# IoTSyn v4.4.0 — reference container (Section 13.1 exact reproducibility).
#
# Pins the reference runtime: PHP 8.3 (top of the spec's supported 7.4-8.3
# range), locale C, UTC. Inside this container the generator output is
# byte-identical; outside it, conformance is tolerance-based per the tolerance
# map (Section 13.2).
#
# The published image digest (sha256:...) is recorded in the run manifest and
# in v440/container/CONTAINER-DIGEST.txt AFTER `docker build && docker push`
# (see build_container.sh). It cannot be computed without building the image.

FROM php:8.3-cli-alpine

LABEL org.opencontainers.image.title="IoTSyn v4.4.0 reference container" \
      org.opencontainers.image.version="4.4.0" \
      org.opencontainers.image.licenses="CC0-1.0"

# Deterministic locale / timezone for byte-exact serialization.
ENV LANG=C \
    LC_ALL=C \
    TZ=UTC \
    PHP_INI_SCAN_DIR=""

WORKDIR /iotsyn

# Reference implementation source + normative deliverables + lockfile.
COPY v440 /iotsyn/v440
COPY composer.json composer.lock /iotsyn/
COPY IoTSyn-v4_4_0-csv-data-dictionary.json \
     IoTSyn-v4_4_0-reference-test-vectors.json \
     IoTSyn-v4_4_0-artifact-schemas.json \
     IoTSyn-v4_4_0-tolerance-map.json \
     IoTSyn-v4_4_0-deliverable-checksums.txt \
     /iotsyn/

# Build-time gate: the image only builds if every KAT and the golden
# reproduction pass, so a published image is a verified reference runtime.
RUN php v440/tests/gate1_mt19937.php \
 && php v440/tests/gate2_substream_seeds.php \
 && php v440/tests/gate3_distributions.php \
 && php v440/tests/gate4_solar.php \
 && php v440/tests/gate5_physics.php \
 && php v440/tests/gate6_risk.php \
 && php v440/tests/gate7_nhpp.php \
 && php v440/tests/gate8_utci.php \
 && php v440/tests/gate7_pipeline.php \
 && php v440/tests/gate_golden.php

# Default: regenerate the golden Appendix B bundle.
CMD ["php", "v440/tools/build_golden.php"]
