From 2dc7ea5c36a8852b0cae9405fed1dd83daef539c Mon Sep 17 00:00:00 2001
From: jnfrati <nicofrati@gmail.com>
Date: Mon, 7 Sep 2026 19:18:15 +0200
Subject: [PATCH] [signal] Add an explicit non-root UBI image variant

Keep the existing signal image unchanged while making a separate UBI image available for local certification-readiness checks. Collect the linked Go dependency license terms as portable build inputs, and use SIGINT for the existing graceful stop handler.
---
 signal/Dockerfile.ubi      | 23 ++++++++++++
 signal/collect-licenses.sh | 76 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 99 insertions(+)
 create mode 100644 signal/Dockerfile.ubi
 create mode 100755 signal/collect-licenses.sh

diff --git a/signal/Dockerfile.ubi b/signal/Dockerfile.ubi
new file mode 100644
index 000000000..5f93d0551
--- /dev/null
+++ b/signal/Dockerfile.ubi
@@ -0,0 +1,23 @@
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
+
+ARG TARGETPLATFORM
+ARG VERSION=dev
+ARG RELEASE=1
+
+LABEL name="netbird-signal" \
+      maintainer="NetBird <dev@netbird.io>" \
+      vendor="NetBird GmbH" \
+      version="${VERSION}" \
+      release="${RELEASE}" \
+      summary="NetBird Signal server" \
+      description="NetBird Signal brokers peer handshakes."
+
+COPY --chmod=0555 ${TARGETPLATFORM}/netbird-signal /go/bin/netbird-signal
+COPY licenses/AGPL-3.0.txt licenses/BSD-3-Clause.txt licenses/Go-LICENSE licenses/Go-PATENTS /licenses/
+COPY licenses/third_party/ /licenses/third_party/
+RUN chmod -R a+rX /licenses
+
+USER 65532
+STOPSIGNAL SIGINT
+ENTRYPOINT [ "/go/bin/netbird-signal", "run" ]
+CMD ["--log-file", "console"]
diff --git a/signal/collect-licenses.sh b/signal/collect-licenses.sh
new file mode 100755
index 000000000..904f456c7
--- /dev/null
+++ b/signal/collect-licenses.sh
@@ -0,0 +1,76 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -ne 1 ]; then
+	printf '%s\n' "usage: $0 OUTPUT_DIRECTORY" >&2
+	exit 2
+fi
+
+repo_root=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
+output_name=$(basename "$1")
+case "$output_name" in
+	"" | . | .. | /)
+		printf '%s\n' "OUTPUT_DIRECTORY must name a directory" >&2
+		exit 2
+		;;
+esac
+output_parent=$(CDPATH= cd -- "$(dirname "$1")" && pwd)
+output="$output_parent/$output_name"
+modules=$(mktemp "${TMPDIR:-/tmp}/netbird-signal-licenses.modules.XXXXXX")
+sorted_modules=$(mktemp "${TMPDIR:-/tmp}/netbird-signal-licenses.sorted.XXXXXX")
+trap 'rm -f "$modules" "$sorted_modules"' EXIT HUP INT TERM
+
+if [ -e "$output" ] || [ -L "$output" ]; then
+	printf 'output directory already exists: %s\n' "$output" >&2
+	exit 1
+fi
+mkdir "$output"
+mkdir "$output/third_party"
+
+cp "$repo_root/signal/LICENSE" "$output/AGPL-3.0.txt"
+cp "$repo_root/LICENSE" "$output/BSD-3-Clause.txt"
+
+cd "$repo_root"
+GOOS=${GOOS:-linux} GOARCH=${GOARCH:-amd64} CGO_ENABLED=${CGO_ENABLED:-0} \
+	go list -deps -f '{{with .Module}}{{if .Replace}}{{.Replace.Path}}{{"\t"}}{{.Replace.Version}}{{"\t"}}{{.Replace.Dir}}{{else}}{{.Path}}{{"\t"}}{{.Version}}{{"\t"}}{{.Dir}}{{end}}{{end}}' ./signal >"$modules"
+LC_ALL=C sort -u "$modules" >"$sorted_modules"
+
+goroot=$(go env GOROOT)
+for term in LICENSE PATENTS; do
+	if [ ! -f "$goroot/$term" ]; then
+		printf 'missing Go standard-library term: %s\n' "$goroot/$term" >&2
+		exit 1
+	fi
+	cp "$goroot/$term" "$output/Go-$term"
+done
+
+while IFS='	' read -r module version module_dir; do
+	[ -n "$module" ] || continue
+	[ "$module" = "github.com/netbirdio/netbird" ] && continue
+
+	if [ -z "$version" ] || [ ! -d "$module_dir" ]; then
+		printf 'cannot collect terms for module %s at version %s\n' "$module" "$version" >&2
+		exit 1
+	fi
+
+	destination="$output/third_party/$module/$version"
+	mkdir -p "$destination"
+	printf 'module: %s\nversion: %s\n' "$module" "$version" >"$destination/MODULE"
+
+	found=false
+	for term in \
+		"$module_dir"/LICENSE* "$module_dir"/License* "$module_dir"/license* \
+		"$module_dir"/LICENCE* "$module_dir"/Licence* "$module_dir"/licence* \
+		"$module_dir"/COPYING* "$module_dir"/Copying* "$module_dir"/copying* \
+		"$module_dir"/NOTICE* "$module_dir"/Notice* "$module_dir"/notice* \
+		"$module_dir"/PATENTS* "$module_dir"/Patents* "$module_dir"/patents*; do
+		[ -f "$term" ] || continue
+		cp "$term" "$destination/"
+		found=true
+	done
+
+	if [ "$found" = false ]; then
+		printf 'no root license terms found for module %s at %s\n' "$module" "$module_dir" >&2
+		exit 1
+	fi
+done <"$sorted_modules"