Containerfile.final

ARG IMAGE_NAME
ARG IMAGE_VENDOR
ARG DESKTOP_FLAVOR
ARG TUNAOS_IMAGE_FLAVOR
ARG SHA_HEAD_SHORT
ARG TUNAOS_PROJECT_NAME
ARG RECHUNKED_BASE

# Produced by external chunkah run and loaded into podman storage via skopeo
FROM ${RECHUNKED_BASE}

ARG IMAGE_NAME
ARG IMAGE_VENDOR
ARG DESKTOP_FLAVOR
ARG TUNAOS_IMAGE_FLAVOR
ARG SHA_HEAD_SHORT
ARG TUNAOS_PROJECT_NAME

LABEL org.opencontainers.image.title="${TUNAOS_PROJECT_NAME} ${IMAGE_NAME} (${DESKTOP_FLAVOR})"
LABEL org.opencontainers.image.vendor="${IMAGE_VENDOR}"
LABEL org.opencontainers.image.version="${SHA_HEAD_SHORT}"
LABEL io.bootc=1
LABEL containers.bootc=1
LABEL ostree.bootable=1

# Common administrator policy, after every variant's package/config layers.
# tuna-desktop#989 / run 41230684089: a GDM-created wheel admin on Marlin got
# "user NOT in sudoers". Debian/Ubuntu retain their existing %sudo grant.
# Tumbleweed's vendor sudoers is 0444; Containerfile.opensuse moves /usr/etc
# into /etc, so tighten whichever copy exists for visudo's 0440 check.
COPY --chown=0:0 --chmod=0440 system_files/etc/sudoers.d/10-tunaos-wheel /etc/sudoers.d/10-tunaos-wheel
RUN for f in /etc/sudoers /usr/etc/sudoers; do \
        if [ -f "$f" ]; then chmod 0440 "$f"; fi; \
    done && \
    visudo -cf /etc/sudoers.d/10-tunaos-wheel && \
    visudo -c

# Retain build provenance in the final non-empty layer. A LABEL-only stage
# produces an empty tar that bootc cannot import (tuna-os/tunaOS#3378).
RUN mkdir -p /usr/share/tunaos && \
    printf '{"image":"%s","flavor":"%s","vendor":"%s","revision":"%s"}\n' \
        "${IMAGE_NAME}" "${TUNAOS_IMAGE_FLAVOR}" "${IMAGE_VENDOR}" "${SHA_HEAD_SHORT}" \
        > /usr/share/tunaos/build-info.json