# tacchaind — binary download from GitHub releases (v1.6.0).
# Downloads pre-built linux-amd64 binary and verifies against checksums.txt.
ARG VERSION=v1.6.0

FROM alpine:3.21

RUN apk upgrade --no-cache && \
    apk add --no-cache \
    ca-certificates \
    curl \
    libusb

# Download binary and checksums
ARG VERSION
RUN set -eux; \
    BINARY_URL="https://github.com/TacBuild/tacchain/releases/download/${VERSION}/tacchaind-linux-amd64" && \
    CHECKSUMS_URL="https://github.com/TacBuild/tacchain/releases/download/${VERSION}/checksums.txt" && \
    curl -sL -o /tmp/tacchaind "${BINARY_URL}" && \
    curl -sL -o /tmp/checksums.txt "${CHECKSUMS_URL}" && \
    # Verify the binary against checksums.txt (sha256sum format: <hash>  <filename>)
    cd /tmp && \
    ExpectedHash=$(grep "tacchaind-linux-amd64$" checksums.txt | awk '{print $1}') && \
    ActualHash=$(sha256sum tacchaind | awk '{print $1}') && \
    if [ "$ExpectedHash" != "$ActualHash" ]; then \
      echo "ERROR: checksum mismatch for tacchaind-linux-amd64" >&2; \
      echo "  Expected: $ExpectedHash" >&2; \
      echo "  Actual:   $ActualHash" >&2; \
      exit 1; \
    fi && \
    chmod +x /tmp/tacchaind && \
    mv /tmp/tacchaind /usr/bin/tacchaind && \
    rm -f /tmp/checksums.txt

COPY ./scripts/cometbft-common.sh /usr/local/bin/cometbft-common.sh
COPY ./scripts/init.sh /usr/local/bin/init.sh
RUN chmod +x /usr/local/bin/init.sh /usr/local/bin/cometbft-common.sh

WORKDIR /opt

EXPOSE 1317 26656 26657 8545 8546

ENTRYPOINT ["init.sh"]