# Deterministic non-ASAN runtime for CVE-2026-92392.
FROM ubuntu:24.04@sha256:224a1869083a311ef3f13648a154ba79832fbef6364d31493642ca03082da254
ARG CURL_SHA256=d54dd598bf05927a726deb38df31c6a255ba83ff1de57c5d1464dac3ed8f44a1
ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates curl clang make pkg-config wget \
      libnghttp2-dev libssl-dev zlib1g-dev libbrotli-dev libzstd-dev \
      libidn2-dev libpsl-dev libssh2-1-dev libkrb5-dev libldap2-dev libsasl2-dev \
      python3 python3-pip python3-cryptography openssl \
 && pip3 install --break-system-packages hyperframe==6.1.0 hpack==4.1.0 \
 && rm -rf /var/lib/apt/lists/*

# Exact historical packages are downloaded and SHA-256-verified by
# reproduction_steps.sh before docker build; Docker only consumes local bytes.
COPY pinned /tmp/pinned
RUN apt-get update && apt-get install -y --allow-downgrades \
      /tmp/pinned/libc6_2.39-0ubuntu8.7_amd64.deb \
      /tmp/pinned/libc-bin_2.39-0ubuntu8.7_amd64.deb \
      /tmp/pinned/libc6-dev_2.39-0ubuntu8.7_amd64.deb \
      /tmp/pinned/libc-dev-bin_2.39-0ubuntu8.7_amd64.deb \
      /tmp/pinned/libc6-i386_2.39-0ubuntu8.7_amd64.deb \
      /tmp/pinned/ca-certificates_20240203_all.deb \
      /tmp/pinned/libssl3t64_3.0.13-0ubuntu3.15_amd64.deb \
      /tmp/pinned/libssl-dev_3.0.13-0ubuntu3.15_amd64.deb \
      /tmp/pinned/openssl_3.0.13-0ubuntu3.15_amd64.deb \
      /tmp/pinned/libkrb5-3_1.20.1-6ubuntu2.8_amd64.deb \
      /tmp/pinned/libgssapi-krb5-2_1.20.1-6ubuntu2.8_amd64.deb \
      /tmp/pinned/libk5crypto3_1.20.1-6ubuntu2.8_amd64.deb \
      /tmp/pinned/libkrb5support0_1.20.1-6ubuntu2.8_amd64.deb \
      /tmp/pinned/libkrb5-dev_1.20.1-6ubuntu2.8_amd64.deb \
      /tmp/pinned/krb5-multidev_1.20.1-6ubuntu2.8_amd64.deb \
      /tmp/pinned/libgssrpc4t64_1.20.1-6ubuntu2.8_amd64.deb \
      /tmp/pinned/libkadm5clnt-mit12_1.20.1-6ubuntu2.8_amd64.deb \
      /tmp/pinned/libkadm5srv-mit12_1.20.1-6ubuntu2.8_amd64.deb \
      /tmp/pinned/libkdb5-10t64_1.20.1-6ubuntu2.8_amd64.deb \
 && apt-mark hold libc6 libc-bin libc6-dev libc-dev-bin libc6-i386 \
      ca-certificates libssl3t64 libssl-dev openssl libkrb5-3 \
      libgssapi-krb5-2 libk5crypto3 libkrb5support0 libkrb5-dev \
 && echo "d8db8739a1633c972cec6a4fe0566bdcec6fd088f98723492ab0361f66238f75  /usr/lib/x86_64-linux-gnu/libc.so.6" | sha256sum -c - \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /src
COPY curl-8.22.0.tar.gz curl.tar.gz
RUN echo "${CURL_SHA256}  curl.tar.gz" | sha256sum -c - \
 && tar xzf curl.tar.gz && mkdir build && cd build \
 && CC=clang CFLAGS="-O2 -g" LDFLAGS="-Wl,-rpath,/opt/curl-release/lib" \
    ../curl-8.22.0/configure --prefix=/opt/curl-release \
      --enable-static --enable-shared --disable-docs --disable-manual \
      --with-openssl --with-zlib --with-brotli --with-zstd --with-libidn2 \
      --with-nghttp2 --with-libpsl --with-libssh2 --with-gssapi \
      --enable-ldap --enable-ldaps --enable-websockets --enable-mqtt --enable-ipfs \
      --enable-ntlm --enable-smb --enable-httpsig --enable-httpsrr --enable-ssls-export \
 && make -j"$(nproc)" && make install

COPY rce /work/rce
RUN chmod +x /work/rce/*.sh && mkdir -p /work/rce/victim-cwd /work/rce/out \
 && cp /work/rce/ca/labca.crt /usr/local/share/ca-certificates/ \
 && update-ca-certificates

# Preserve the disclosed CA-bundle shaping step used by the heap calibration.
RUN cd /tmp && csplit -s -z -f anchor -b '%03d.pem' /etc/ssl/certs/ca-certificates.crt '/-----BEGIN CERTIFICATE-----/' '{*}' \
 && for c in /tmp/anchor*.pem; do \
      name=$(openssl x509 -in "$c" -noout -subject -nameopt multiline 2>/dev/null | sed -n 's/^ *commonName *= *//p' | head -1); \
      [ -n "$name" ] || name=$(openssl x509 -in "$c" -noout -subject -nameopt multiline | sed -n 's/^ *organizationName *= *//p' | head -1); \
      printf '%s\n' "$name"; openssl x509 -in "$c" -outform PEM; \
      printf '\nTrusted for:\n  - 1.3.6.1.5.5.7.3.1 (RFC5280: serverAuth key usage)\n'; \
      openssl x509 -in "$c" -trustout -addtrust serverAuth; printf '\n'; \
    done > /tmp/bundle.crt \
 && cp /tmp/bundle.crt /etc/ssl/certs/ca-certificates.crt \
 && rm -f /tmp/anchor*.pem /tmp/bundle.crt
WORKDIR /work/rce
CMD ["/bin/bash"]