refactor(): image enhancements

Dockerfile

@@ -2,36 +2,47 @@ FROM alpine:3.3
 MAINTAINER Wonderfall <wonderfall@mondedie.fr>
 MAINTAINER Hardware <contact@meshup.net>
 
+ARG GPG_rainloop="3B79 7ECE 694F 3B7B 70F3  11A4 ED7C 49D9 87DA 4591"
+
 ENV GID=991 UID=991
 
 RUN echo "@commuedge http://nl.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories \
+ && echo "@testing http://nl.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories \
  && apk -U add \
-    nginx \
-    php-fpm \
-    php-curl \
-    php-iconv \
-    php-xml \
-    php-dom \
-    php-openssl \
-    php-json \
-    php-zlib \
-    php-pdo_mysql \
-    php-pdo_sqlite \
-    php-sqlite3 \
-    supervisor \
     gnupg \
+    nginx \
+    supervisor \
     tini@commuedge \
- && wget -q http://repository.rainloop.net/v2/webmail/rainloop-community-latest.zip -P /tmp \
- && wget -q http://repository.rainloop.net/v2/webmail/rainloop-community-latest.zip.asc -P /tmp \
- && wget -q http://repository.rainloop.net/RainLoop.asc -P /tmp \
- && gpg --import /tmp/RainLoop.asc \
- && gpg --verify /tmp/rainloop-community-latest.zip.asc \
+    php7-fpm@testing \
+    php7-curl@testing \
+    php7-iconv@testing \
+    php7-xml@testing \
+    php7-dom@testing \
+    php7-openssl@testing \
+    php7-json@testing \
+    php7-zlib@testing \
+    php7-pdo_mysql@testing \
+    php7-pdo_sqlite@testing \
+    php7-sqlite3@testing \
+ && cd /tmp \
+ && wget -q http://repository.rainloop.net/v2/webmail/rainloop-community-latest.zip \
+ && wget -q http://repository.rainloop.net/v2/webmail/rainloop-community-latest.zip.asc \
+ && wget -q http://repository.rainloop.net/RainLoop.asc \
+ && echo "Verifying authenticity of rainloop-community-latest.zip using GPG..." \
+ && gpg --import RainLoop.asc \
+ && FINGERPRINT="$(LANG=C gpg --verify rainloop-community-latest.zip.asc rainloop-community-latest.zip 2>&1 \
+  | sed -n "s#Primary key fingerprint: \(.*\)#\1#p")" \
+ && if [ -z "${FINGERPRINT}" ]; then echo "Warning! Invalid GPG signature!" && exit 1; fi \
+ && if [ "${FINGERPRINT}" != "${GPG_rainloop}" ]; then echo "Warning! Wrong GPG fingerprint!" && exit 1; fi \
+ && echo "All seems good, now unzipping rainloop-community-latest.zip..." \
  && mkdir /rainloop && unzip -q /tmp/rainloop-community-latest.zip -d /rainloop \
+ && find /rainloop -type d -exec chmod 755 {} \; \
+ && find /rainloop -type f -exec chmod 644 {} \; \
  && apk del gnupg \
  && rm -rf /tmp/* /var/cache/apk/*
 
 COPY nginx.conf /etc/nginx/nginx.conf
-COPY php-fpm.conf /etc/php/php-fpm.conf
+COPY php-fpm.conf /etc/php7/php-fpm.conf
 COPY supervisord.conf /etc/supervisor/supervisord.conf
 COPY startup /usr/local/bin/startup
 
@@ -39,5 +50,4 @@ RUN chmod +x /usr/local/bin/startup
 
 VOLUME /rainloop/data
 EXPOSE 80
-LABEL description "Fast, simple and modern webmail client"
-CMD ["tini","--","startup"]
+CMD ["/sbin/tini","--","startup"]