# Build context: bundle root. First stage genuine RHEL RPMs and a local RHEL base.
# Supply a locally loaded RHEL 9.6 image; no public registry pull at build time.
ARG RHEL_BASE=localhost/rhel:9.6
FROM ${RHEL_BASE}
USER root
COPY rpms/ /opt/rpms/
RUN test -n "$(find /opt/rpms -name 'openscap-scanner-*.rpm' -print -quit)" && \
    rpmkeys --checksig /opt/rpms/*.rpm && \
    dnf --disablerepo='*' --setopt=localpkg_gpgcheck=1 install -y /opt/rpms/*.rpm && \
    dnf clean all
ENTRYPOINT []
CMD ["oscap", "--version"]
# This image evaluates its container environment. It is NOT proof of host compliance.