FROM node:24-trixie-slim
WORKDIR /app
RUN apt-get update -qq \
  && apt-get upgrade -y -qq \
  && apt-get install -y -qq --no-install-recommends ca-certificates curl gnupg openssl bzip2 \
    && rm -rf /var/lib/apt/lists/*
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
RUN set -eu; \
    mkdir -m 700 -p /tmp/monero-verify /opt/monero; \
    cd /tmp/monero-verify; \
    curl --fail --silent --show-error --location --proto '=https' --tlsv1.2 \
      'https://downloads.getmonero.org/cli/monero-linux-x64-v0.18.5.4.tar.bz2' -o monero-linux-x64-v0.18.5.4.tar.bz2; \
    curl --fail --silent --show-error --location --proto '=https' --tlsv1.2 \
      'https://www.getmonero.org/downloads/hashes.txt' -o hashes.txt; \
    curl --fail --silent --show-error --location --proto '=https' --tlsv1.2 \
      'https://raw.githubusercontent.com/monero-project/monero/master/utils/gpg_keys/binaryfate.asc' -o binaryfate.asc; \
    actual_fingerprint="$(gpg --batch --show-keys --with-colons binaryfate.asc | awk -F: '$1 == "fpr" {print $10; exit}')"; \
    test "$actual_fingerprint" = '81AC591FE9C4B65C5806AFC3F0AF4D462A0BDF92'; \
    export GNUPGHOME=/tmp/monero-verify/gnupg; mkdir -m 700 -p "$GNUPGHOME"; \
    gpg --batch --import binaryfate.asc >/dev/null 2>&1; \
    gpg --batch --output hashes.verified.txt --decrypt hashes.txt >/dev/null 2>&1; \
    grep -Fx 'ba2928962c101b609434bf8c1b43ad59ebe96c5525977284ca599d8bf0f02d10  monero-linux-x64-v0.18.5.4.tar.bz2' hashes.verified.txt >/dev/null; \
    printf '%s  %s\n' 'ba2928962c101b609434bf8c1b43ad59ebe96c5525977284ca599d8bf0f02d10' 'monero-linux-x64-v0.18.5.4.tar.bz2' | sha256sum --check --status; \
    tar -xjf monero-linux-x64-v0.18.5.4.tar.bz2 -C /opt/monero --strip-components=1; \
    rm -rf /tmp/monero-verify
CMD ["node", "--experimental-strip-types", "scripts/monero-mtls-stagenet-rehearsal.mjs", "/opt/monero/monero-wallet-rpc"]