@startuml
title Before: Runtime image depends on live apt mirror state
skinparam backgroundColor #FFFFFF
skinparam componentStyle rectangle
skinparam defaultFontName Consolas
skinparam defaultFontColor #000000
skinparam shadowing false

package "Builder stage\nrust:1.93.1-slim" #EAF2FF {
  component "apt-get update" as builderApt
  component "install pkg-config + libssl-dev" as builderPackages
  component "cargo build --release\n--bin server --features server" as cargoBuild
}

package "Runtime stage\ndebian:bookworm-slim" #FFE8E8 {
  component "apt-get update" as runtimeApt #FFCDD2
  component "install ca-certificates + libssl3" as runtimePackages
  component "/app/server" as server
}

cloud "deb.debian.org" as mirror #FFF4E6

builderApt --> mirror : package index
builderApt --> builderPackages
builderPackages --> cargoBuild
cargoBuild --> server : COPY binary

runtimeApt --> mirror : package index
runtimeApt --> runtimePackages : fails on invalid signature
runtimePackages --> server : OpenSSL + CA runtime deps

note right of runtimeApt
Production builds can fail before
the binary is copied when the remote
builder sees invalid apt signatures.
end note
@enduml
