philips-software · Ron (rjaegers) · Jul 21, 2026 · Jul 21, 2026 · Jul 21, 2026 · Jul 21, 2026
@@ -6,6 +6,8 @@
 # taken from https://ccache.dev/minisign.pub
 ARG CCACHE_MINISIGN_PUBKEY=RWQX7yXbBedVfI4PNx6FLdFXu9GHUFsr28s4BVGxm4BeybtnX3P06saF
 ARG CCACHE_VERSION=4.13.1
+ARG CPM_VERSION=0.43.1
+ARG INCLUDE_WHAT_YOU_USE_VERSION=0.26
 ARG XWIN_VERSION=0.8.0
 # Whether or not to build the embedded flavor of this container
 ARG BUILD_EMBEDDED_FLAVOR=false
@@ -42,10 +44,17 @@
 # trivy:ignore:AVD-DS-0001
 FROM downloader-${TARGETARCH} AS downloader
 
+ARG CPM_VERSION
+ARG INCLUDE_WHAT_YOU_USE_VERSION
+
 ADD --checksum=sha256:8b2a587ffd672c4687e7581dad4b2f6c1bb2ad6b480cd9771ba2ff48e0b8c75d \
  https://apt.llvm.org/llvm-snapshot.gpg.key /llvm.gpg.key
 ADD --checksum=sha256:db2938ce5fd422f2db7a07508452772c945135d99274004c462190c323fefcf1 \
  https://dl.cloudsmith.io/public/mull-project/mull-stable/gpg.41DB35380DE6BD6F.key /mull.gpg.key
+ADD --checksum=sha256:1c40fc102ce9625d7de7eb14f541cab30cc3138dca627f0b0ec40293ce6c2934 \
+ https://github.com/cpm-cmake/CPM.cmake/releases/download/v${CPM_VERSION}/CPM.cmake /CPM.cmake
+ADD --checksum=sha256:ca3f157a5e6bf293cfb2fea585b103ec87245d02eaee0b6ab832665e740016eb \
+  https://github.com/include-what-you-use/include-what-you-use/archive/refs/tags/${INCLUDE_WHAT_YOU_USE_VERSION}.tar.gz /iwyu.tar.gz
 
 # Extractor stage using target architecture specific downloader
 FROM ${BASE_IMAGE} AS extractor
@@ -86,6 +95,8 @@
 
     tar xJf /dl/ccache.tar.xz --strip-components=1 "ccache-${CCACHE_VERSION}-linux-$(uname -m)-glibc/ccache"
     tar xzf /dl/xwin.tar.gz --strip-components=1 "xwin-${XWIN_VERSION}-$(uname -m)-unknown-linux-musl/xwin"
+    tar xzf /dl/iwyu.tar.gz
+    cp /dl/CPM.cmake /CPM.cmake
     cp /dl/llvm.gpg.key /llvm.gpg.key
     cp /dl/mull.gpg.key /mull.gpg.key
 EOF
@@ -94,10 +105,9 @@
 FROM ${BASE_IMAGE}
 
 ARG CLANG_VERSION=22
-ARG CPM_VERSION=0.42.1
-ARG INCLUDE_WHAT_YOU_USE_VERSION=0.26
 ARG BUILD_EMBEDDED_FLAVOR
 ARG CCACHE_VERSION
+ARG INCLUDE_WHAT_YOU_USE_VERSION
 ARG XWIN_VERSION
 ARG ARM_GNU_TOOLCHAIN_VERSION
 
@@ -136,8 +146,8 @@
     rm -rf "$(pip cache dir)"
 
     # Install ccache and xwin
-    cp /src/ccache /usr/local/bin/ccache
-    cp /src/xwin /usr/local/bin/xwin
+    install -m 0755 /src/ccache /usr/local/bin/ccache
+    install -m 0755 /src/xwin /usr/local/bin/xwin
 
     # Install clang toolchain and mull mutation testing framework
     cat /src/llvm.gpg.key | gpg --dearmor -o /usr/share/keyrings/llvm-snapshot-keyring.gpg
@@ -156,12 +166,11 @@
     fi
 
     # Install include-what-you-use (iwyu) from source
-    apt-get update && apt-get install -y --no-install-recommends libclang-${CLANG_VERSION}-dev llvm-${CLANG_VERSION}-dev
-    wget --no-hsts -qO - https://github.com/include-what-you-use/include-what-you-use/archive/refs/tags/${INCLUDE_WHAT_YOU_USE_VERSION}.tar.gz | tar xz -C /tmp
-    CC=clang CXX=clang++ cmake -S /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION} -B /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION}/build
-    cmake --build /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION}/build --target install
-    rm -rf /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION}
-    apt-get purge -y libclang-${CLANG_VERSION}-dev llvm-${CLANG_VERSION}-dev
+    apt-get update && apt-get install -y --no-install-recommends "libclang-${CLANG_VERSION}-dev" "llvm-${CLANG_VERSION}-dev"
+    CC=clang CXX=clang++ cmake -S "/src/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION}" -B "/tmp/include-what-you-use/build"
+    cmake --build "/tmp/include-what-you-use/build" --target install
+    rm -rf "/tmp/include-what-you-use"
+    apt-get purge -y "libclang-${CLANG_VERSION}-dev" "llvm-${CLANG_VERSION}-dev"
     apt-get autoremove -y
     apt-get clean
 
@@ -172,9 +181,9 @@
     update-alternatives --install /usr/bin/cc cc /usr/bin/gcc-15 10 \
                         --slave /usr/bin/c++ c++ /usr/bin/g++-15
     update-alternatives --install /usr/bin/iwyu iwyu /usr/local/bin/include-what-you-use 10
-    update-alternatives --install /usr/bin/mull-runner mull-runner /usr/bin/mull-runner-${CLANG_VERSION} 10 \
-                        --slave /usr/bin/mull-reporter mull-reporter /usr/bin/mull-reporter-${CLANG_VERSION} \
-                        --slave /usr/lib/mull-ir-frontend mull-ir-frontend /usr/lib/mull-ir-frontend-${CLANG_VERSION}
+    update-alternatives --install /usr/bin/mull-runner mull-runner "/usr/bin/mull-runner-${CLANG_VERSION}" 10 \
+                        --slave /usr/bin/mull-reporter mull-reporter "/usr/bin/mull-reporter-${CLANG_VERSION}" \
+                        --slave /usr/lib/mull-ir-frontend mull-ir-frontend "/usr/lib/mull-ir-frontend-${CLANG_VERSION}"
     update-alternatives --install /usr/bin/python python /usr/bin/python3 10
 
     # Add a dummy compile_commands.json file to the default location so that tools like SonarLint and Clangd can find it.
@@ -189,7 +198,7 @@
     # CMake module (not an ELF binary), so it cannot carry a `.note.package` ELF
     # section and Syft has no cataloger for standalone `.cmake` files. Its version is
     # pinned and tracked via the CPM_VERSION build argument above.
-    wget --no-hsts -qP /usr/local/lib/python*/dist-packages/cmake/data/share/cmake-*/Modules/ https://github.com/cpm-cmake/CPM.cmake/releases/download/v${CPM_VERSION}/CPM.cmake
+    cp /src/CPM.cmake /usr/local/lib/python*/dist-packages/cmake/data/share/cmake-*/Modules/
     conan profile detect
     echo -e "\n[conf]\ntools.cmake.cmaketoolchain:generator=Ninja" >> "$(conan profile path default)"
 

@@ -1,9 +1,62 @@
 # syntax=docker/dockerfile:1
+# hadolint global ignore=DL3006
 
 ARG BASE_IMAGE=ghcr.io/philips-software/amp-devcontainer-base:edge
+# Public minisign key for verifying ccache releases,
+# taken from https://ccache.dev/minisign.pub
+ARG CARGO_BINSTALL_MINISIGN_PUBKEY=RWRk4OqCLGFd42uTAec/I+038vQLmeZzCBOS40LLDVC6qW3SVuDsdcW0
+ARG CARGO_BINSTALL_VERSION=1.21.0
+
+# Downloader stage for AMD64 architecture
+FROM scratch AS downloader-amd64
+
+ARG CARGO_BINSTALL_VERSION
+
+ADD --checksum=sha256:a753a83ea4c79a629790e003822d4e82bec5bf839120f1826969c2401bd9f559 \
+  https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-x86_64-unknown-linux-gnu.tgz /cargo-binstall.tgz
+ADD --checksum=sha256:131d12bc7dd4d7c431b8f36447ce630c71e61975af1da6215c317bfde60e8a53 \
+  https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-x86_64-unknown-linux-gnu.tgz.sig /cargo-binstall.tgz.minisig
+
+# Downloader stage for ARM64 architecture
+FROM scratch AS downloader-arm64
+
+ARG CARGO_BINSTALL_VERSION
+
+ADD --checksum=sha256:f70991d597655bc928444c0ac0dedcbd1d16a9e64d0b1ea544dde2cc710e25f6 \
+  https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-aarch64-unknown-linux-gnu.tgz /cargo-binstall.tgz
+ADD --checksum=sha256:3d4ed28844baeeafa5e7df2112e623ae6098cf70b61983054d7ecd5cdbce35bb \
+  https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-aarch64-unknown-linux-gnu.tgz.sig /cargo-binstall.tgz.minisig
+
+# Select downloader stage based on target architecture.
+# Linters don't recognize the TARGETARCH variable, so we ignore warnings here.
+# trivy:ignore:AVD-DS-0001
+FROM downloader-${TARGETARCH} AS downloader
+
+# Extractor stage using target architecture specific downloader
+FROM ${BASE_IMAGE} AS extractor
+
+ARG CARGO_BINSTALL_VERSION
+ARG CARGO_BINSTALL_MINISIGN_PUBKEY
+
+SHELL ["/bin/bash", "-Eeuo", "pipefail", "-c"]
+
+WORKDIR /
+
+# hadolint ignore=DL3008
+RUN --mount=from=downloader,target=/dl \
+    --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked <<EOF
+    apt-get update && apt-get install --no-install-recommends -y minisign
+
+    minisign -P "${CARGO_BINSTALL_MINISIGN_PUBKEY}" -Vm /dl/cargo-binstall.tgz
+
+    tar xzf /dl/cargo-binstall.tgz
+EOF
+
+# Final development container image
 FROM ${BASE_IMAGE}
 
-ARG CARGO_BINSTALL_VERSION=1.17.9
+ARG CARGO_BINSTALL_VERSION
 ARG CARGO_BINUTILS_VERSION=0.3.6
 ARG CARGO_MUTANTS_VERSION=25.3.1
 ARG FLIP_LINK_VERSION=0.1.12
@@ -26,7 +79,8 @@ ENV BINSTALL_DISABLE_TELEMETRY=true \
 RUN --mount=type=bind,source=.devcontainer/rust/apt-requirements.json,target=/tmp/apt-requirements.json \
     --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
-    --mount=type=cache,target=/var/log,sharing=locked <<EOF
+    --mount=type=cache,target=/var/log,sharing=locked \
+    --mount=from=extractor,target=/src <<EOF
 
     # Install the base system with all tool dependencies
     apt-get update && jq -r 'to_entries | .[] | .key + "=" + .value' /tmp/apt-requirements.json | \
@@ -37,7 +91,7 @@ RUN --mount=type=bind,source=.devcontainer/rust/apt-requirements.json,target=/tm
 
     # Install rust
     rustup set profile minimal
-    rustup default ${RUST_VERSION}
+    rustup default "${RUST_VERSION}"
     rustup component add clippy llvm-tools rustfmt
 
     if [[ "${BUILD_EMBEDDED_FLAVOR}" == "true" ]]; then
@@ -46,7 +100,7 @@ RUN --mount=type=bind,source=.devcontainer/rust/apt-requirements.json,target=/tm
         rustup target add thumbv7em-none-eabihf
     fi
 
-    wget -qO - "https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-$(uname -m)-unknown-linux-gnu.tgz" | tar xz -C "/usr/bin"
+    install -m 0755 /src/cargo-binstall /usr/local/bin/cargo-binstall
     cargo-binstall -y --locked "cargo-binutils@${CARGO_BINUTILS_VERSION}" \
                                "cargo-mutants@${CARGO_MUTANTS_VERSION}"
 
@@ -61,7 +115,7 @@ RUN --mount=type=bind,source=.devcontainer/rust/apt-requirements.json,target=/tm
     # https://systemd.io/ELF_PACKAGE_METADATA/) so they are included in the SBOM
     # generated for the image. `add-sbom-note` is provided by the base image.
     add-sbom-note cargo-binstall "${CARGO_BINSTALL_VERSION}" "pkg:cargo/cargo-binstall@${CARGO_BINSTALL_VERSION}" \
-        /usr/bin/cargo-binstall
+        /usr/local/bin/cargo-binstall
     add-sbom-note cargo-binutils "${CARGO_BINUTILS_VERSION}" "pkg:cargo/cargo-binutils@${CARGO_BINUTILS_VERSION}" \
         "${CARGO_HOME}"/bin/cargo-{cov,nm,objcopy,profdata,readobj,size,strip}
     add-sbom-note cargo-mutants "${CARGO_MUTANTS_VERSION}" "pkg:cargo/cargo-mutants@${CARGO_MUTANTS_VERSION}" \

@@ -37,7 +37,7 @@ runs:
         cache-dependency-path: package.json
         node-version: 22.x
 
-    - run: npm install
+    - run: npm install --ignore-scripts
       shell: bash
 
     - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0

@@ -68,7 +68,7 @@ jobs:
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24.8.0
-      - run: npm ci
+      - run: npm ci --ignore-scripts
       - run: npx playwright install --with-deps
       - name: Wait for Codespace to be active
         run: |

@@ -264,10 +264,12 @@ jobs:
           CONTAINER: ${{ needs.sanitize-image-name.outputs.fully-qualified-image-name }}:${{ steps.metadata.outputs.version }}
       - run: |
           set -Eeuo pipefail
-          wget -O diffoci https://github.com/reproducible-containers/diffoci/releases/download/v0.1.7/diffoci-v0.1.7.linux-amd64
+          wget -qO diffoci https://github.com/reproducible-containers/diffoci/releases/download/v0.1.8/diffoci-v0.1.8.linux-amd64
+          echo "${DIFFOCI_SHA256}  diffoci" | sha256sum --check --strict -
           chmod +x diffoci
           ./diffoci diff --semantic --report-file=container-diff.json "${FROM_CONTAINER}" "${TO_CONTAINER}" || true
         env:
+          DIFFOCI_SHA256: 01e6b50c1568c9d61c758ef6da81869f2c26c852698d73dca961b3617effe949
           FROM_CONTAINER: ${{ needs.sanitize-image-name.outputs.fully-qualified-image-name }}:edge
           TO_CONTAINER: ${{ needs.sanitize-image-name.outputs.fully-qualified-image-name }}:${{ steps.metadata.outputs.version }}
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1