FROM ubuntu:24.04 AS builder

ARG OPENSSL_VERSION=1.1.1w
ARG PYTHON_VERSION=2.7.18

ENV DEBIAN_FRONTEND=noninteractive \
    OPENSSL_ROOT=/opt/openssl-1.1.1 \
    PYTHON_ROOT=/opt/python2 \
    PATH=/opt/python2/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
    LD_LIBRARY_PATH=/opt/openssl-1.1.1/lib:/opt/python2/lib

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        build-essential \
        ca-certificates \
        curl \
        default-libmysqlclient-dev \
        libbz2-dev \
        libffi-dev \
        libncurses-dev \
        libreadline-dev \
        libsqlite3-dev \
        perl \
        xz-utils \
        zlib1g-dev \
    && rm -rf /var/lib/apt/lists/* /var/cache/apt/*

# O Python 2.7 precisa do OpenSSL 1.1.1 para manter compatibilidade com as
# bibliotecas fiscais e criptográficas legadas do e-Corporativo.
RUN curl -fsSL \
        "https://www.openssl.org/source/old/1.1.1/openssl-${OPENSSL_VERSION}.tar.gz" \
        -o /tmp/openssl.tar.gz \
    && mkdir -p /tmp/openssl-src \
    && tar -xzf /tmp/openssl.tar.gz --strip-components=1 -C /tmp/openssl-src \
    && cd /tmp/openssl-src \
    && ./config \
        --prefix="${OPENSSL_ROOT}" \
        --openssldir="${OPENSSL_ROOT}/ssl" \
        --libdir=lib \
        shared zlib \
    && make -s -j2 \
    && make -s install_sw \
    && mkdir -p "${OPENSSL_ROOT}/ssl" \
    && cp apps/openssl.cnf "${OPENSSL_ROOT}/ssl/openssl.cnf" \
    && rm -rf /tmp/openssl-src /tmp/openssl.tar.gz

# UCS4 é necessário para utilizar os wheels CPython 2.7 "cp27mu" usados por
# NumPy, SciPy, lxml, Pillow e outras dependências antigas do projeto.
RUN curl -fsSL \
        "https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz" \
        -o /tmp/python.tgz \
    && mkdir -p /tmp/python-src \
    && tar -xzf /tmp/python.tgz --strip-components=1 -C /tmp/python-src \
    && cd /tmp/python-src \
    && CPPFLAGS="-I${OPENSSL_ROOT}/include" \
       LDFLAGS="-L${OPENSSL_ROOT}/lib -Wl,-rpath,${OPENSSL_ROOT}/lib -Wl,-rpath,${PYTHON_ROOT}/lib" \
       ./configure \
        --prefix="${PYTHON_ROOT}" \
        --enable-shared \
        --enable-unicode=ucs4 \
        --with-ensurepip=no \
    && make -s -j2 \
    && make -s install \
    && "${PYTHON_ROOT}/bin/python2" -c \
        "import ssl; assert ssl.OPENSSL_VERSION.startswith('OpenSSL ${OPENSSL_VERSION}'), ssl.OPENSSL_VERSION; print(ssl.OPENSSL_VERSION)" \
    && rm -rf /tmp/python-src /tmp/python.tgz

COPY requirements.txt /tmp/requirements.txt

RUN curl -fsSL https://bootstrap.pypa.io/pip/2.7/get-pip.py -o /tmp/get-pip.py \
    && "${PYTHON_ROOT}/bin/python2" /tmp/get-pip.py \
    && "${PYTHON_ROOT}/bin/pip2" install --no-cache-dir -r /tmp/requirements.txt \
    && "${PYTHON_ROOT}/bin/pip2" check \
    && find "${PYTHON_ROOT}" -depth -type d \
        \( -name test -o -name tests \) -exec rm -rf '{}' + \
    && find "${PYTHON_ROOT}" -type f -name '*.a' -delete \
    && rm -rf /root/.cache /tmp/*


FROM ubuntu:24.04

LABEL org.opencontainers.image.title="e-Corporativo Python 2 base" \
      org.opencontainers.image.description="Ubuntu 24.04, Python 2.7.18, OpenSSL 1.1.1w e dependências do e-Corporativo"

ENV DEBIAN_FRONTEND=noninteractive \
    PYTHONUNBUFFERED=1 \
    MALLOC_ARENA_MAX=2 \
    OPENSSL_ROOT=/opt/openssl-1.1.1 \
    OPENSSL_CONF=/opt/openssl-1.1.1/ssl/openssl.cnf \
    PATH=/opt/python2/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
    LD_LIBRARY_PATH=/opt/openssl-1.1.1/lib:/opt/python2/lib \
    LANG=pt_BR.UTF-8 \
    LANGUAGE=pt_BR.UTF-8 \
    LC_ALL=pt_BR.UTF-8

# Somente bibliotecas necessárias em tempo de execução. Cabeçalhos,
# compiladores e fontes permanecem exclusivamente no estágio builder.
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        ca-certificates \
        libbz2-1.0 \
        libffi8 \
        libgomp1 \
        libmysqlclient21 \
        libncursesw6 \
        libreadline8t64 \
        libsqlite3-0 \
        libtinfo6 \
        locales \
        procps \
        tzdata \
        zlib1g \
    && sed -i '/pt_BR.UTF-8/s/^# //g' /etc/locale.gen \
    && locale-gen \
    && ln -snf /usr/share/zoneinfo/America/Araguaina /etc/localtime \
    && rm -rf /var/lib/apt/lists/* /var/cache/apt/* /tmp/*

COPY --from=builder /opt/openssl-1.1.1 /opt/openssl-1.1.1
COPY --from=builder /opt/python2 /opt/python2

RUN useradd --create-home --shell /bin/bash tins

WORKDIR /home/tins