fix(dockerfile): verify prosody source tarball SHA256 on download

Pin the version and expected SHA256 as build ARGs and verify the
download with sha256sum -c so a tampered or corrupt source download
fails the build loudly. Also drops the noisy tar -v and removes the
tarball after extraction.

Part-of: <http://gitlab.vnc.biz/uxf/vnctalk-prosody/-/merge_requests/3>

Dockerfile

@@ -9,15 +9,23 @@ RUN apk update && apk upgrade && \
   libc-dev g++ yarn nagios-plugins-tcp patch && \
   rm -rf /var/cache/apk/*
 
-RUN wget https://prosody.im/downloads/source/prosody-13.0.6.tar.gz && tar xvfz prosody-13.0.6.tar.gz
+ARG PROSODY_VERSION=13.0.6
+ARG PROSODY_TARBALL_SHA256=ec696f9cf562c3af4a04b07d3fb36a1cedcc4e69a392fddcfc524bc67d93050f
+
+# Download the Prosody source and verify its SHA256 so a tampered or corrupt
+# download fails the build loudly instead of producing a broken image.
+RUN wget -O prosody-${PROSODY_VERSION}.tar.gz https://prosody.im/downloads/source/prosody-${PROSODY_VERSION}.tar.gz && \
+    echo "${PROSODY_TARBALL_SHA256}  prosody-${PROSODY_VERSION}.tar.gz" | sha256sum -c - && \
+    tar xzf prosody-${PROSODY_VERSION}.tar.gz && \
+    rm prosody-${PROSODY_VERSION}.tar.gz
 
 ADD patches /vnc/patches
-RUN cd prosody-13.0.6/ && \
+RUN cd prosody-${PROSODY_VERSION}/ && \
   for p in /vnc/patches/*.patch; do patch -p1 --fuzz=0 < "$p"; done
 
 # --idn-library=idn: 0.12+ defaults to ICU, but the runtime image ships no ICU
 # data files (U_FILE_ACCESS_ERROR); stick with libidn as 0.11 did
-RUN cd prosody-13.0.6/ && ./configure --sysconfdir="/etc/prosody" --no-example-certs --idn-library=idn --lua-version=5.4 && \
+RUN cd prosody-${PROSODY_VERSION}/ && ./configure --sysconfdir="/etc/prosody" --no-example-certs --idn-library=idn --lua-version=5.4 && \
   make && make install
 
 RUN mkdir -p /vnc && mkdir -p /var/run/prosody/ && \