# syntax=docker/dockerfile:1
# Scanner image: OpenSCAP and the SCAP Security Guide content, plus PyYAML for the gate.
# The base is pinned by digest and the packages by version. The content version decides
# which rules run, so a new SSG release is a deliberate change: bump it here and in the
# register's content_version together, then review the new results.
FROM registry.fedoraproject.org/fedora:44@sha256:1b8544582f974533fb8d9a5d6bf6dc2caf0d977ea54979d5e864a6ffd345c32e
RUN dnf -y install --setopt=install_weak_deps=False \
      openscap-scanner-1.4.4-1.fc44 scap-security-guide-0.1.82-1.fc44 python3-pyyaml \
 && dnf clean all
