FROM scratch AS base
ENV VERSION=3.0.12
ENV SRC_HASH=f93c9e8edde5e9166119de31755fc87b4aa34863662f67ddfcba14d0b6b69b61
ENV SRC_FILE=openssl-${VERSION}.tar.gz
ENV SRC_SITE=https://www.openssl.org/source/${SRC_FILE}

FROM base AS fetch
ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .

FROM fetch AS build
COPY --from=stagex/busybox . /
COPY --from=stagex/gcc . /
COPY --from=stagex/binutils . /
COPY --from=stagex/make . /
COPY --from=stagex/musl . /
COPY --from=stagex/perl . /
COPY --from=stagex/linux-headers . /
RUN tar -xf ${SRC_FILE}
WORKDIR /openssl-${VERSION}
ENV SOURCE_DATE_EPOCH=1
RUN --network=none <<-EOF
	set -eux
	export CC='gcc -fPIE -pie'
	perl ./Configure \
		--prefix=/usr \
		--libdir=lib \
		--openssldir=/etc/ssl \
		threads \
		enable-ktls \
		shared \
		no-zlib \
		no-async \
		no-comp \
		no-idea \
		no-mdc2 \
		no-rc5 \
		no-ec2m \
		no-ssl3 \
		no-seed \
		no-weak-ssl-ciphers \
		linux-x86_64
	make -j "$(nproc)"
EOF

FROM build AS install
RUN --network=none make DESTDIR=/rootfs install

FROM stagex/filesystem AS package
COPY --from=install /rootfs/. /