/adscan/tools/windows-tools/<name>/<filename> to match
# get_adscan_home() / "tools" / "windows-tools" with ADSCAN_HOME=/opt/adscan.
ARG MIMIKATZ_VERSION=2.2.0-20220919
ARG RUBEUS_COMMIT=e37fa53
ARG WHISKER_COMMIT=9a236c063e37f2d59c1637bdefcae6b4371bf466
ARG KRBRELAYUP_URL=https://kb.offsec.nl/tools/techniques/krbrelayup/files/KrbRelayUp.exe
ARG RUNASCS_VERSION=1.5
ARG NANODUMP_COMMIT=main
RUN set -eux; \
  mkdir -p \
    /opt/adscan/tools/windows-tools/mimikatz \
    /opt/adscan/tools/windows-tools/rubeus \
    /opt/adscan/tools/windows-tools/certify \
    /opt/adscan/tools/windows-tools/whisker \
    /opt/adscan/tools/windows-tools/seatbelt \
    /opt/adscan/tools/windows-tools/krbrelayup \
    /opt/adscan/tools/windows-tools/runascs \
    /opt/adscan/tools/windows-tools/procdump \
    /opt/adscan/tools/windows-tools/nanodump; \
  \
  # mimikatz – credential extraction (official gentilkiwi release ZIP)
  adscan-curl -fsSL \
    "https://github.com/gentilkiwi/mimikatz/releases/download/${MIMIKATZ_VERSION}/mimikatz_trunk.zip" \
    -o /tmp/mimikatz.zip; \
  unzip -p /tmp/mimikatz.zip x64/mimikatz.exe \
    > /opt/adscan/tools/windows-tools/mimikatz/mimikatz.exe; \
  rm /tmp/mimikatz.zip; \
  \
  # Rubeus – Kerberos attacks (Ghostpack compiled binaries mirror)
  adscan-curl -fsSL \
    "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/Rubeus.exe" \
    -o /opt/adscan/tools/windows-tools/rubeus/Rubeus.exe; \
  \
  # Certify – ADCS exploitation (Ghostpack compiled binaries mirror)
  adscan-curl -fsSL \
    "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/Certify.exe" \
    -o /opt/adscan/tools/windows-tools/certify/Certify.exe; \
  \
  # Whisker – Shadow credentials.
  # The old Ghostpack-CompiledBinaries mirror stopped shipping Whisker.exe,
  # so build it from the official source to keep the image reproducible.
  git clone --depth 1 https://github.com/eladshamir/Whisker.git /tmp/Whisker; \
  git -C /tmp/Whisker checkout "${WHISKER_COMMIT}"; \
  perl -0pi -e 's#<Reference Include="System.DirectoryServices" />#<Reference Include="System.DirectoryServices" />\n    <Reference Include="System.Numerics" />#' \
    /tmp/Whisker/Whisker/Whisker.csproj; \
  build_tool=""; \
  if command -v msbuild >/dev/null 2>&1; then \
    build_tool="msbuild"; \
  elif command -v xbuild >/dev/null 2>&1; then \
    build_tool="xbuild"; \
  else \
    echo "Neither msbuild nor xbuild is available for Whisker build" >&2; \
    exit 1; \
  fi; \
  "${build_tool}" /tmp/Whisker/Whisker.sln /p:Configuration=Release /verbosity:minimal; \
  test -f /tmp/Whisker/Whisker/bin/Release/Whisker.exe; \
  cp /tmp/Whisker/Whisker/bin/Release/Whisker.exe /opt/adscan/tools/windows-tools/whisker/Whisker.exe; \
  rm -rf /tmp/Whisker; \
  \
  # Seatbelt – host security enumeration (Ghostpack compiled binaries mirror)
  adscan-curl -fsSL \
    "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/Seatbelt.exe" \
    -o /opt/adscan/tools/windows-tools/seatbelt/Seatbelt.exe; \
  \
  # KrbRelayUp – local privilege escalation via Kerberos relay.
  # The historical GitHub release URL now returns 404 and the source tree
  # requires a larger Mono/xbuild compatibility patch set than we want inside
  # the runtime image, so use the maintained OffSec knowledge-base binary.
  adscan-curl -fsSL "${KRBRELAYUP_URL}" \
    -o /opt/adscan/tools/windows-tools/krbrelayup/KrbRelayUp.exe; \
  \
  # RunasCs – run as different user (official GitHub release ZIP)
  # Also symlinked to the legacy path so runascs_manager.py finds it.
  adscan-curl -fsSL \
    "https://github.com/antonioCoco/RunasCs/releases/download/v${RUNASCS_VERSION}/RunasCs.zip" \
    -o /tmp/runascs.zip; \
  unzip -p /tmp/runascs.zip RunasCs.exe \
    > /opt/adscan/tools/windows-tools/runascs/RunasCs.exe; \
  rm /tmp/runascs.zip; \
  mkdir -p /opt/adscan/tools/runascs/windows-amd64; \
  ln -sf \
    /opt/adscan/tools/windows-tools/runascs/RunasCs.exe \
    /opt/adscan/tools/runascs/windows-amd64/RunasCs.exe; \
  \
  # procdump – Sysinternals LSASS dumper (official Microsoft/Sysinternals ZIP)
  adscan-curl -fsSL \
    "https://download.sysinternals.com/files/Procdump.zip" \
    -o /tmp/procdump.zip; \
  unzip -p /tmp/procdump.zip procdump64.exe \
    > /opt/adscan/tools/windows-tools/procdump/procdump64.exe; \
  rm /tmp/procdump.zip; \
  \
  # nanodump – LSASS dumper with PPL bypass (no public release; cross-compile from source)
  # mingw-w64 is already installed above. nanodump uses direct syscalls so no
  # MSVC dependency — the provided Makefile works with the MinGW cross-compiler.
  git clone --depth 1 https://github.com/fortra/nanodump.git /tmp/nanodump_build; \
  if [ "${NANODUMP_COMMIT}" != "main" ]; then \
    git -C /tmp/nanodump_build checkout "${NANODUMP_COMMIT}"; \
  fi; \
  make -C /tmp/nanodump_build \
    CC=x86_64-w64-mingw32-gcc \
    CXX=x86_64-w64-mingw32-g++ \
    2>&1 || true; \
  if [ -f /tmp/nanodump_build/dist/nanodump.x64.exe ]; then \
    cp /tmp/nanodump_build/dist/nanodump.x64.exe \
       /opt/adscan/tools/windows-tools/nanodump/nanodump.x64.exe; \
    echo "nanodump compiled OK"; \
  else \
    echo "warning: nanodump build did not produce dist/nanodump.x64.exe — binary will need manual placement" >&2; \
  fi; \
  rm -rf /tmp/nanodump_build; \
  \
  # GodPotatoCLR – SeImpersonate→SYSTEM via MSSQL CLR assembly (bypasses Defender write-time scan).
  # Compiled from GodPotato source (src/windows_tools/godpotato/) as a .NET library.
  # Loaded into SQL Server via CREATE ASSEMBLY FROM 0x<hex> — never touches target disk as a PE.
  # Requires: mssql sysadmin + SeImpersonatePrivilege + clr enabled + clr strict security = 0.
  mkdir -p /opt/adscan/tools/windows-tools/godpotato-clr; \
  mcs -target:library -platform:x64 -sdk:4 \
    /workspace_build/src/windows_tools/godpotato/Program.cs \
    /workspace_build/src/windows_tools/godpotato/ArgsParse.cs \
    /workspace_build/src/windows_tools/godpotato/SharpToken.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/NativeMethods.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/GodPotatoContext.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/GodPotatoUnmarshalTrigger.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/UnmarshalDCOM.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/ObjRef.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/IStreamImpl.cs \
    /workspace_build/src/windows_tools/godpotato/SqlGodPotato.cs \
    -out:/opt/adscan/tools/windows-tools/godpotato-clr/GodPotatoCLR.dll 2>&1 \
    && echo "GodPotatoCLR.dll compiled OK" \
    || echo "warning: GodPotatoCLR compilation failed — binary will need manual placement" >&2; \
  \
  # SweetPotatoCLR – SeImpersonate→SYSTEM fallback for WS2016 where GodPotato's RPCSS hook
  # does not fire (build 14393). Uses DCOM NTLM relay via BITS CLSID to obtain SYSTEM token.
  # Activated automatically by MssqlSeImpersonateService when GodPotato fails in < 2s.
  mkdir -p /opt/adscan/tools/windows-tools/sweetpotato-clr; \
  mcs -target:library -platform:x64 -sdk:4 \
    /workspace_build/src/windows_tools/sweetpotato/LocalNegotiator.cs \
    /workspace_build/src/windows_tools/sweetpotato/ObjRef.cs \
    /workspace_build/src/windows_tools/sweetpotato/StorageTrigger.cs \
    /workspace_build/src/windows_tools/sweetpotato/PotatoAPI.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/IEnumSTATSTG.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/ILockBytes.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/IMarshal.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/IStorage.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/IStream.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/Ole32.cs \
    /workspace_build/src/windows_tools/sweetpotato/Security/Privilege.cs \
    /workspace_build/src/windows_tools/sweetpotato/Security/SSPIHelper.cs \
    /workspace_build/src/windows_tools/sweetpotato/Stubs.cs \
    /workspace_build/src/windows_tools/sweetpotato/SqlSweetPotato.cs \
    -out:/opt/adscan/tools/windows-tools/sweetpotato-clr/SweetPotatoCLR.dll 2>&1 \
    && echo "SweetPotatoCLR.dll compiled OK" \
    || echo "warning: SweetPotatoCLR compilation failed — binary will need manual placement" >&2; \
  \
  # TokenTheftCLR – SMB loopback logon session token theft + GodPotato chain for
  # escalation WITHOUT SeImpersonatePrivilege (Forshaw 2020). Named pipe + SMB
  # loopback recovers a stored logon session token that retains SeImpersonate.
  # Activated automatically when SeImpersonatePrivilege is absent from the
  # process token.
  #
  # Two-artifact build: SQL Server's PROCESS token has SeImpersonate stripped
  # by hardening, so running GodPotato IN-PROCESS (impersonating the stolen
  # token on a thread only) still resolves DCOM activation against the
  # stripped process identity and degrades to NT AUTHORITY\NETWORK SERVICE
  # instead of SYSTEM (confirmed live against HTB DarkZero). The fix mirrors
  # the public write-up: launch GodPotato as a FRESH PROCESS whose PRIMARY
  # token is the stolen one. That requires an actual godpotato.exe, which is
  # compiled standalone here and embedded as a .NET manifest resource inside
  # TokenTheftCLR.dll (`-resource:`) — so the CLR ships as ONE assembly loaded
  # via CREATE ASSEMBLY FROM 0x<hex> exactly like the others, and only drops
  # the embedded exe to disk transiently at runtime (random filename, deleted
  # after use) purely because CreateProcessWithTokenW needs a real file.
  mkdir -p /opt/adscan/tools/windows-tools/token-theft-clr; \
  mcs -target:exe -platform:x64 -sdk:4 \
    /workspace_build/src/windows_tools/godpotato/Program.cs \
    /workspace_build/src/windows_tools/godpotato/ArgsParse.cs \
    /workspace_build/src/windows_tools/godpotato/SharpToken.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/NativeMethods.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/GodPotatoContext.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/GodPotatoUnmarshalTrigger.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/UnmarshalDCOM.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/ObjRef.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/IStreamImpl.cs \
    -out:/tmp/godpotato_standalone.exe 2>&1 \
  && mcs -target:library -platform:x64 -sdk:4 \
    /workspace_build/src/windows_tools/godpotato/SharpToken.cs \
    /workspace_build/src/windows_tools/token_theft/SqlTokenTheftChain.cs \
    -resource:/tmp/godpotato_standalone.exe,AdscanGodPotato.exe \
    -out:/opt/adscan/tools/windows-tools/token-theft-clr/TokenTheftCLR.dll 2>&1 \
    && echo "TokenTheftCLR.dll compiled OK" \
    || echo "warning: TokenTheftCLR compilation failed — binary will need manual placement" >&2; \
  rm -f /tmp/godpotato_standalone.exe; \
  \
  # pss-dumper + rtlcp-dumper – AV-evasion LSASS dumpers (Mono C# → Windows .NET exe)
  # PssCaptureSnapshot: snapshots lsass into a VA clone, MiniDumpWriteDump targets the
  # snapshot handle (not lsass PID) — bypasses AV hooks on MiniDumpWriteDump(lsass).
  # RtlCreateProcessReflection: clones lsass into a reflection process, dumps the clone.
  # Both require admin, neither bypasses PPL. mono-complete (mcs) is installed above.
  mkdir -p /opt/adscan/tools/windows-tools/pss-dumper \
           /opt/adscan/tools/windows-tools/rtlcp-dumper \
           /opt/adscan/tools/windows-tools/wsass-dumper \
           /opt/adscan/tools/windows-tools/ppldump; \
  mcs -target:exe -unsafe -out:/opt/adscan/tools/windows-tools/pss-dumper/pss-dumper.exe \
    /workspace_build/src/windows_tools/pss_dumper.cs 2>&1 && echo "pss-dumper compiled OK" \
    || echo "warning: pss-dumper compilation failed — binary will need manual placement" >&2; \
  mcs -target:exe -out:/opt/adscan/tools/windows-tools/rtlcp-dumper/rtlcp-dumper.exe \
    /workspace_build/src/windows_tools/rtlcp_dumper.cs 2>&1 && echo "rtlcp-dumper compiled OK" \
    || echo "warning: rtlcp-dumper compilation failed — binary will need manual placement" >&2; \
  \
  # wsass-dumper – PPL bypass via WerFaultSecure.exe (Win8.1, signed Microsoft WinTcb)
  # WSASS.exe: official TwoSevenOneT source + two ADscan patches (MinGW build):
  #   1. lpDesktop=WinSta0\Default in PPLHelp.cpp → works from Session-0 services
  #   2. explicit output path arg + auto-find lsass PID → no CWD dependency
  # WerFaultSecure.exe runs at PPL WinTcb and can open lsass even with RunAsPPL=1.
  # Syntax: WSASS.exe <WerFaultSecure.exe path> <OutputDumpPath>
  mkdir -p /opt/adscan/tools/windows-tools/wsass-dumper; \
  cp /workspace_build/src/windows_tools/WSASS.exe \
     /opt/adscan/tools/windows-tools/wsass-dumper/WSASS.exe \
     && echo "WSASS.exe (patched) copied OK" \
     || echo "warning: WSASS.exe copy failed" >&2; \
  cp /workspace_build/src/windows_tools/WerFaultSecure.exe \
     /opt/adscan/tools/windows-tools/wsass-dumper/WerFaultSecure.exe \
     && echo "WerFaultSecure.exe copied OK" \
     || echo "warning: WerFaultSecure.exe copy failed" >&2; \
  \
  # ppldump – PPL bypass via KnownDlls/DefineDosDevice userland exploit (itm4n/PPLMedic).
  # Binary extracted from lsassy ppldump_embedded and stored in src/windows_tools/.
  # Works on Windows without the July 2022 PPL patch (pre-19044.1826).
  cp /workspace_build/src/windows_tools/PPLdump.exe \
     /opt/adscan/tools/windows-tools/ppldump/PPLdump.exe \
     && echo "PPLdump.exe copied OK" \
     || echo "warning: PPLdump.exe copy failed" >&2; \
  \
  chmod -R 0777 /opt/adscan/tools/windows-tools

# Wordlists
RUN set -eux; \
  download_wordlist() { \
    local url="$1"; \
    local dest="$2"; \
    if curl --http1.1 -fsSL --retry 3 --retry-all-errors --retry-delay 5 "$url" -o "$dest"; then \
      return 0; \
    fi; \
    case "$url" in \
      https://weakpass.com/*) \
        echo "warning: TLS verification failed for $url; retrying with insecure fallback (-k)" >&2; \
        curl --http1.1 -kfsSL --retry 3 --retry-all-errors --retry-delay 5 "$url" -o "$dest"; \
        ;; \
      *) \
        return 1; \
        ;; \
    esac; \
  }; \
  mkdir -p /opt/adscan/wordlists; \
  download_wordlist https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt /opt/adscan/wordlists/rockyou.txt; \
  # kerberoast_pws is no longer downloaded here: it is staged host-side by
  # scripts/prepare_runtime_wordlists.sh and folded into combined_audit_base.txt
  # by scripts/build_combined_audit_wordlist.sh, then dropped from the context —
  # the image ships the combined audit base only (no standalone kerberoast_pws).
  mkdir -p /usr/share/wordlists/statistically-likely-usernames; \
  # Reuse the host-seeded usernames dir when present (COPYed from slu_source
  # above), else fetch the commit-pinned tarball. A bare `git clone` corrupts
  # under GitHub throttle ("curl 18 transfer closed" / "fetch-pack: invalid
  # index-pack output") and had no retry; a tarball does no pack negotiation,
  # gzip -t rejects a truncated download, and the loop accepts only a COMPLETE
  # archive. Same resilient pattern as the John builder; warm builds skip GitHub
  # entirely via the mirror (scripts/lib_build_mirror.sh, build_mirror_spec_slu).
  if [ -n "$(ls -A /usr/share/wordlists/statistically-likely-usernames 2>/dev/null)" ]; then \
    echo "using prebuilt statistically-likely-usernames from host mirror — skipping GitHub fetch"; \
  else \
    slu_fetched=0; \
    for attempt in 1 2 3 4 5; do \
      if adscan-curl -fsSL --retry 3 --retry-all-errors --retry-delay 5 \
           "https://github.com/insidetrust/statistically-likely-usernames/archive/${SLU_COMMIT}.tar.gz" \
           -o /tmp/slu.tar.gz \
         && gzip -t /tmp/slu.tar.gz; then \
        tar -xzf /tmp/slu.tar.gz -C /usr/share/wordlists/statistically-likely-usernames --strip-components=1; \
        rm -f /tmp/slu.tar.gz; \
        slu_fetched=1; break; \
      fi; \
      echo "statistically-likely-usernames tarball attempt ${attempt} failed (incomplete/throttled), retrying in $((attempt * 5))s..." >&2; \
      rm -f /tmp/slu.tar.gz; \
      sleep "$((attempt * 5))"; \
    done; \
    [ "${slu_fetched}" = "1" ] || { echo "statistically-likely-usernames: giving up after retries" >&2; exit 1; }; \
  fi; \
  chmod -R 0777 /opt/adscan/wordlists /usr/share/wordlists/statistically-likely-usernames

COPY adscan_internal/assets/wordlists/kerberos-format-inference.txt /opt/adscan/wordlists/kerberos-format-inference.txt
COPY adscan_internal/assets/wordlists/kerberos-format-inference.json /opt/adscan/wordlists/kerberos-format-inference.json

# Unbound container configuration
COPY docker/unbound_container_base.conf /etc/unbound/unbound.conf
COPY docker/unbound_adscan_control.conf /etc/unbound/unbound.conf.d/00-adscan-control.conf

COPY docker/adscan_entrypoint.sh /usr/local/bin/adscan-entrypoint
RUN chmod +x /usr/local/bin/adscan-entrypoint

###############################################################################
# PRO target: compiled binary runtime
###############################################################################
FROM runtime-common AS runtime-pro

# NOTE: ADSCAN_RUNTIME_VERSION and ADSCAN_PARTNER_TAG are declared LATER
# in this stage (at the point of use), not here. BuildKit binds
# `--build-arg` values to ARG variables at their declaration line and
# hashes the bound value into the cache key of every layer in the ARG's
# scope — even when no upstream layer references the variable. Declaring
# ARG at the point of use narrows the scope so upstream layers stay
# cacheable across builds with different version timestamps / partner
# tags. (PRO's COPY dist/adscan invalidates downstream layers on every
# build anyway because PyArmor is non-deterministic, but keeping this
# pattern consistent with LITE makes the file easier to reason about.)

ENV ADSCAN_RUNTIME_LICENSE_MODE=PRO

COPY dist/adscan /usr/local/bin/adscan

# Partner tag baked at build time — identifies which partner this image was built for.
# Passed via: docker build --build-arg ADSCAN_PARTNER_TAG=glenn-mssp-beta1
# Empty in untagged builds (dev/CI). Used by telemetry for partner-level filtering.
ARG ADSCAN_PARTNER_TAG=""

# ADSCAN_RUNTIME_VERSION enters scope HERE — narrowest possible.
ARG ADSCAN_RUNTIME_VERSION=""
# Build provenance (git commit SHA / describe / UTC timestamp the image was
# built from). Declared HERE — narrowest possible scope, BELOW every expensive
# pip/apt layer above — so a new commit SHA per build does NOT re-key those
# layers (the "a new ARG re-keys every RUN below it in scope" rule from
# CLAUDE.md; mirrors the ADSCAN_RUNTIME_VERSION precedent). Empty / "unknown"
# when built outside a git tree.
ARG ADSCAN_BUILD_COMMIT="unknown"
ARG ADSCAN_BUILD_DESCRIBE="unknown"
ARG ADSCAN_BUILD_TIMESTAMP="unknown"
RUN set -eux; \
  chmod +x /usr/local/bin/adscan; \
  if [[ -n "${ADSCAN_RUNTIME_VERSION}" ]]; then \
    printf '%s\n' "${ADSCAN_RUNTIME_VERSION}" > /opt/adscan/version; \
  fi

# Bake build-time ARGs into the image ENV only at the end, after every
# expensive layer above. The running container still exposes both
# variables without contaminating upstream cache keys.
ENV ADSCAN_PARTNER_TAG=${ADSCAN_PARTNER_TAG}
ENV ADSCAN_RUNTIME_VERSION=${ADSCAN_RUNTIME_VERSION}
ENV ADSCAN_BUILD_COMMIT=${ADSCAN_BUILD_COMMIT}
ENV ADSCAN_BUILD_DESCRIBE=${ADSCAN_BUILD_DESCRIBE}
ENV ADSCAN_BUILD_TIMESTAMP=${ADSCAN_BUILD_TIMESTAMP}

ENTRYPOINT ["/usr/local/bin/adscan-entrypoint"]

###############################################################################
# LITE target: source runtime (open-source)
###############################################################################
FROM runtime-common AS runtime-lite

# NOTE: ADSCAN_RUNTIME_VERSION is declared LATER in this stage (right before
# it's used), not here. BuildKit binds `--build-arg` values to ARG
# variables at their declaration line, and even when no upstream layer
# references the variable BuildKit hashes the bound value into the cache
# key of every layer in the ARG's scope. In CI the timestamped value
# (`9.0.0.dev<timestamp>`) would otherwise invalidate the heavy pip
# install layer on every build. Declaring ARG at the point of use
# narrows the scope so the expensive layers stay cacheable.

ENV ADSCAN_RUNTIME_LICENSE_MODE=LITE

# Runtime Python dependencies for source-mode ADscan CLI.
# Shares the same BuildKit pip wheel cache as the tool venvs above so a layer
# invalidation re-installs from cached wheels instead of re-downloading from PyPI
# (image stays small — the cache lives in the builder, not the image layer).
RUN --mount=type=cache,target=/var/cache/adscan-pip,sharing=locked \
  set -eux; \
  export PIP_CACHE_DIR=/var/cache/adscan-pip; \
  python3 -m venv /opt/adscan/venv; \
  /opt/adscan/venv/bin/python -m pip install -U pip; \
  /opt/adscan/venv/bin/python -m pip install \
    prompt_toolkit==3.0.52 \
    psutil==7.2.2 \
    rich==15.0.0 \
    python-docx==1.2.0 \
    openpyxl==3.1.5 \
    pdfplumber==0.11.10 \
    netifaces==0.11.0 \
    certifi==2026.1.4 \
    ipaddress==1.0.23 \
    python-dotenv==1.2.1 \
    sentry-sdk==2.52.0 \
    packaging==26.2 \
    questionary==2.1.1 \
    pypsrp[kerberos]==0.9.0 \
    pydantic-settings==2.13.1 \
    "pydantic-ai-slim[anthropic,google,openai]==1.101.0" \
    gssapi==1.10.1 \
    krb5==0.9.0 \
    python-magic==0.4.27 \
    markitdown==0.1.5 \
    credsweeper==${CREDSWEEPER_VERSION} \
    pykeepass==4.1.1.post1 \
    impacket==0.13.1 \
    pycryptodome==3.23.0 \
    pycryptodomex==3.23.0 \
    "dissect.target==3.25.1" \
    gpp-decrypt==2.0.0 \
    requests==2.32.5 \
    matplotlib==3.10.8 \
    graphviz==0.21 \
    pyarrow==21.0.0 \
    rustworkx==0.15.1 \
    selenium==4.31.0 \
    textual==0.80.1 \
    "redis>=5.0.0,<7.1.0" \
    playwright==1.60.0 \
    jinja2>=3.0 \
    "scapy>=2.5.0,<3.0"

# Vendored skelsec native AD stack — installed from local source at vendor/.
# This is the SAME source the developer reads under vendor/<lib>/, so what
# you read is exactly what runs. Bumping a vendored library is a single
# scripts/refresh_vendor.sh + uv lock + commit; never depend on PyPI for
# these. See CLAUDE.md § Native Library Source Code.
#
# NOTE: setcap is intentionally deferred to AFTER all pip installs.
# Applying file capabilities to the venv python binary before any subsequent
# RUN step that invokes it causes Docker buildkit to reject execution with
# exit code 126 ("Operation not permitted") — the kernel blocks execution of
# capability-bearing binaries in the builder's restricted namespace.
COPY vendor /opt/adscan-src/vendor
RUN set -eux; \
  /opt/adscan/venv/bin/python -m pip install --no-cache-dir \
    /opt/adscan-src/vendor/asysocks \
    /opt/adscan-src/vendor/badauth \
    /opt/adscan-src/vendor/kerbad \
    /opt/adscan-src/vendor/badldap \
    /opt/adscan-src/vendor/winacl \
    /opt/adscan-src/vendor/aiosmb \
    /opt/adscan-src/vendor/pypykatz \
    /opt/adscan-src/vendor/aardwolf; \
  /opt/adscan/venv/bin/python -c "\
import aiosmb, kerbad, badldap, winacl, pypykatz, asysocks, badauth, aardwolf, os; \
print('vendor ok:', aiosmb.__file__);"; \
  runtime_python="$(readlink -f /opt/adscan/venv/bin/python)"; \
  setcap cap_net_bind_service,cap_net_raw,cap_net_admin+ep "${runtime_python}"

COPY adscan.py /opt/adscan-src/adscan.py
COPY adscan_core /opt/adscan-src/adscan_core
COPY adscan_internal /opt/adscan-src/adscan_internal
COPY adscan_launcher /opt/adscan-src/adscan_launcher
COPY custom_config.yaml /opt/adscan-src/custom_config.yaml
COPY pyproject.toml /opt/adscan-src/pyproject.toml

# Pre-baked LITE cheatsheet PDF. The LITE runtime cannot render the
# cheatsheet on demand (the render engine is shared, but the PRO cheatsheet
# template under ``adscan_internal/pro/`` is stripped from this image), so the build
# pipeline pre-renders the PDF in the PRO image and seeds it into the
# build context at ``adscan_internal/assets/cheatsheet/``. The runtime
# ``adscan cheatsheet`` falls back to this static path when the PRO
# renderer module is not importable. See scripts/bake_cheatsheet.sh.
RUN mkdir -p /opt/adscan/static/cheatsheet
COPY adscan_internal/assets/cheatsheet/Quick_Start_Cheatsheet.pdf \
     /opt/adscan/static/cheatsheet/Quick_Start_Cheatsheet.pdf

# Strip PRO-only Client Deliverable Kit modules from the LITE source tree.
# Pass C: ensure deliver.py (the PRO deliverable orchestrator from Pass B)
# is never present in LITE. ``rm -f`` is idempotent — it is a no-op when
# Pass B has not landed yet, and a real strip when it has.
RUN rm -f /opt/adscan-src/adscan_internal/cli/deliver.py
# Note: cheatsheet stays in LITE (operator-facing desk reference). The
# bonuses.py module imports its PRO renderer lazily, so the import
# succeeds in LITE; PRO-only verbs (playbook/checklist/coverage-matrix)
# are gated by the exit-42 protocol in adscan.py before any PRO import
# is attempted.

# Normalize source permissions to avoid host-side restrictive modes leaking into
# the image (e.g. 0700 dirs), which can break imports when running as the
# non-root `adscan` user.
RUN chmod -R a+rX /opt/adscan-src

# Safety assertions: LITE image must not contain private modules.
RUN test ! -d /opt/adscan-src/adscan_internal/pro
RUN test ! -d /opt/adscan-src/adscan_internal/reporting
RUN test ! -f /opt/adscan-src/adscan_internal/services/report_service.py
RUN test ! -f /opt/adscan-src/adscan_internal/report_generator.py
RUN test ! -f /opt/adscan-src/adscan_internal/cli/deliver.py

ENV PYTHONPATH=/opt/adscan-src

RUN printf '%s\n' \
  '#!/usr/bin/env bash' \
  'set -euo pipefail' \
  'exec /opt/adscan/venv/bin/python /opt/adscan-src/adscan.py "$@"' \
  > /usr/local/bin/adscan \
  && chmod +x /usr/local/bin/adscan

# ADSCAN_RUNTIME_VERSION enters scope HERE — narrowest scope possible.
# Every layer above this point is independent of the version timestamp
# and stays cacheable across builds with different versions.
ARG ADSCAN_RUNTIME_VERSION=""
# Build provenance (git commit SHA / describe / UTC timestamp the image was
# built from). Declared HERE — narrowest possible scope, BELOW every expensive
# pip/apt layer above — so a new commit SHA per build does NOT re-key those
# layers (the "a new ARG re-keys every RUN below it in scope" rule from
# CLAUDE.md; mirrors the ADSCAN_RUNTIME_VERSION precedent). Empty / "unknown"
# when built outside a git tree.
ARG ADSCAN_BUILD_COMMIT="unknown"
ARG ADSCAN_BUILD_DESCRIBE="unknown"
ARG ADSCAN_BUILD_TIMESTAMP="unknown"
RUN set -eux; \
  if [[ -n "${ADSCAN_RUNTIME_VERSION}" ]]; then \
    printf '%s\n' "${ADSCAN_RUNTIME_VERSION}" > /opt/adscan/version; \
  fi

# Bake the version into the image ENV only at the end, after every
# expensive layer above. The running container still exposes
# ADSCAN_RUNTIME_VERSION without contaminating upstream cache keys.
ENV ADSCAN_RUNTIME_VERSION=${ADSCAN_RUNTIME_VERSION}
ENV ADSCAN_BUILD_COMMIT=${ADSCAN_BUILD_COMMIT}
ENV ADSCAN_BUILD_DESCRIBE=${ADSCAN_BUILD_DESCRIBE}
ENV ADSCAN_BUILD_TIMESTAMP=${ADSCAN_BUILD_TIMESTAMP}

ENTRYPOINT ["/usr/local/bin/adscan-entrypoint"]