build: rootless Dockerfile; fix git sha in version

Cargo.toml

@@ -41,6 +41,3 @@ expect-test = "1.5.0"
 iroha_crypto = { git = "https://github.com/hyperledger-iroha/iroha.git", rev = "v2.0.0-rc.2.0", features = ["rand"] }
 tokio = { version = "1", features = ["process"] }
 
-[build-dependencies]
-vergen = { version = "8.3.1", default-features = false, features = ["cargo"] }
-

Dockerfile

@@ -2,14 +2,23 @@ FROM rust:alpine3.21 AS builder
 
 WORKDIR /app
 
-RUN apk add musl-dev pkgconfig openssl-dev openssl-libs-static
-
-# NOTE: this disregards `./rust-toolchain.toml`, but it's fine
-COPY Cargo.lock Cargo.toml build.rs ./
+RUN apk add build-base pkgconfig openssl-dev openssl-libs-static git
+COPY Cargo* rust-toolchain.toml build.rs ./
 COPY src src
-RUN cargo fetch
+COPY .git .git
+RUN cargo fetch --locked
 RUN cargo build --release
 
 FROM alpine:3.21
+
 COPY --from=builder /app/target/release/iroha_explorer /usr/local/bin/
+
+ARG UID=1001
+ARG GID=1001
+
+RUN addgroup -g $GID explorer \
+ && adduser -D -H -u $UID -G explorer explorer
+
+USER explorer
+
 CMD iroha_explorer serve

build.rs

@@ -1,7 +1,16 @@
+fn emit_git_sha() {
+    let output = std::process::Command::new("git")
+        .args(&["rev-parse", "--short", "HEAD"])
+        .output()
+        .expect("build script is executed with `git` installed and `.git` available");
+
+    let git_hash = String::from_utf8(output.stdout).unwrap();
+    println!("cargo:rustc-env=VERGEN_GIT_SHA={}", git_hash.trim());
+
+    println!("cargo:rerun-if-changed=.git/HEAD");
+    println!("cargo:rerun-if-changed=.git/refs/heads/");
+}
+
 fn main() {
-    vergen::EmitBuilder::builder()
-        .git_sha(true)
-        .cargo_features()
-        .emit()
-        .unwrap();
+    emit_git_sha();
 }