Dockerfile.runtime

###############################################################################
# ADscan runtime image (single source of truth)
#
# Build targets:
# - runtime-pro: uses compiled binary from dist/adscan (PyArmor/PyInstaller flow)
# - runtime-lite: uses open-source Python sources (no PyArmor/PyInstaller)
#
# This file centralizes all shared runtime dependencies/tools so LITE and PRO
# never drift when adding system packages or tooling.
###############################################################################

# Global ARGs (usable in FROM): select where the John `run/` and FreeRDP
# `install/` artifacts come from. The build scripts override these to the
# `*_prebuilt` stage when they have seeded a host-cached, commit-keyed artifact
# into the build context (see the *_prebuilt stages + scripts/lib_build_mirror.sh).
# John's default `john_builder` fetches+compiles from GitHub. FreeRDP's default
# is the EMPTY `freerdp_none` stage — the multi-minute cmake compile then runs
# inline in runtime-common only when no prebuilt `install/` tree was seeded.
ARG JOHN_SOURCE_STAGE=john_builder
ARG FREERDP_SOURCE_STAGE=freerdp_none
ARG SLU_SOURCE_STAGE=slu_none

###############################################################################
# John the Ripper build stage (generic john binary + official converters)
###############################################################################
FROM debian:trixie-slim AS john_builder

ARG DEBIAN_FRONTEND=noninteractive
ARG JOHN_BLEEDING_JUMBO_COMMIT=d8f5b0138e6f9fe24ab453f886dcaa2abb2e5407
SHELL ["/bin/bash", "-euo", "pipefail", "-c"]

RUN apt-get update -y && apt-get install -y --no-install-recommends \
      ca-certificates \
      curl \
      git \
      build-essential \
      automake \
      autoconf \
      libtool \
      pkg-config \
      zlib1g-dev \
      libbz2-dev \
      libpcap-dev \
      libssl-dev \
      libgmp-dev \
    && rm -rf /var/lib/apt/lists/*

# Resilient source acquisition. GitHub's CDN intermittently throttles hard; under
# that throttle a `git fetch` of the pinned commit transfers the pack slowly for
# minutes and then CORRUPTS at the end ("fetch-pack: invalid index-pack output" /
# over HTTP/2 "curl 92 stream CANCEL"), and git-pack cannot resume, so each retry
# restarts from 0% — observed burning ~800s PER attempt.
#
# So the PRIMARY path is the source tarball over a plain HTTP GET (codeload): no
# git-pack negotiation, so it does not corrupt under throttling — it is merely
# slow, and `gzip -t` rejects a truncated/throttled download so the retry only
# accepts a COMPLETE archive. git fetch (HTTP/1.1, low-speed abort) is the
# fallback for the rare case codeload is unavailable but the git endpoint works.
# git config is global so it also covers the converter build below.
RUN set -eux; \
  git config --global http.version HTTP/1.1; \
  git config --global http.lowSpeedLimit 1000; \
  git config --global http.lowSpeedTime 60; \
  mkdir -p /opt/adscan/tools/john; \
  fetched=0; \
  for attempt in 1 2 3 4 5; do \
    if curl --http1.1 -fSL --retry 3 --retry-all-errors --retry-delay 5 \
         "https://github.com/openwall/john/archive/${JOHN_BLEEDING_JUMBO_COMMIT}.tar.gz" \
         -o /tmp/john-src.tar.gz \
       && gzip -t /tmp/john-src.tar.gz; then \
      rm -rf /opt/adscan/tools/john; \
      mkdir -p /opt/adscan/tools/john; \
      tar -xzf /tmp/john-src.tar.gz -C /opt/adscan/tools/john --strip-components=1; \
      rm -f /tmp/john-src.tar.gz; \
      fetched=1; break; \
    fi; \
    echo "[john_builder] tarball attempt ${attempt} failed (incomplete/throttled), retrying in $((attempt * 5))s..." >&2; \
    rm -f /tmp/john-src.tar.gz; \
    sleep "$((attempt * 5))"; \
  done; \
  if [ "${fetched}" != "1" ]; then \
    echo "[john_builder] tarball exhausted; falling back to git fetch" >&2; \
    rm -rf /opt/adscan/tools/john; \
    mkdir -p /opt/adscan/tools/john; \
    git -C /opt/adscan/tools/john init -q; \
    git -C /opt/adscan/tools/john remote add origin https://github.com/openwall/john.git; \
    for attempt in 1 2 3; do \
      if git -C /opt/adscan/tools/john -c protocol.version=2 fetch \
           --depth=1 --no-tags \
           origin "${JOHN_BLEEDING_JUMBO_COMMIT}"; then \
        git -C /opt/adscan/tools/john checkout -q FETCH_HEAD; \
        fetched=1; break; \
      fi; \
      echo "[john_builder] git fetch attempt ${attempt} failed, retrying in $((attempt * 5))s..." >&2; \
      sleep "$((attempt * 5))"; \
    done; \
  fi; \
  [ "${fetched}" = "1" ] || { echo "[john_builder] giving up: both tarball and git fetch failed" >&2; exit 1; }; \
  ( \
    cd /opt/adscan/tools/john/src && \
    make -s -f Makefile.legacy clean && \
    make -sj"$(nproc)" -f Makefile.legacy linux-x86-64 && \
    cp /opt/adscan/tools/john/run/john /tmp/john-generic && \
    ./configure --disable-native-tests --enable-simd=sse2 >/dev/null && \
    make -s clean && \
    make -sj"$(nproc)" && \
    cp /tmp/john-generic /opt/adscan/tools/john/run/john-generic && \
    ln -sf /opt/adscan/tools/john/run/john-generic /opt/adscan/tools/john/run/john \
  ); \
  chmod +x /opt/adscan/tools/john/run/john /opt/adscan/tools/john/run/john-generic

###############################################################################
# John prebuilt-artifact stage (host-side build mirror — NO GitHub fetch)
#
# Selected via `--build-arg JOHN_SOURCE_STAGE=john_prebuilt` when the build
# script has seeded a host-cached, commit-keyed `run/` dir into the build
# context at `john-prebuilt/run/` (see scripts/build_docker_lite_image.sh).
# This reuses a known-good John binary instead of fetching + compiling from
# GitHub, which is the robust path when GitHub's CDN is degraded (it cannot even
# serve the source tarball completely). The host cache is keyed by the pinned
# commit, so a commit bump misses the cache and falls back to a real build.
# Cold cache / new commit → JOHN_SOURCE_STAGE defaults to `john_builder`, this
# stage is never referenced, and John is fetched + built from source as usual.
###############################################################################
FROM debian:trixie-slim AS john_prebuilt
COPY john-prebuilt/run /opt/adscan/tools/john/run

# Resolve the selected John source (john_builder | john_prebuilt) to a fixed
# alias so the downstream COPY uses a static --from (no ARG in --from, which the
# Dockerfile parser rejects). Only the selected stage is built; the other is
# pruned from the graph — so john_prebuilt selection never triggers a GitHub
# fetch, and john_builder selection never requires a seeded artifact.
ARG JOHN_SOURCE_STAGE
FROM ${JOHN_SOURCE_STAGE} AS john_source

###############################################################################
# FreeRDP source selector (host-side build mirror — skips the cmake compile)
#
# FreeRDP is a multi-minute cmake build whose dependencies are entangled with
# runtime-common's apt (X11/Wayland/codec -dev libs that ALSO provide the
# runtime libs xfreerdp links against). So instead of a self-contained builder
# stage like John, the compile stays INLINE in runtime-common and is made
# CONDITIONAL: runtime-common COPYs an `install/` tree from `freerdp_source`,
# and the inline step compiles only when that tree is absent.
#
#   FREERDP_SOURCE_STAGE=freerdp_none      → empty install/ → compile inline (default)
#   FREERDP_SOURCE_STAGE=freerdp_prebuilt  → COPY the host-seeded install/ → skip compile
#
# Only the selected stage is built; the other is pruned. So freerdp_prebuilt
# selection never requires a seeded artifact to be absent, and freerdp_none
# selection never requires the seeded dir to exist.
###############################################################################
FROM debian:trixie-slim AS freerdp_prebuilt
COPY freerdp-prebuilt/install /opt/adscan/tools/freerdp/install

FROM debian:trixie-slim AS freerdp_none
RUN mkdir -p /opt/adscan/tools/freerdp/install

ARG FREERDP_SOURCE_STAGE
FROM ${FREERDP_SOURCE_STAGE} AS freerdp_source

###############################################################################
# statistically-likely-usernames source selector (host-side mirror)
#
# Same conditional pattern as FreeRDP: runtime-common COPYs a usernames/ dir
# from slu_source and the Wordlists layer fetches the commit-pinned tarball only
# when that dir is absent. A bare `git clone` of this repo corrupts under GitHub
# throttle, so the mirror lets warm builds skip GitHub entirely.
#
#   SLU_SOURCE_STAGE=slu_none      → empty dir → tarball-fetch inline (default)
#   SLU_SOURCE_STAGE=slu_prebuilt  → COPY the host-seeded dir → skip fetch
###############################################################################
FROM debian:trixie-slim AS slu_prebuilt
COPY slu-prebuilt/usernames /usr/share/wordlists/statistically-likely-usernames

FROM debian:trixie-slim AS slu_none
RUN mkdir -p /usr/share/wordlists/statistically-likely-usernames

ARG SLU_SOURCE_STAGE
FROM ${SLU_SOURCE_STAGE} AS slu_source

###############################################################################
# Shared runtime base for both PRO and LITE images
###############################################################################
FROM debian:trixie-slim AS runtime-common

ARG DEBIAN_FRONTEND=noninteractive
ARG JOHN_BLEEDING_JUMBO_COMMIT=d8f5b0138e6f9fe24ab453f886dcaa2abb2e5407
ARG CREDSWEEPER_VERSION=1.15.1
ARG HASHCAT_VERSION=7.1.2
ARG LIGOLO_NG_VERSION=0.8.3
ARG FREERDP_VERSION=3.24.1
ARG FREERDP_COMMIT=b6e770ccba87c58ffd0a55366fef33361798e39c
ARG SLU_COMMIT=31132bd5da19787152a354e6adad18b2c8432e73
ARG ADSCAN_RUNTIME_CONTRACT_VERSION="1"
SHELL ["/bin/bash", "-euo", "pipefail", "-c"]

ENV ADSCAN_HOME=/opt/adscan \
    HOME=/opt/adscan \
    ADSCAN_RUNTIME_CONTRACT_VERSION=${ADSCAN_RUNTIME_CONTRACT_VERSION} \
    XDG_CONFIG_HOME=/opt/adscan/.config \
    NPM_CONFIG_UPDATE_NOTIFIER=false \
    PLAYWRIGHT_BROWSERS_PATH=/opt/adscan/ms-playwright \
    PATH="/opt/adscan/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

RUN mkdir -p /opt/adscan

# BuildKit apt cache mounts: keep downloaded .deb archives + apt lists in the
# builder cache (NOT the image — image stays the same size), so when this layer
# is invalidated (a package added/removed) apt reuses cached debs instead of
# re-downloading hundreds of MB. Removing docker-clean stops apt from purging the
# archive cache after install; the lists live in the mount so we do NOT rm them.
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    rm -f /etc/apt/apt.conf.d/docker-clean \
    && apt-get update -y && apt-get install -y --no-install-recommends \
      ca-certificates \
      curl \
      git \
      ripgrep \
      asciinema \
      jq \
      bat \
      gosu \
      sudo \
      libcap2-bin \
      util-linux \
      net-tools \
      iputils-ping \
      iproute2 \
      procps \
      unzip \
      p7zip-full \
      wget \
      rclone \
      xz-utils \
      bzip2 \
      python3 \
      python3-pip \
      python3-venv \
      python3-dev \
      chromium \
      chromium-driver \
      nodejs \
      npm \
      build-essential \
      automake \
      autoconf \
      libtool \
      pkg-config \
      make \
      cmake \
      ninja-build \
      clang \
      llvm \
      libclang-dev \
      libffi-dev \
      libssl-dev \
      zlib1g-dev \
      libbz2-dev \
      libreadline-dev \
      libsqlite3-dev \
      libncurses-dev \
      libncursesw5-dev \
      tk-dev \
      liblzma-dev \
      libgmp-dev \
      libkrb5-dev \
      libgssapi-krb5-2 \
      libsasl2-2 \
      libsasl2-modules-gssapi-mit \
      krb5-user \
      libssl3t64 \
      libldap2 \
      libldns-dev \
      nmap \
      hydra \
      pocl-opencl-icd \
      samba \
      samba-common-bin \
      mono-devel \
      mingw-w64 \
      gcc-mingw-w64-x86-64 \
      musl-tools \
      tesseract-ocr \
      antiword \
      moreutils \
      libreoffice \
      graphviz \
      fontconfig \
      fonts-crosextra-carlito \
      fonts-crosextra-caladea \
      fonts-liberation \
      libx11-dev \
      libxext-dev \
      libxinerama-dev \
      libxcursor-dev \
      libxkbcommon-dev \
      libxkbfile-dev \
      libxrandr-dev \
      libxi-dev \
      libxrender-dev \
      libxv-dev \
      libxfixes-dev \
      libxdamage-dev \
      libxtst-dev \
      libfuse3-dev \
      libpam0g-dev \
      libasound2-dev \
      libcups2-dev \
      libpulse-dev \
      libjpeg-dev \
      libpng-dev \
      libavutil-dev \
      libavcodec-dev \
      libswscale-dev \
      libusb-1.0-0-dev \
      libpcsclite-dev \
      libsystemd-dev \
      libwayland-dev \
      wayland-protocols \
      libepoxy-dev \
      libicu-dev \
      libmagic1 \
      rustc \
      cargo \
      ntpsec-ntpdate \
      unbound \
      unbound-anchor \
      dns-root-data \
      libpango-1.0-0 \
      libcairo2 \
      libglib2.0-0 \
      libpangocairo-1.0-0 \
      libharfbuzz0b \
      libfontconfig1 \
    && mkdir -p /etc/OpenCL/vendors \
    && printf '%s\n' 'libnvidia-opencl.so.1' > /etc/OpenCL/vendors/nvidia.icd \
    && rm -rf /var/lib/apt/lists/*

# --http1.1 is forced on every adscan-curl download: GitHub's CDN intermittently
# cancels HTTP/2 streams mid-transfer under load ("curl 92 stream CANCEL"), which
# kills release/raw downloads (mimikatz, Rubeus, kerbrute, ligolo, ...) the same
# way it kills the John fetch. HTTP/1.1 avoids that failure class; it works on
# every host we download from and the per-file perf cost is negligible.
RUN printf '%s\n' \
  '#!/usr/bin/env bash' \
  'set -euo pipefail' \
  'if curl --http1.1 "$@"; then' \
  '  exit 0' \
  'else' \
  '  status=$?' \
  'fi' \
  'if [[ "$status" -ne 60 ]]; then' \
  '  exit "$status"' \
  'fi' \
  'echo "warning: curl TLS verification failed; retrying with insecure fallback (-k)" >&2' \
  'exec curl --http1.1 -k "$@"' \
  > /usr/local/bin/adscan-curl \
  && chmod +x /usr/local/bin/adscan-curl

# Install the browser revision expected by the Python Playwright package bundled
# into the PRO binary. The Debian chromium package remains installed as a
# fallback and for workflows that call Chromium directly.
RUN set -eux; \
  python3 -m venv /tmp/playwright-installer; \
  /tmp/playwright-installer/bin/python -m pip install --no-cache-dir --upgrade pip; \
  /tmp/playwright-installer/bin/python -m pip install --no-cache-dir playwright==1.60.0; \
  PLAYWRIGHT_BROWSERS_PATH=/opt/adscan/ms-playwright \
    /tmp/playwright-installer/bin/python -m playwright install chromium; \
  rm -rf /tmp/playwright-installer

# Codex CLI (official ChatGPT plan sign-in path for Plus/Pro subscriptions).
# Installed globally so `ask login codex` and `ask` can use `codex` directly.
RUN set -eux; \
  npm install --global @openai/codex; \
  codex --version

# Base runtime layout
RUN mkdir -p /opt/adscan/{bin,tools,tool_venvs,wordlists,logs,fonts} /workspaces \
  && fc-cache -f \
  && chmod -R 0777 /opt/adscan /workspaces

COPY wordlists/ /opt/adscan/wordlists/
# C# sources for Windows tool compilation (pss-dumper, rtlcp-dumper)
COPY src/windows_tools/ /workspace_build/src/windows_tools/

COPY --from=john_source /opt/adscan/tools/john/run /opt/adscan/tools/john/run

# Prebuilt FreeRDP install tree (empty when building from source — see the
# freerdp_source selector above). The External-tools RUN below compiles FreeRDP
# only when this tree is absent (no xfreerdp binary present).
COPY --from=freerdp_source /opt/adscan/tools/freerdp/install /opt/adscan/tools/freerdp/install

# Prebuilt statistically-likely-usernames dir (empty when not seeded). The
# Wordlists layer below tarball-fetches it only when this dir is empty.
COPY --from=slu_source /usr/share/wordlists/statistically-likely-usernames /usr/share/wordlists/statistically-likely-usernames

# Install Python tool environments (mirrors `PipToolsConfig` from adscan.py)
# BuildKit cache mount persists pip's wheel cache ACROSS builds (in the builder
# cache, NOT the image — image stays small), so when this layer is invalidated
# (a version bump, or an earlier-layer change cascading down) the re-install
# reuses already-downloaded wheels instead of re-fetching from PyPI. pip resolves
# versions itself, so a changed pin fetches only the new wheel — no manual cache
# key needed. `--no-cache-dir` is dropped precisely so the mount is populated.
RUN --mount=type=cache,target=/var/cache/adscan-pip,sharing=locked \
  set -eux; \
  export PIP_CACHE_DIR=/var/cache/adscan-pip; \
  # Several tool deps are git+https clones from GitHub (NetExec, enum-trusts,
  # MANSPIDER). This layer runs BEFORE the External-tools layer that sets the
  # global git HTTP/1.1 config, so without this its clones default to HTTP/2 and
  # hit the same "curl 92 stream CANCEL" / pack-corruption failures under GitHub
  # throttle that plagued the John fetch — failing the layer so it never caches.
  # Force HTTP/1.1 + abort a genuinely stalled transfer so pip_retry can retry.
  git config --global http.version HTTP/1.1; \
  git config --global http.lowSpeedLimit 1000; \
  git config --global http.lowSpeedTime 60; \
  pip_retry() { \
    local python_bin="$1"; shift; \
    local attempt=1; \
    local max_attempts=4; \
    until "$python_bin" -m pip install --retries 8 --timeout 120 "$@"; do \
      if [ "$attempt" -ge "$max_attempts" ]; then \
        echo "pip install failed after ${max_attempts} attempts: $*" >&2; \
        return 1; \
      fi; \
      echo "pip install failed (attempt ${attempt}/${max_attempts}) for: $*" >&2; \
      sleep $((attempt * 5)); \
      attempt=$((attempt + 1)); \
    done; \
  }; \
  python3 -m venv /opt/adscan/tool_venvs/impacket/venv; \
  pip_retry /opt/adscan/tool_venvs/impacket/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/impacket/venv/bin/python "impacket==0.13.1" "pycryptodome==3.23.0"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/netexec/venv; \
  pip_retry /opt/adscan/tool_venvs/netexec/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/netexec/venv/bin/python "git+https://github.com/Pennyw0rth/NetExec.git@73ccf0d"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/certipy/venv; \
  pip_retry /opt/adscan/tool_venvs/certipy/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/certipy/venv/bin/python "certipy-ad==5.0.4"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/bloodyad/venv; \
  pip_retry /opt/adscan/tool_venvs/bloodyad/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/bloodyad/venv/bin/python "bloodyAD==2.5.4"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/enum-trusts/venv; \
  pip_retry /opt/adscan/tool_venvs/enum-trusts/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/enum-trusts/venv/bin/python "git+https://github.com/ADScanPro/enum-trusts.git@f7eae14"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/manspider/venv; \
  pip_retry /opt/adscan/tool_venvs/manspider/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/manspider/venv/bin/python "git+https://github.com/ADScanPro/MANSPIDER@cedb138"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/credsweeper/venv; \
  pip_retry /opt/adscan/tool_venvs/credsweeper/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/credsweeper/venv/bin/python "credsweeper==${CREDSWEEPER_VERSION}"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/pypykatz/venv; \
  pip_retry /opt/adscan/tool_venvs/pypykatz/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/pypykatz/venv/bin/python "pypykatz==0.6.13"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/lsassy/venv; \
  pip_retry /opt/adscan/tool_venvs/lsassy/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/lsassy/venv/bin/python "lsassy==3.1.16"; \
  \
  # Volatility 3 — offline VM MEMORY-image credential carving (vm_artifact_service:
  # .vmem/.vmrs → windows.registry.hashdump/lsadump/cachedump). Invoked as a
  # subprocess tool (not bundled into the PRO PyInstaller binary). pycryptodome is
  # REQUIRED or vol3's credential plugins silently fail to register. `vol` is
  # symlinked onto PATH so vm_artifact_service._locate_volatility() finds it in
  # both PRO and LITE. (Windows symbol tables are fetched from the Microsoft symbol
  # server on first use and cached under ~/.cache/volatility3.)
  python3 -m venv /opt/adscan/tool_venvs/volatility3/venv; \
  pip_retry /opt/adscan/tool_venvs/volatility3/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/volatility3/venv/bin/python "volatility3>=2.5.0" "pycryptodome>=3.20"; \
  ln -sf /opt/adscan/tool_venvs/volatility3/venv/bin/vol /opt/adscan/bin/vol; \
  \
  chmod -R 0777 /opt/adscan/tool_venvs

# External tools (git/curl)
# Harden every git clone below against GitHub's intermittent HTTP/2 stream
# CANCEL / CDN throttling (same failure class as the John builder): force
# HTTP/1.1 and abort a genuinely stalled transfer in ~60s so it can retry.
# git config is global, so it persists to all later RUN layers' clones too.
RUN set -eux; \
  git config --global http.version HTTP/1.1; \
  git config --global http.lowSpeedLimit 1000; \
  git config --global http.lowSpeedTime 60; \
  mkdir -p /opt/adscan/tools; \
  if ! adscan-curl -fsSL "https://hashcat.net/files/hashcat-${HASHCAT_VERSION}.7z" -o /tmp/hashcat.7z; then \
    echo "warning: official hashcat download failed; falling back to SourceForge mirror" >&2; \
    wget --max-redirect=10 --no-check-certificate -O /tmp/hashcat.7z \
      "https://sourceforge.net/projects/hashcat.mirror/files/v${HASHCAT_VERSION}/hashcat-${HASHCAT_VERSION}.7z/download"; \
  fi; \
  7z x /tmp/hashcat.7z -o/opt/adscan/tools >/dev/null; \
  test -x "/opt/adscan/tools/hashcat-${HASHCAT_VERSION}/hashcat.bin"; \
  ln -sf "/opt/adscan/tools/hashcat-${HASHCAT_VERSION}/hashcat.bin" /opt/adscan/bin/hashcat; \
  /opt/adscan/bin/hashcat --version | grep -F "v${HASHCAT_VERSION}"; \
  rm -f /tmp/hashcat.7z; \
  \
  git clone --depth 1 https://github.com/Greenwolf/ntlm_theft.git /opt/adscan/tools/ntlm_theft; \
  mkdir -p /opt/adscan/tools/firepwd; \
  adscan-curl -fsSL https://raw.githubusercontent.com/lclevy/firepwd/refs/heads/master/firepwd.py -o /opt/adscan/tools/firepwd/firepwd.py; \
  adscan-curl -fsSL https://raw.githubusercontent.com/lclevy/firepwd/refs/heads/master/requirements.txt -o /opt/adscan/tools/firepwd/requirements.txt; \
  python3 -m venv /opt/adscan/tool_venvs/firepwd/venv; \
  /opt/adscan/tool_venvs/firepwd/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/firepwd/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/firepwd/requirements.txt; \
  \
  git clone --depth 1 https://github.com/spextat0r/LSA-Reaper.git /opt/adscan/tools/LSA-Reaper; \
  python3 -m venv --system-site-packages /opt/adscan/tool_venvs/LSA-Reaper/venv; \
  /opt/adscan/tool_venvs/LSA-Reaper/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/LSA-Reaper/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/LSA-Reaper/requirements.txt impacket; \
  \
  mkdir -p /opt/adscan/tools/PKINITtools; \
  adscan-curl -fsSL https://raw.githubusercontent.com/dirkjanm/PKINITtools/refs/heads/master/gettgtpkinit.py -o /opt/adscan/tools/PKINITtools/gettgtpkinit.py; \
  adscan-curl -fsSL https://raw.githubusercontent.com/dirkjanm/PKINITtools/refs/heads/master/getnthash.py -o /opt/adscan/tools/PKINITtools/getnthash.py; \
  adscan-curl -fsSL https://raw.githubusercontent.com/dirkjanm/PKINITtools/refs/heads/master/requirements.txt -o /opt/adscan/tools/PKINITtools/requirements.txt; \
  python3 -m venv /opt/adscan/tool_venvs/PKINITtools/venv; \
  /opt/adscan/tool_venvs/PKINITtools/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/PKINITtools/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/PKINITtools/requirements.txt; \
  \
  mkdir -p /opt/adscan/tools/kerbrute; \
  adscan-curl -fsSL https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64 -o /opt/adscan/tools/kerbrute/kerbrute; \
  chmod +x /opt/adscan/tools/kerbrute/kerbrute; \
  \
  mkdir -p /opt/adscan/tools/ligolo-ng/proxy/linux-amd64; \
  adscan-curl -fsSL \
    "https://github.com/nicocha30/ligolo-ng/releases/download/v${LIGOLO_NG_VERSION}/ligolo-ng_proxy_${LIGOLO_NG_VERSION}_linux_amd64.tar.gz" \
    -o /tmp/ligolo_proxy.tar.gz; \
  tar -xzf /tmp/ligolo_proxy.tar.gz -C /opt/adscan/tools/ligolo-ng/proxy/linux-amd64 proxy; \
  chmod +x /opt/adscan/tools/ligolo-ng/proxy/linux-amd64/proxy; \
  setcap cap_net_admin,cap_net_bind_service+ep /opt/adscan/tools/ligolo-ng/proxy/linux-amd64/proxy; \
  ln -sf /opt/adscan/tools/ligolo-ng/proxy/linux-amd64/proxy /opt/adscan/bin/ligolo-proxy; \
  rm -f /tmp/ligolo_proxy.tar.gz; \
  \
  mkdir -p /opt/adscan/tools/ligolo-ng/agent/windows-amd64; \
  adscan-curl -fsSL \
    "https://github.com/nicocha30/ligolo-ng/releases/download/v${LIGOLO_NG_VERSION}/ligolo-ng_agent_${LIGOLO_NG_VERSION}_windows_amd64.zip" \
    -o /tmp/ligolo_agent_windows_amd64.zip; \
  unzip -q /tmp/ligolo_agent_windows_amd64.zip agent.exe -d /opt/adscan/tools/ligolo-ng/agent/windows-amd64; \
  rm -f /tmp/ligolo_agent_windows_amd64.zip; \
  \
  git clone --depth 1 https://github.com/p0dalirius/Coercer.git /opt/adscan/tools/coercer; \
  python3 -m venv /opt/adscan/tool_venvs/coercer/venv; \
  /opt/adscan/tool_venvs/coercer/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/coercer/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/coercer/requirements.txt; \
  \
  # FreeRDP: reuse the host-seeded install/ tree when present (COPYed from
  # freerdp_source above), else clone + cmake-build from source. The compile is
  # the single most expensive step in this RUN (~minutes); the mirror skips it.
  if [ -x /opt/adscan/tools/freerdp/install/bin/xfreerdp ]; then \
    echo "using prebuilt FreeRDP from host mirror — skipping clone + cmake build"; \
  else \
    git clone --branch "${FREERDP_VERSION}" --depth 1 https://github.com/FreeRDP/FreeRDP.git /tmp/freerdp-src; \
    test "$(git -C /tmp/freerdp-src rev-parse HEAD)" = "${FREERDP_COMMIT}"; \
    cmake -S /tmp/freerdp-src -B /tmp/freerdp-build -G Ninja \
      -DCMAKE_BUILD_TYPE=Release \
      -DCMAKE_INSTALL_PREFIX=/opt/adscan/tools/freerdp/install \
      -DBUILD_TESTING=OFF \
      -DWITH_SERVER=OFF \
      -DWITH_X11=ON \
      -DWITH_WAYLAND=ON; \
    cmake --build /tmp/freerdp-build --parallel "$(nproc)"; \
    cmake --install /tmp/freerdp-build; \
    rm -rf /tmp/freerdp-src /tmp/freerdp-build; \
  fi; \
  ln -sf /opt/adscan/tools/freerdp/install/bin/xfreerdp /opt/adscan/bin/xfreerdp; \
  ln -sf /opt/adscan/tools/freerdp/install/bin/xfreerdp /opt/adscan/bin/xfreerdp3; \
  printf '%s\n' '/opt/adscan/tools/freerdp/install/lib' '/opt/adscan/tools/freerdp/install/lib64' \
    > /etc/ld.so.conf.d/adscan-freerdp.conf; \
  ldconfig; \
  /opt/adscan/bin/xfreerdp --version; \
  \
  chmod +x /opt/adscan/tools/john/run/john /opt/adscan/tools/john/run/john-generic; \
  for tool in john keepass2john keepass2john.py zip2john zip2john.py pfx2john pfx2john.py ansible2john ansible2john.py; do \
    if [ -e "/opt/adscan/tools/john/run/${tool}" ]; then \
      chmod +x "/opt/adscan/tools/john/run/${tool}" || true; \
      ln -sf "/opt/adscan/tools/john/run/${tool}" "/opt/adscan/bin/${tool}"; \
    fi; \
  done; \
  if [ -e "/opt/adscan/tools/john/run/john.conf" ]; then \
    ln -sf "/opt/adscan/tools/john/run/john.conf" "/opt/adscan/bin/john.conf"; \
  fi; \
  \
  git clone --depth 1 https://github.com/blechschmidt/massdns.git /opt/adscan/tools/massdns; \
  make -C /opt/adscan/tools/massdns; \
  chmod +x /opt/adscan/tools/massdns/bin/massdns; \
  ln -sf /opt/adscan/tools/massdns/bin/massdns /opt/adscan/bin/massdns; \
  \
  chmod -R 0777 /opt/adscan/tools /opt/adscan/tool_venvs

# SysWhispers4 – direct-syscall stub generator for evasion-compiled Windows binaries.
# mingw-w64 (already installed above) provides the x86_64-w64-mingw32-g++ cross-compiler
# required by the binary_ops Tier-2 pipeline.
RUN set -eux; \
  git clone --depth 1 https://github.com/JoasASantos/SysWhispers4.git /opt/adscan/tools/syswhispers4; \
  python3 -m venv /opt/adscan/tool_venvs/syswhispers4/venv; \
  /opt/adscan/tool_venvs/syswhispers4/venv/bin/python -m pip install --no-cache-dir -U pip; \
  if [ -f /opt/adscan/tools/syswhispers4/requirements.txt ]; then \
    /opt/adscan/tool_venvs/syswhispers4/venv/bin/python -m pip install --no-cache-dir \
      -r /opt/adscan/tools/syswhispers4/requirements.txt; \
  fi; \
  python3 /opt/adscan/tools/syswhispers4/syswhispers.py --help >/dev/null 2>&1 || true; \
  chmod -R 0777 /opt/adscan/tools/syswhispers4 /opt/adscan/tool_venvs/syswhispers4

# Donut – PE-to-shellcode converter for the Tier-3 in-memory loader pipeline.
# Installed to /opt/adscan/bin/ which is on PATH (see ENV above).
# CFLAGS=-w suppresses deprecation warnings that would fail on GCC 13+ with -Werror.
RUN set -eux; \
  git clone --depth 1 https://github.com/TheWover/donut.git /tmp/donut_build; \
  make -C /tmp/donut_build CFLAGS="-w -O2"; \
  cp /tmp/donut_build/donut /opt/adscan/bin/donut; \
  chmod 0755 /opt/adscan/bin/donut; \
  rm -rf /tmp/donut_build

# Windows attack binaries (binary_ops catalog – Tier 1 prebuilt cache).
# Stored at /opt/adscan/tools/windows-tools/<name>/<filename> to match
# get_adscan_home() / "tools" / "windows-tools" with ADSCAN_HOME=/opt/adscan.
ARG MIMIKATZ_VERSION=2.2.0-20220919
ARG RUBEUS_COMMIT=e37fa53
ARG WHISKER_COMMIT=9a236c063e37f2d59c1637bdefcae6b4371bf466
ARG KRBRELAYUP_URL=https://kb.offsec.nl/tools/techniques/krbrelayup/files/KrbRelayUp.exe
ARG RUNASCS_VERSION=1.5
ARG NANODUMP_COMMIT=main
RUN set -eux; \
  mkdir -p \
    /opt/adscan/tools/windows-tools/mimikatz \
    /opt/adscan/tools/windows-tools/rubeus \
    /opt/adscan/tools/windows-tools/certify \
    /opt/adscan/tools/windows-tools/whisker \
    /opt/adscan/tools/windows-tools/seatbelt \
    /opt/adscan/tools/windows-tools/krbrelayup \
    /opt/adscan/tools/windows-tools/runascs \
    /opt/adscan/tools/windows-tools/procdump \
    /opt/adscan/tools/windows-tools/nanodump; \
  \
  # mimikatz – credential extraction (official gentilkiwi release ZIP)
  adscan-curl -fsSL \
    "https://github.com/gentilkiwi/mimikatz/releases/download/${MIMIKATZ_VERSION}/mimikatz_trunk.zip" \
    -o /tmp/mimikatz.zip; \
  unzip -p /tmp/mimikatz.zip x64/mimikatz.exe \
    > /opt/adscan/tools/windows-tools/mimikatz/mimikatz.exe; \
  rm /tmp/mimikatz.zip; \
  \
  # Rubeus – Kerberos attacks (Ghostpack compiled binaries mirror)
  adscan-curl -fsSL \
    "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/Rubeus.exe" \
    -o /opt/adscan/tools/windows-tools/rubeus/Rubeus.exe; \
  \
  # Certify – ADCS exploitation (Ghostpack compiled binaries mirror)
  adscan-curl -fsSL \
    "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/Certify.exe" \
    -o /opt/adscan/tools/windows-tools/certify/Certify.exe; \
  \
  # Whisker – Shadow credentials.
  # The old Ghostpack-CompiledBinaries mirror stopped shipping Whisker.exe,
  # so build it from the official source to keep the image reproducible.
  git clone --depth 1 https://github.com/eladshamir/Whisker.git /tmp/Whisker; \
  git -C /tmp/Whisker checkout "${WHISKER_COMMIT}"; \
  perl -0pi -e 's#<Reference Include="System.DirectoryServices" />#<Reference Include="System.DirectoryServices" />\n    <Reference Include="System.Numerics" />#' \
    /tmp/Whisker/Whisker/Whisker.csproj; \
  build_tool=""; \
  if command -v msbuild >/dev/null 2>&1; then \
    build_tool="msbuild"; \
  elif command -v xbuild >/dev/null 2>&1; then \
    build_tool="xbuild"; \
  else \
    echo "Neither msbuild nor xbuild is available for Whisker build" >&2; \
    exit 1; \
  fi; \
  "${build_tool}" /tmp/Whisker/Whisker.sln /p:Configuration=Release /verbosity:minimal; \
  test -f /tmp/Whisker/Whisker/bin/Release/Whisker.exe; \
  cp /tmp/Whisker/Whisker/bin/Release/Whisker.exe /opt/adscan/tools/windows-tools/whisker/Whisker.exe; \
  rm -rf /tmp/Whisker; \
  \
  # Seatbelt – host security enumeration (Ghostpack compiled binaries mirror)
  adscan-curl -fsSL \
    "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/Seatbelt.exe" \
    -o /opt/adscan/tools/windows-tools/seatbelt/Seatbelt.exe; \
  \
  # KrbRelayUp – local privilege escalation via Kerberos relay.
  # The historical GitHub release URL now returns 404 and the source tree
  # requires a larger Mono/xbuild compatibility patch set than we want inside
  # the runtime image, so use the maintained OffSec knowledge-base binary.
  adscan-curl -fsSL "${KRBRELAYUP_URL}" \
    -o /opt/adscan/tools/windows-tools/krbrelayup/KrbRelayUp.exe; \
  \
  # RunasCs – run as different user (official GitHub release ZIP)
  # Also symlinked to the legacy path so runascs_manager.py finds it.
  adscan-curl -fsSL \
    "https://github.com/antonioCoco/RunasCs/releases/download/v${RUNASCS_VERSION}/RunasCs.zip" \
    -o /tmp/runascs.zip; \
  unzip -p /tmp/runascs.zip RunasCs.exe \
    > /opt/adscan/tools/windows-tools/runascs/RunasCs.exe; \
  rm /tmp/runascs.zip; \
  mkdir -p /opt/adscan/tools/runascs/windows-amd64; \
  ln -sf \
    /opt/adscan/tools/windows-tools/runascs/RunasCs.exe \
    /opt/adscan/tools/runascs/windows-amd64/RunasCs.exe; \
  \
  # procdump – Sysinternals LSASS dumper (official Microsoft/Sysinternals ZIP)
  adscan-curl -fsSL \
    "https://download.sysinternals.com/files/Procdump.zip" \
    -o /tmp/procdump.zip; \
  unzip -p /tmp/procdump.zip procdump64.exe \
    > /opt/adscan/tools/windows-tools/procdump/procdump64.exe; \
  rm /tmp/procdump.zip; \
  \
  # nanodump – LSASS dumper with PPL bypass (no public release; cross-compile from source)
  # mingw-w64 is already installed above. nanodump uses direct syscalls so no
  # MSVC dependency — the provided Makefile works with the MinGW cross-compiler.
  git clone --depth 1 https://github.com/fortra/nanodump.git /tmp/nanodump_build; \
  if [ "${NANODUMP_COMMIT}" != "main" ]; then \
    git -C /tmp/nanodump_build checkout "${NANODUMP_COMMIT}"; \
  fi; \
  make -C /tmp/nanodump_build \
    CC=x86_64-w64-mingw32-gcc \
    CXX=x86_64-w64-mingw32-g++ \
    2>&1 || true; \
  if [ -f /tmp/nanodump_build/dist/nanodump.x64.exe ]; then \
    cp /tmp/nanodump_build/dist/nanodump.x64.exe \
       /opt/adscan/tools/windows-tools/nanodump/nanodump.x64.exe; \
    echo "nanodump compiled OK"; \
  else \
    echo "warning: nanodump build did not produce dist/nanodump.x64.exe — binary will need manual placement" >&2; \
  fi; \
  rm -rf /tmp/nanodump_build; \
  \
  # GodPotatoCLR – SeImpersonate→SYSTEM via MSSQL CLR assembly (bypasses Defender write-time scan).
  # Compiled from GodPotato source (src/windows_tools/godpotato/) as a .NET library.
  # Loaded into SQL Server via CREATE ASSEMBLY FROM 0x<hex> — never touches target disk as a PE.
  # Requires: mssql sysadmin + SeImpersonatePrivilege + clr enabled + clr strict security = 0.
  mkdir -p /opt/adscan/tools/windows-tools/godpotato-clr; \
  mcs -target:library -platform:x64 -sdk:4 \
    /workspace_build/src/windows_tools/godpotato/Program.cs \
    /workspace_build/src/windows_tools/godpotato/ArgsParse.cs \
    /workspace_build/src/windows_tools/godpotato/SharpToken.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/NativeMethods.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/GodPotatoContext.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/GodPotatoUnmarshalTrigger.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/UnmarshalDCOM.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/ObjRef.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/IStreamImpl.cs \
    /workspace_build/src/windows_tools/godpotato/SqlGodPotato.cs \
    -out:/opt/adscan/tools/windows-tools/godpotato-clr/GodPotatoCLR.dll 2>&1 \
    && echo "GodPotatoCLR.dll compiled OK" \
    || echo "warning: GodPotatoCLR compilation failed — binary will need manual placement" >&2; \
  \
  # SweetPotatoCLR – SeImpersonate→SYSTEM fallback for WS2016 where GodPotato's RPCSS hook
  # does not fire (build 14393). Uses DCOM NTLM relay via BITS CLSID to obtain SYSTEM token.
  # Activated automatically by MssqlSeImpersonateService when GodPotato fails in < 2s.
  mkdir -p /opt/adscan/tools/windows-tools/sweetpotato-clr; \
  mcs -target:library -platform:x64 -sdk:4 \
    /workspace_build/src/windows_tools/sweetpotato/LocalNegotiator.cs \
    /workspace_build/src/windows_tools/sweetpotato/ObjRef.cs \
    /workspace_build/src/windows_tools/sweetpotato/StorageTrigger.cs \
    /workspace_build/src/windows_tools/sweetpotato/PotatoAPI.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/IEnumSTATSTG.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/ILockBytes.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/IMarshal.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/IStorage.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/IStream.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/Ole32.cs \
    /workspace_build/src/windows_tools/sweetpotato/Security/Privilege.cs \
    /workspace_build/src/windows_tools/sweetpotato/Security/SSPIHelper.cs \
    /workspace_build/src/windows_tools/sweetpotato/Stubs.cs \
    /workspace_build/src/windows_tools/sweetpotato/SqlSweetPotato.cs \
    -out:/opt/adscan/tools/windows-tools/sweetpotato-clr/SweetPotatoCLR.dll 2>&1 \
    && echo "SweetPotatoCLR.dll compiled OK" \
    || echo "warning: SweetPotatoCLR compilation failed — binary will need manual placement" >&2; \
  \
  # pss-dumper + rtlcp-dumper – AV-evasion LSASS dumpers (Mono C# → Windows .NET exe)
  # PssCaptureSnapshot: snapshots lsass into a VA clone, MiniDumpWriteDump targets the
  # snapshot handle (not lsass PID) — bypasses AV hooks on MiniDumpWriteDump(lsass).
  # RtlCreateProcessReflection: clones lsass into a reflection process, dumps the clone.
  # Both require admin, neither bypasses PPL. mono-complete (mcs) is installed above.
  mkdir -p /opt/adscan/tools/windows-tools/pss-dumper \
           /opt/adscan/tools/windows-tools/rtlcp-dumper \
           /opt/adscan/tools/windows-tools/wsass-dumper \
           /opt/adscan/tools/windows-tools/ppldump; \
  mcs -target:exe -unsafe -out:/opt/adscan/tools/windows-tools/pss-dumper/pss-dumper.exe \
    /workspace_build/src/windows_tools/pss_dumper.cs 2>&1 && echo "pss-dumper compiled OK" \
    || echo "warning: pss-dumper compilation failed — binary will need manual placement" >&2; \
  mcs -target:exe -out:/opt/adscan/tools/windows-tools/rtlcp-dumper/rtlcp-dumper.exe \
    /workspace_build/src/windows_tools/rtlcp_dumper.cs 2>&1 && echo "rtlcp-dumper compiled OK" \
    || echo "warning: rtlcp-dumper compilation failed — binary will need manual placement" >&2; \
  \
  # wsass-dumper – PPL bypass via WerFaultSecure.exe (Win8.1, signed Microsoft WinTcb)
  # WSASS.exe: official TwoSevenOneT source + two ADscan patches (MinGW build):
  #   1. lpDesktop=WinSta0\Default in PPLHelp.cpp → works from Session-0 services
  #   2. explicit output path arg + auto-find lsass PID → no CWD dependency
  # WerFaultSecure.exe runs at PPL WinTcb and can open lsass even with RunAsPPL=1.
  # Syntax: WSASS.exe <WerFaultSecure.exe path> <OutputDumpPath>
  mkdir -p /opt/adscan/tools/windows-tools/wsass-dumper; \
  cp /workspace_build/src/windows_tools/WSASS.exe \
     /opt/adscan/tools/windows-tools/wsass-dumper/WSASS.exe \
     && echo "WSASS.exe (patched) copied OK" \
     || echo "warning: WSASS.exe copy failed" >&2; \
  cp /workspace_build/src/windows_tools/WerFaultSecure.exe \
     /opt/adscan/tools/windows-tools/wsass-dumper/WerFaultSecure.exe \
     && echo "WerFaultSecure.exe copied OK" \
     || echo "warning: WerFaultSecure.exe copy failed" >&2; \
  \
  # ppldump – PPL bypass via KnownDlls/DefineDosDevice userland exploit (itm4n/PPLMedic).
  # Binary extracted from lsassy ppldump_embedded and stored in src/windows_tools/.
  # Works on Windows without the July 2022 PPL patch (pre-19044.1826).
  cp /workspace_build/src/windows_tools/PPLdump.exe \
     /opt/adscan/tools/windows-tools/ppldump/PPLdump.exe \
     && echo "PPLdump.exe copied OK" \
     || echo "warning: PPLdump.exe copy failed" >&2; \
  \
  chmod -R 0777 /opt/adscan/tools/windows-tools

# Wordlists
RUN set -eux; \
  download_wordlist() { \
    local url="$1"; \
    local dest="$2"; \
    if curl --http1.1 -fsSL --retry 3 --retry-all-errors --retry-delay 5 "$url" -o "$dest"; then \
      return 0; \
    fi; \
    case "$url" in \
      https://weakpass.com/*) \
        echo "warning: TLS verification failed for $url; retrying with insecure fallback (-k)" >&2; \
        curl --http1.1 -kfsSL --retry 3 --retry-all-errors --retry-delay 5 "$url" -o "$dest"; \
        ;; \
      *) \
        return 1; \
        ;; \
    esac; \
  }; \
  mkdir -p /opt/adscan/wordlists; \
  download_wordlist https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt /opt/adscan/wordlists/rockyou.txt; \
  download_wordlist https://gist.github.com/The-Viper-One/a1ee60d8b3607807cc387d794e809f0b/raw/b7d83af6a8bbb43013e04f78328687d19d0cf9a7/kerberoast_pws.xz /opt/adscan/wordlists/kerberoast_pws.xz; \
  xz -d -c /opt/adscan/wordlists/kerberoast_pws.xz > /opt/adscan/wordlists/kerberoast_pws; \
  mkdir -p /usr/share/wordlists/statistically-likely-usernames; \
  # Reuse the host-seeded usernames dir when present (COPYed from slu_source
  # above), else fetch the commit-pinned tarball. A bare `git clone` corrupts
  # under GitHub throttle ("curl 18 transfer closed" / "fetch-pack: invalid
  # index-pack output") and had no retry; a tarball does no pack negotiation,
  # gzip -t rejects a truncated download, and the loop accepts only a COMPLETE
  # archive. Same resilient pattern as the John builder; warm builds skip GitHub
  # entirely via the mirror (scripts/lib_build_mirror.sh, build_mirror_spec_slu).
  if [ -n "$(ls -A /usr/share/wordlists/statistically-likely-usernames 2>/dev/null)" ]; then \
    echo "using prebuilt statistically-likely-usernames from host mirror — skipping GitHub fetch"; \
  else \
    slu_fetched=0; \
    for attempt in 1 2 3 4 5; do \
      if adscan-curl -fsSL --retry 3 --retry-all-errors --retry-delay 5 \
           "https://github.com/insidetrust/statistically-likely-usernames/archive/${SLU_COMMIT}.tar.gz" \
           -o /tmp/slu.tar.gz \
         && gzip -t /tmp/slu.tar.gz; then \
        tar -xzf /tmp/slu.tar.gz -C /usr/share/wordlists/statistically-likely-usernames --strip-components=1; \
        rm -f /tmp/slu.tar.gz; \
        slu_fetched=1; break; \
      fi; \
      echo "statistically-likely-usernames tarball attempt ${attempt} failed (incomplete/throttled), retrying in $((attempt * 5))s..." >&2; \
      rm -f /tmp/slu.tar.gz; \
      sleep "$((attempt * 5))"; \
    done; \
    [ "${slu_fetched}" = "1" ] || { echo "statistically-likely-usernames: giving up after retries" >&2; exit 1; }; \
  fi; \
  rm -f /opt/adscan/wordlists/kerberoast_pws.xz; \
  chmod -R 0777 /opt/adscan/wordlists /usr/share/wordlists/statistically-likely-usernames

COPY adscan_internal/assets/wordlists/kerberos-format-inference.txt /opt/adscan/wordlists/kerberos-format-inference.txt
COPY adscan_internal/assets/wordlists/kerberos-format-inference.json /opt/adscan/wordlists/kerberos-format-inference.json

# Unbound container configuration
COPY docker/unbound_container_base.conf /etc/unbound/unbound.conf
COPY docker/unbound_adscan_control.conf /etc/unbound/unbound.conf.d/00-adscan-control.conf

COPY docker/adscan_entrypoint.sh /usr/local/bin/adscan-entrypoint
RUN chmod +x /usr/local/bin/adscan-entrypoint

###############################################################################
# PRO target: compiled binary runtime
###############################################################################
FROM runtime-common AS runtime-pro

# NOTE: ADSCAN_RUNTIME_VERSION and ADSCAN_PARTNER_TAG are declared LATER
# in this stage (at the point of use), not here. BuildKit binds
# `--build-arg` values to ARG variables at their declaration line and
# hashes the bound value into the cache key of every layer in the ARG's
# scope — even when no upstream layer references the variable. Declaring
# ARG at the point of use narrows the scope so upstream layers stay
# cacheable across builds with different version timestamps / partner
# tags. (PRO's COPY dist/adscan invalidates downstream layers on every
# build anyway because PyArmor is non-deterministic, but keeping this
# pattern consistent with LITE makes the file easier to reason about.)

ENV ADSCAN_RUNTIME_LICENSE_MODE=PRO

COPY dist/adscan /usr/local/bin/adscan

# Partner tag baked at build time — identifies which partner this image was built for.
# Passed via: docker build --build-arg ADSCAN_PARTNER_TAG=glenn-mssp-beta1
# Empty in untagged builds (dev/CI). Used by telemetry for partner-level filtering.
ARG ADSCAN_PARTNER_TAG=""

# ADSCAN_RUNTIME_VERSION enters scope HERE — narrowest possible.
ARG ADSCAN_RUNTIME_VERSION=""
# Build provenance (git commit SHA / describe / UTC timestamp the image was
# built from). Declared HERE — narrowest possible scope, BELOW every expensive
# pip/apt layer above — so a new commit SHA per build does NOT re-key those
# layers (the "a new ARG re-keys every RUN below it in scope" rule from
# CLAUDE.md; mirrors the ADSCAN_RUNTIME_VERSION precedent). Empty / "unknown"
# when built outside a git tree.
ARG ADSCAN_BUILD_COMMIT="unknown"
ARG ADSCAN_BUILD_DESCRIBE="unknown"
ARG ADSCAN_BUILD_TIMESTAMP="unknown"
RUN set -eux; \
  chmod +x /usr/local/bin/adscan; \
  if [[ -n "${ADSCAN_RUNTIME_VERSION}" ]]; then \
    printf '%s\n' "${ADSCAN_RUNTIME_VERSION}" > /opt/adscan/version; \
  fi

# Bake build-time ARGs into the image ENV only at the end, after every
# expensive layer above. The running container still exposes both
# variables without contaminating upstream cache keys.
ENV ADSCAN_PARTNER_TAG=${ADSCAN_PARTNER_TAG}
ENV ADSCAN_RUNTIME_VERSION=${ADSCAN_RUNTIME_VERSION}
ENV ADSCAN_BUILD_COMMIT=${ADSCAN_BUILD_COMMIT}
ENV ADSCAN_BUILD_DESCRIBE=${ADSCAN_BUILD_DESCRIBE}
ENV ADSCAN_BUILD_TIMESTAMP=${ADSCAN_BUILD_TIMESTAMP}

ENTRYPOINT ["/usr/local/bin/adscan-entrypoint"]

###############################################################################
# LITE target: source runtime (open-source)
###############################################################################
FROM runtime-common AS runtime-lite

# NOTE: ADSCAN_RUNTIME_VERSION is declared LATER in this stage (right before
# it's used), not here. BuildKit binds `--build-arg` values to ARG
# variables at their declaration line, and even when no upstream layer
# references the variable BuildKit hashes the bound value into the cache
# key of every layer in the ARG's scope. In CI the timestamped value
# (`9.0.0.dev<timestamp>`) would otherwise invalidate the heavy pip
# install layer on every build. Declaring ARG at the point of use
# narrows the scope so the expensive layers stay cacheable.

ENV ADSCAN_RUNTIME_LICENSE_MODE=LITE

# Runtime Python dependencies for source-mode ADscan CLI.
# Shares the same BuildKit pip wheel cache as the tool venvs above so a layer
# invalidation re-installs from cached wheels instead of re-downloading from PyPI
# (image stays small — the cache lives in the builder, not the image layer).
RUN --mount=type=cache,target=/var/cache/adscan-pip,sharing=locked \
  set -eux; \
  export PIP_CACHE_DIR=/var/cache/adscan-pip; \
  python3 -m venv /opt/adscan/venv; \
  /opt/adscan/venv/bin/python -m pip install -U pip; \
  /opt/adscan/venv/bin/python -m pip install \
    prompt_toolkit==3.0.52 \
    psutil==7.2.2 \
    rich==15.0.0 \
    python-docx==1.2.0 \
    openpyxl==3.1.5 \
    netifaces==0.11.0 \
    posthog==7.9.3 \
    certifi==2026.1.4 \
    ipaddress==1.0.23 \
    python-dotenv==1.2.1 \
    sentry-sdk==2.52.0 \
    packaging==26.2 \
    questionary==2.1.1 \
    pypsrp[kerberos]==0.9.0 \
    pydantic-settings==2.13.1 \
    "pydantic-ai-slim[ag-ui,anthropic,bedrock,cli,cohere,evals,fastmcp,google,groq,huggingface,logfire,mcp,mistral,openai,retries,temporal,ui,vertexai]==1.101.0" \
    gssapi==1.10.1 \
    krb5==0.9.0 \
    python-magic==0.4.27 \
    markitdown==0.1.5 \
    credsweeper==${CREDSWEEPER_VERSION} \
    pykeepass==4.1.1.post1 \
    impacket==0.13.1 \
    pycryptodome==3.23.0 \
    pycryptodomex==3.23.0 \
    "dissect.target==3.25.1" \
    gpp-decrypt==2.0.0 \
    requests==2.32.5 \
    matplotlib==3.10.8 \
    graphviz==0.21 \
    pyarrow==21.0.0 \
    rustworkx==0.15.1 \
    selenium==4.31.0 \
    textual==0.80.1 \
    "redis>=5.0.0,<7.1.0" \
    playwright==1.60.0 \
    jinja2>=3.0 \
    "scapy>=2.5.0,<3.0"

# Vendored skelsec native AD stack — installed from local source at vendor/.
# This is the SAME source the developer reads under vendor/<lib>/, so what
# you read is exactly what runs. Bumping a vendored library is a single
# scripts/refresh_vendor.sh + uv lock + commit; never depend on PyPI for
# these. See CLAUDE.md § Native Library Source Code.
#
# NOTE: setcap is intentionally deferred to AFTER all pip installs.
# Applying file capabilities to the venv python binary before any subsequent
# RUN step that invokes it causes Docker buildkit to reject execution with
# exit code 126 ("Operation not permitted") — the kernel blocks execution of
# capability-bearing binaries in the builder's restricted namespace.
COPY vendor /opt/adscan-src/vendor
RUN set -eux; \
  /opt/adscan/venv/bin/python -m pip install --no-cache-dir \
    /opt/adscan-src/vendor/asysocks \
    /opt/adscan-src/vendor/badauth \
    /opt/adscan-src/vendor/kerbad \
    /opt/adscan-src/vendor/badldap \
    /opt/adscan-src/vendor/winacl \
    /opt/adscan-src/vendor/aiosmb \
    /opt/adscan-src/vendor/pypykatz \
    /opt/adscan-src/vendor/aardwolf; \
  /opt/adscan/venv/bin/python -c "\
import aiosmb, kerbad, badldap, winacl, pypykatz, asysocks, badauth, aardwolf, os; \
print('vendor ok:', aiosmb.__file__);"; \
  runtime_python="$(readlink -f /opt/adscan/venv/bin/python)"; \
  setcap cap_net_bind_service,cap_net_raw,cap_net_admin+ep "${runtime_python}"

COPY adscan.py /opt/adscan-src/adscan.py
COPY adscan_core /opt/adscan-src/adscan_core
COPY adscan_internal /opt/adscan-src/adscan_internal
COPY adscan_launcher /opt/adscan-src/adscan_launcher
COPY custom_config.yaml /opt/adscan-src/custom_config.yaml
COPY pyproject.toml /opt/adscan-src/pyproject.toml

# Pre-baked LITE cheatsheet PDF. The LITE runtime cannot render the
# cheatsheet on demand (the PRO reporting templates/engines under
# ``adscan_internal/pro/`` are stripped from this image), so the build
# pipeline pre-renders the PDF in the PRO image and seeds it into the
# build context at ``adscan_internal/assets/cheatsheet/``. The runtime
# ``adscan cheatsheet`` falls back to this static path when the PRO
# renderer module is not importable. See scripts/bake_cheatsheet.sh.
RUN mkdir -p /opt/adscan/static/cheatsheet
COPY adscan_internal/assets/cheatsheet/Quick_Start_Cheatsheet.pdf \
     /opt/adscan/static/cheatsheet/Quick_Start_Cheatsheet.pdf

# Strip PRO-only Client Deliverable Kit modules from the LITE source tree.
# Pass C: ensure deliver.py (the PRO deliverable orchestrator from Pass B)
# is never present in LITE. ``rm -f`` is idempotent — it is a no-op when
# Pass B has not landed yet, and a real strip when it has.
RUN rm -f /opt/adscan-src/adscan_internal/cli/deliver.py
# Note: cheatsheet stays in LITE (operator-facing desk reference). The
# bonuses.py module imports its PRO renderer lazily, so the import
# succeeds in LITE; PRO-only verbs (playbook/checklist/coverage-matrix)
# are gated by the exit-42 protocol in adscan.py before any PRO import
# is attempted.

# Normalize source permissions to avoid host-side restrictive modes leaking into
# the image (e.g. 0700 dirs), which can break imports when running as the
# non-root `adscan` user.
RUN chmod -R a+rX /opt/adscan-src

# Safety assertions: LITE image must not contain private modules.
RUN test ! -d /opt/adscan-src/adscan_internal/pro
RUN test ! -d /opt/adscan-src/adscan_internal/reporting
RUN test ! -f /opt/adscan-src/adscan_internal/services/report_service.py
RUN test ! -f /opt/adscan-src/adscan_internal/report_generator.py
RUN test ! -f /opt/adscan-src/adscan_internal/cli/deliver.py

ENV PYTHONPATH=/opt/adscan-src

RUN printf '%s\n' \
  '#!/usr/bin/env bash' \
  'set -euo pipefail' \
  'exec /opt/adscan/venv/bin/python /opt/adscan-src/adscan.py "$@"' \
  > /usr/local/bin/adscan \
  && chmod +x /usr/local/bin/adscan

# ADSCAN_RUNTIME_VERSION enters scope HERE — narrowest scope possible.
# Every layer above this point is independent of the version timestamp
# and stays cacheable across builds with different versions.
ARG ADSCAN_RUNTIME_VERSION=""
# Build provenance (git commit SHA / describe / UTC timestamp the image was
# built from). Declared HERE — narrowest possible scope, BELOW every expensive
# pip/apt layer above — so a new commit SHA per build does NOT re-key those
# layers (the "a new ARG re-keys every RUN below it in scope" rule from
# CLAUDE.md; mirrors the ADSCAN_RUNTIME_VERSION precedent). Empty / "unknown"
# when built outside a git tree.
ARG ADSCAN_BUILD_COMMIT="unknown"
ARG ADSCAN_BUILD_DESCRIBE="unknown"
ARG ADSCAN_BUILD_TIMESTAMP="unknown"
RUN set -eux; \
  if [[ -n "${ADSCAN_RUNTIME_VERSION}" ]]; then \
    printf '%s\n' "${ADSCAN_RUNTIME_VERSION}" > /opt/adscan/version; \
  fi

# Bake the version into the image ENV only at the end, after every
# expensive layer above. The running container still exposes
# ADSCAN_RUNTIME_VERSION without contaminating upstream cache keys.
ENV ADSCAN_RUNTIME_VERSION=${ADSCAN_RUNTIME_VERSION}
ENV ADSCAN_BUILD_COMMIT=${ADSCAN_BUILD_COMMIT}
ENV ADSCAN_BUILD_DESCRIBE=${ADSCAN_BUILD_DESCRIBE}
ENV ADSCAN_BUILD_TIMESTAMP=${ADSCAN_BUILD_TIMESTAMP}

ENTRYPOINT ["/usr/local/bin/adscan-entrypoint"]