fix: resolve four Dockerfile ponytail issues (H1-H4)

H1: Pin FROM debian:trixie to @sha256 digest for reproducible builds
H2: Remove apt-get upgrade -y (base image already ships known-good packages)
H3: Pin debos go install to v1.1.7 instead of @latest
H4: Replace shell-form ENTRYPOINT with exec-form + entrypoint.sh with BUILD_TARGET support

Author: stuartmhannon

Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:trixie
+FROM debian:trixie@sha256:3a953985c225a97dfb5a8f1ddc6a3ecefefc35ef51f537075e08941305045a1e
 
 # Set environment variables
 ENV DEBIAN_FRONTEND=noninteractive
@@ -10,9 +10,6 @@ ENV LINUX_OUT=/artifacts/linux
 # Add arm64 architecture for cross-compilation
 RUN dpkg --add-architecture arm64 && apt-get update
 
-# Upgrade base system
-RUN apt-get upgrade -y
-
 # Prerequisites
 RUN apt-get install -y \
     git \
@@ -51,7 +48,7 @@ RUN apt-get install -y \
     libostree-dev \
     fakemachine
 
-RUN go install -v github.com/go-debos/debos/cmd/debos@latest
+RUN go install -v github.com/go-debos/debos/cmd/debos@v1.1.7
 
 RUN install -m 755 ~/go/bin/debos /usr/local/bin
 
@@ -70,4 +67,7 @@ WORKDIR /flipperone-linux-build-scripts
 RUN git clone --depth=1 https://github.com/flipperdevices/flipperone-linux-build-scripts .
 
 # Entry point
-ENTRYPOINT ./build-uboot.sh && ./build-kernel-mainline.sh && ./build-kernel-bsp.sh && ./build-images.sh
+COPY entrypoint.sh /flipperone-linux-build-scripts/entrypoint.sh
+RUN chmod +x /flipperone-linux-build-scripts/entrypoint.sh
+ENTRYPOINT ["/bin/bash", "/flipperone-linux-build-scripts/entrypoint.sh"]
+CMD ["all"]

entrypoint.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+set -e
+
+# Determine build target (default: all)
+BUILD_TARGET="${BUILD_TARGET:-all}"
+
+cd /flipperone-linux-build-scripts
+
+case "${BUILD_TARGET}" in
+    all)
+        ./build-uboot.sh
+        ./build-kernel-mainline.sh
+        ./build-kernel-bsp.sh
+        ./build-images.sh
+        ;;
+    uboot)
+        ./build-uboot.sh
+        ;;
+    kernel-mainline)
+        ./build-kernel-mainline.sh
+        ;;
+    kernel-bsp)
+        ./build-kernel-bsp.sh
+        ;;
+    images)
+        ./build-images.sh
+        ;;
+    *)
+        echo "Unknown BUILD_TARGET: ${BUILD_TARGET}"
+        echo "Valid targets: all, uboot, kernel-mainline, kernel-bsp, images"
+        exit 1
+        ;;
+esac