anchor.diff:        org.label-schema.version=$VAULT_VERSION \
         org.label-schema.description="Vault secure production ready Docker image"
   
  -# Download Bifurcate
  -RUN apk -q --no-cache add ca-certificates curl gnupg wget &&\
  +WORKDIR /tmp
  +RUN	apk -q --no-cache add ca-certificates curl gnupg wget &&\
  +# Download Vault binary & integrity file
   	gpg --keyserver pgp.mit.edu --recv-keys 91A6E7F85D05C65630BEF18951852D87348FFC4C &&\
  -	wget -nv --progress=bar:force --show-progress https://github.com/novilabs/bifurcate/releases/download/v${BIFURCATE_VERSION}/bifurcate_${BIFURCATE_VERSION}_linux_amd64.tar.gz &&\
  -# Download Vault binary & integrity file
   	wget -nv --progress=bar:force --show-progress https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip &&\
   	wget -nv --progress=bar:force --show-progress https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_SHA256SUMS &&\
   	wget -nv --progress=bar:force --show-progress https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_SHA256SUMS.sig &&\
  -# Install Bifurcate, Vault
  -	tar xzf bifurcate_${BIFURCATE_VERSION}_linux_amd64.tar.gz -C /usr/local/bin/ &&\
  +# Install Vault
   	gpg --batch --verify vault_${VAULT_VERSION}_SHA256SUMS.sig vault_${VAULT_VERSION}_SHA256SUMS &&\
   	grep "linux_amd64.zip" vault_${VAULT_VERSION}_SHA256SUMS | sha256sum -sc &&\
   	unzip -q -o vault_${VAULT_VERSION}_linux_amd64.zip -d /usr/local/bin/ &&\
  
positive.code: MAINTAINER Miguel Terron <miguel.a.terron@gmail.com>
  
  ARG BUILD_DATE
  ARG VCS_REF
  ARG HASHICORP_PGP_KEY=51852D87348FFC4C
  ARG VAULT_VERSION=0.9.5
  
  ENV BIFURCATE_VERSION=0.5.0
  ENV VAULT_CLI_NO_COLOR=1
  
  LABEL org.label-schema.build-date=$BUILD_DATE \
        org.label-schema.vcs-url="https://github.com/mterron/vault.git" \
  
negative.code: ONBUILD COPY client_certificate.* /etc/tls/
  # Fix permissions & add custom certs to the system certicate store
  ONBUILD RUN chown -R vault: /etc/vault &&\
  			chmod +x /usr/local/bin/* &&\
  			chmod 660 /etc/vault/config.json &&\
  			cat /etc/tls/ca.pem >> /etc/ssl/certs/ca-certificates.crt
  
  ENV VAULT_CLI_NO_COLOR=1 \
  	CONTAINERPILOT=/etc/containerpilot.json5
  
  EXPOSE 8200
  
  ENTRYPOINT ["containerpilot"]
  