FROM debian:bookworm-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
      build-essential curl xz-utils ca-certificates \
  && rm -rf /var/lib/apt/lists/*

# The wasmtime C API -- the CONSENSUS-pinned runtime. Pinned by version AND sha256 so the
# determinism and fuel legs link a reproducible embedding library: they must run the blob
# under exactly the runtime the chain runs it under, or they prove nothing.
ARG WASMTIME_VERSION=46.0.1
ARG WASMTIME_SHA256=4b7e7acf08467de6147f11c8fb71c4db7623035064c096976aa969d54171fed4
RUN set -eux; \
  f="wasmtime-v${WASMTIME_VERSION}-x86_64-linux-c-api"; \
  curl -fsSLo /tmp/wt.tar.xz \
    "https://github.com/bytecodealliance/wasmtime/releases/download/v${WASMTIME_VERSION}/${f}.tar.xz"; \
  echo "${WASMTIME_SHA256}  /tmp/wt.tar.xz" | sha256sum -c -; \
  tar -xJf /tmp/wt.tar.xz -C /tmp; \
  cp -r "/tmp/${f}/include/." /usr/local/include/; \
  cp "/tmp/${f}/lib/libwasmtime.a" "/tmp/${f}/lib/libwasmtime.so" /usr/local/lib/; \
  ldconfig; \
  rm -rf /tmp/wt.tar.xz "/tmp/${f}"
