Dockerfile

# Reproducible verify image for tinyexpr.zig
# Zig tarball pinned by SHA-256 per architecture. Base is ubuntu:24.04.
# TARGETARCH comes from BuildKit (amd64 / arm64). Without this, Apple Silicon
# Docker builds an arm64 Ubuntu image, downloads the x86_64 Zig binary, and
# fails at link time with "invalid ELF machine type: AARCH64".
# Note: no `# syntax=docker/dockerfile:...` line. That frontend pull has timed
# out on GitHub-hosted runners talking to registry-1.docker.io.
FROM ubuntu:24.04 AS base

ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    curl \
    xz-utils \
    gcc \
    g++ \
    libc6-dev \
    make \
    git \
    python3 \
    rsync \
    binutils \
    && rm -rf /var/lib/apt/lists/* \
    && apt-get clean

ARG TARGETARCH
ENV ZIG_VERSION=0.16.0
# Official ziglang.org SHA-256 for 0.16.0 (also recorded in .upstream.toml).
RUN set -eux; \
    case "${TARGETARCH}" in \
      amd64) ZIG_ARCH=x86_64; ZIG_SHA256=70e49664a74374b48b51e6f3fdfbf437f6395d42509050588bd49abe52ba3d00 ;; \
      arm64) ZIG_ARCH=aarch64; ZIG_SHA256=ea4b09bfb22ec6f6c6ceac57ab63efb6b46e17ab08d21f69f3a48b38e1534f17 ;; \
      *) echo "unsupported TARGETARCH=${TARGETARCH}" >&2; exit 1 ;; \
    esac; \
    curl -fsSL "https://ziglang.org/download/${ZIG_VERSION}/zig-${ZIG_ARCH}-linux-${ZIG_VERSION}.tar.xz" \
      -o /tmp/zig.tar.xz; \
    echo "${ZIG_SHA256}  /tmp/zig.tar.xz" | sha256sum -c -; \
    tar -xJf /tmp/zig.tar.xz -C /opt; \
    mv /opt/zig-${ZIG_ARCH}-linux-${ZIG_VERSION} /opt/zig; \
    rm /tmp/zig.tar.xz
ENV PATH=/opt/zig:$PATH

WORKDIR /src
COPY . .
RUN chown -R ubuntu:ubuntu /src \
 && mkdir -p /home/ubuntu/.cache/zig-tinyexpr /home/ubuntu/.cache/zig-local /home/ubuntu/.cache/zig-global \
 && chown -R ubuntu:ubuntu /home/ubuntu

USER ubuntu
ENV HOME=/home/ubuntu
ENV CACHE=/home/ubuntu/.cache/zig-tinyexpr
ENV WORKDIR=/home/ubuntu/tinyexpr-work
ENV ZIG_LOCAL_CACHE_DIR=/home/ubuntu/.cache/zig-local
ENV ZIG_GLOBAL_CACHE_DIR=/home/ubuntu/.cache/zig-global
CMD ["bash", "scripts/verify.sh"]