FROM python:3.12.13-bookworm

# Noninteractive apt to keep builds deterministic
ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        git \
        build-essential \
        pkg-config \
        libssl-dev \
        libjson-c-dev \
        python3 \
        python3-pip && \
    rm -rf /var/lib/apt/lists/*

# Working directory for the project
WORKDIR /opt/cipherscan

# Copy source code
COPY . .

# Ensure scripts are executable
RUN chmod +x cscan.sh && chmod +x cscan.py

# Build the C component (parse_CAs) using the provided Makefile in top1m
RUN make -C top1m build

# Default entrypoint to run the project's scanner wrapper
ENTRYPOINT ["./cscan.sh"]

# Ignore git and environment and various generated files
.git
__pycache__/
*.pyc
*.pyo
*.pyd
*.swp
*.swo
.DS_Store
venv/
.env
.envrc
.coverage
*.log
build/
dist/

# Ignore top-level build outputs
**/build/
**/dist/

# Ignore node_modules if present
node_modules/

Failing step
- [6/6] RUN make -C top1m build

Exact error message and exit code
- parse_CAs.c: In function ‘process_host_results’:
- parse_CAs.c:434:17: error: ‘FALSE’ undeclared (first use in this function)
- 434 |     if (j_rc == FALSE) {
- parse_CAs.c:434:17: note: each undeclared identifier is reported only once for each function it appears in
- make: *** [Makefile:2: build] Error 1
- process "/bin/sh -c make -C top1m build" did not complete successfully: exit code: 2

Failing command/step
- RUN make -C top1m build (in the Dockerfile’s 6th step)

Missing packages or files mentioned
- None explicitly mentioned as missing. The error is a C compile-time issue (FALSE undeclared) in parse_CAs.c, not a missing package/file.

Version mismatch info
- Base image: python:3.12.13-bookworm (FROM line)
- apt-get step shows Python version mismatch: “python3 is already the newest version (3.11.2-1+b1)” indicating the apt repository provides Python 3.11.x while the base image ships Python 3.12.x. This is a version mismatch between the image base and the package index.

- Purpose: A C program (OpenSSL + json-c) that verifies TLS certificate chains against trust stores and outputs per-host chain results in JSON.

- License/author: Mozilla Public License v2.0; Author: Hubert Kario (2014).

- Dependencies/libraries: OpenSSL, json-c.

- Configured paths (hard-coded):
  - CA_TRUSTED: ./ca_trusted
  - CA_ALL: ./ca_files
  - CERTS_DIR: ./certs

- SSL trust stores:
  - trusted_only: SSL_CTX created from SSLv23_method, loaded with CA_TRUSTED
  - all_CAs: SSL_CTX created from SSLv23_method, loaded with CA_ALL

- Time handling:
  - Optional argument: if no arg, v_time = current time
  - If an argument is provided, it must be a valid number (time in seconds). Error: "time parameter is not a valid number"

- Main workflow:
  - Iterates files in results/ (skips . and ..)
  - For each file, calls process_host_results(buffer, v_time)
  - process_host_results reads JSON host results, prints JSON like {"host":"<path>","chains":[ ... ]}
  - For each ciphersuite entry with a "certificates" array:
    - Builds certs array of hash strings
    - Registers known chains to avoid duplicates
    - If first valid chain, calls process_chain(certs, v_time)

- process_chain behavior:
  - Loads EE certificate from first hash via hash_to_filename(hash) → "<CERTS_DIR>/<hash>.pem" or "<CA_ALL>/<hash>.pem"
  - Loads intermediate certs from remaining hashes
  - Verifies chain using trusted_only store with X509_V_FLAG_TRUSTED_FIRST and v_time
  - If verification succeeds with trusted anchors only: prints
    {"chain":"complete","certificates":[ "<sha256>", ... ]}
  - If fails, retries with all_CAs (including intermediates):
    - If verification fails: prints {"chain":"untrusted"}
    - If succeeds: prints {"chain":"incomplete","certificates":[ "<sha256>", ... ]}

- SHA-256 hashing:
  - For each certificate in the produced chain, X509_digest(..., "sha256") → hex string

- Output format:
  - Per host file: {"host":"<results file>","chains":[ ... ]}
  - Each chain entry either "complete", "untrusted", or "incomplete" with corresponding "certificates" hex list when applicable

- Auxiliary helpers (summary):
  - load_cert: reads PEM X509 with PEM_read_bio_X509_AUX; reports "Unable to load file %s as X509 certificate" on failure
  - hash_to_filename: checks "<CERTS_DIR>/<hash>.pem" then "<CA_ALL>/<hash>.pem"; returns NULL if not found
  - read_json_from_file: reads and parses JSON file; prints errors to stderr on failure
  - string_array_cmp/register_known_chains: deduplicates known certificate chains
  - Warnings: if X509_V_FLAG_TRUSTED_FIRST not available, a #warning is emitted and the flag is defined as 0

- Notable error messages you might see:
  - "Unable to load file %s as X509 certificate"
  - "Out of memory (line %i)"
  - "Out of buffer space (line %i)"
  - "store init failed"
  - "time parameter is not a valid number"
  - "error while processing %s"

FROM python:3.12.13-bookworm

# Noninteractive apt to keep builds deterministic
ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        git \
        build-essential \
        pkg-config \
        libssl-dev \
        libjson-c-dev \
        python3 \
        python3-pip && \
    rm -rf /var/lib/apt/lists/*

# Working directory for the project
WORKDIR /opt/cipherscan

# Copy source code
COPY . .

# Ensure scripts are executable
RUN chmod +x cscan.sh && chmod +x cscan.py

# Note: Building the C CA parser (top1m/parse_CAs.c) can fail on some environments due to macro issues.
# Rely on runtime TLS libraries clones performed by cscan.sh.

# Default entrypoint to run the project's scanner wrapper
ENTRYPOINT ["./cscan.sh"]