FROM quay.io/pypa/manylinux_2_28_x86_64@sha256:65140ef21cef92d0c13d001708afd7d304d7a154f7120d039df99dac708f3ffb

ENV RUSTUP_HOME=/usr/local/rustup \
    CARGO_HOME=/usr/local/cargo \
    PATH=/opt/python/cp311-cp311/bin:/usr/local/cargo/bin:$PATH \
    RUST_VERSION=1.97.0 \
    RUSTUP_VERSION=1.29.0 \
    RUSTUP_INIT_SHA256=4acc9acc76d5079515b46346a485974457b5a79893cfb01112423c89aeb5aa10

# Override the repository rust-toolchain.toml at run time so rustup uses the
# preinstalled minimal toolchain instead of lazily installing its components.
ENV RUSTUP_TOOLCHAIN=1.97.0

# perl-core supplies Time::Piece and friends that OpenSSL's Configure needs
# when the human-approval-vendored feature builds OpenSSL from source.
RUN yum install -y curl gcc make perl-core perl-IPC-Cmd openssl-devel && \
    yum clean all && \
    rm -rf /var/cache/yum

# Bootstrap rustup from a versioned binary only after validating the
# publisher-provided SHA-256. Rustup then installs the exact toolchain and
# verifies component hashes recorded in the Rust distribution manifest.
RUN set -eux; \
    rustup_init=/tmp/rustup-init; \
    curl --fail --location --proto '=https' --proto-redir '=https' \
      --tlsv1.2 --retry 3 --connect-timeout 15 --max-time 120 \
      --output "$rustup_init" \
      "https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/x86_64-unknown-linux-gnu/rustup-init"; \
    echo "${RUSTUP_INIT_SHA256}  ${rustup_init}" | sha256sum -c -; \
    chmod 0755 "$rustup_init"; \
    "$rustup_init" -y --profile minimal --no-modify-path --default-toolchain "$RUST_VERSION"; \
    rm -f "$rustup_init"; \
    rustc --version | grep -F "rustc ${RUST_VERSION} "

# Install maturin using pip for one of the Pythons in the image
RUN /opt/python/cp311-cp311/bin/python -m pip install \
      --disable-pip-version-check --no-cache-dir --only-binary=:all: \
      "maturin==1.5.0"

WORKDIR /work
