# pqchannel dev/test image — the shared, reproducible environment for both the
# Windows (amd64) and Mac M2 (arm64) developer.  Docker compiles liboqs once
# here, so nobody needs a local C toolchain.  liboqs is the vetted Open Quantum
# Safe C library — we are NOT vendoring our own crypto (CLAUDE.md rule 1).
FROM python:3.12-slim

# Build tools required to compile the native liboqs library that liboqs-python
# wraps: build-essential (gcc/make), cmake, git to fetch the source, and
# libssl-dev because liboqs's default build links OpenSSL for AES/SHA.
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
        build-essential \
        cmake \
        git \
        libssl-dev \
        ca-certificates \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Install Python dependencies first, in an early layer, for build caching.
# hatchling needs pyproject.toml + README.md + the package source present.
COPY pyproject.toml README.md ./
COPY src ./src
RUN pip install --no-cache-dir -e ".[dev,bench]"

# Bake the native liboqs build into the image.  The first `import oqs`
# compiles liboqs into /root/_oqs; doing it here means it is NOT rebuilt on
# every container start.
RUN python -c "import oqs; print('liboqs', oqs.oqs_version(), 'ready')"

# Copy the rest of the project (tests, scratch scripts, etc.).
COPY . .

# Default command: run the full test suite.  Inside this image liboqs is
# present, so nothing is skipped.
CMD ["pytest"]
