# The edge's image (Redmine #4943): the official nginx image, pinned by digest, with one
# package upgraded. brotli-libs 1.2.1-r0 fixes CVE-2026-111497 (CISA KEV, due 2026-11-10;
# Alpine 3.24 secdb), and no official nginx alpine tag ships it yet. freetype and libcurl pull
# the library in; nginx itself does not load it. Nothing else changes: the entrypoint, the
# command, the user, the ports and the template rendering are the official image's, and
# compose.yml mounts the configuration as before. compose.yml builds this image and never
# pulls it; deploy/host/deploy.sh builds it from the commit on every host.
#
# Once an official alpine tag ships brotli-libs 1.2.1-r0 or later, compose.yml can name that
# tag by digest again, and this file goes.
FROM nginx:1.30.6-alpine@sha256:47928bf67eb62a1863cb08d9ecb52d3e704304ba614eaee17884204677702951

# The newest revision Alpine 3.24 has, never a pinned one: Alpine drops older revisions. The
# build stops below the fixed version. apk-tools 3 prints the version only with -e.
RUN set -eu; \
    apk upgrade --no-cache brotli-libs; \
    installed="$(apk info -e -v brotli-libs)"; \
    case "$(apk version -t "${installed#brotli-libs-}" 1.2.1-r0)" in \
      "=" | ">") ;; \
      *) echo "${installed:-brotli-libs}: CVE-2026-111497 needs 1.2.1-r0 or later" >&2; exit 1 ;; \
    esac
