# CVE-2026-19633 reproduction image
#
# Builds BOTH variants of the postgresql_anonymizer extension inside a real
# postgres:17 server image:
#   * /opt/anon-vuln  : the vulnerable checkout (parent of the fix commit)
#   * /opt/anon-fixed : the fixed checkout (contains the anon.nosuperuser barrier)
#
# Build context must be a directory containing:
#   anon/           full git clone of postgresql_anonymizer (WITH .git)
#   anon-select.sh  variant selection helper (copied into the image)
#
# The server is started later with:
#   anon-select vuln|fixed && docker-entrypoint.sh postgres \
#       -c shared_preload_libraries=anon

ARG PG_IMAGE=postgres:17
FROM ${PG_IMAGE}

ARG VULN_COMMIT
ARG FIXED_COMMIT
ARG PGRX_VERSION=0.19.1

RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      build-essential \
      ca-certificates \
      curl \
      git \
      make \
      pkg-config \
      postgresql-server-dev-17 \
 && rm -rf /var/lib/apt/lists/*

ENV RUSTUP_HOME=/usr/local/rustup
ENV CARGO_HOME=/usr/local/cargo
ENV PATH=/usr/local/cargo/bin:$PATH

RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
      | sh -s -- -y --profile minimal --default-toolchain stable \
 && rustup default stable

RUN cargo install cargo-pgrx --version "${PGRX_VERSION}" --locked

# Full git history is required so both commits can be checked out in-image.
COPY anon /src/anon
RUN git config --global --add safe.directory /src/anon \
 && cd /src/anon \
 && cargo pgrx init --pg17 /usr/bin/pg_config

# ---- vulnerable variant: parent of the fix commit (CVE-2026-19633 live) ----
RUN cd /src/anon \
 && git checkout --detach "${VULN_COMMIT}" \
 && make extension install PGVER=pg17 \
 && mkdir -p /opt/anon-vuln/lib /opt/anon-vuln/extension \
 && cp -r "$(pg_config --sharedir)/extension/." /opt/anon-vuln/extension/ \
 && cp "$(pg_config --pkglibdir)/anon.so" /opt/anon-vuln/lib/ \
 && echo "${VULN_COMMIT}" > /opt/anon-vuln/COMMIT

# ---- fixed variant: the fix commit (anon.nosuperuser barrier present) ----
RUN cd /src/anon \
 && git checkout --detach "${FIXED_COMMIT}" \
 && make extension install PGVER=pg17 \
 && mkdir -p /opt/anon-fixed/lib /opt/anon-fixed/extension \
 && cp -r "$(pg_config --sharedir)/extension/." /opt/anon-fixed/extension/ \
 && cp "$(pg_config --pkglibdir)/anon.so" /opt/anon-fixed/lib/ \
 && echo "${FIXED_COMMIT}" > /opt/anon-fixed/COMMIT

# Empty the live install locations so that a variant MUST be selected
# explicitly before the server starts.
RUN rm -rf "$(pg_config --sharedir)/extension/anon" \
           "$(pg_config --sharedir)"/extension/anon.control \
           "$(pg_config --sharedir)"/extension/anon--*.sql \
           "$(pg_config --pkglibdir)/anon.so"

COPY anon-select.sh /usr/local/bin/anon-select
RUN chmod +x /usr/local/bin/anon-select

# sanity: both variants actually contain the extension files
RUN test -f /opt/anon-vuln/lib/anon.so \
 && test -f /opt/anon-fixed/lib/anon.so \
 && ls /opt/anon-vuln/extension/anon.control \
 && ls /opt/anon-fixed/extension/anon.control