Install GHC directly + bump to 8.10.5

AlistairB · AlistairB · commit 84922d1ed4a4 · 2021-10-06T14:18:53.000+11:00
Also sha256 verify GHC + stack and other minor clean up.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -13,10 +13,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ghc: ['8.10.4', '9.0.1']
+        ghc: ['8.10.5', '9.0.1']
         deb: ['stretch', 'buster']
         include:
-          - ghc: '8.10.4'
+          - ghc: '8.10.5'
             ghc_minor: '8.10'
           - ghc: '9.0.1'
             ghc_minor: '9.0'
diff --git a/8.10/buster/Dockerfile b/8.10/buster/Dockerfile
@@ -2,14 +2,18 @@ FROM debian:buster
 
 ENV LANG C.UTF-8
 
+# common haskell + stack dependencies
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
-        dirmngr \
-        g++ \
         git \
+        gcc \
         gnupg \
+        g++ \
+        libc6-dev \
+        libffi-dev \
+        libgmp-dev \
         libsqlite3-dev \
         libtinfo-dev \
         make \
@@ -19,9 +23,10 @@ RUN apt-get update && \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
 
-ARG GHC=8.10.4
-ARG DEBIAN_KEY=427CB69AAC9D00F2A43CAF1CBA3CBA3FFE22B574
+
+# The cabal install process will also move away from the debian package once https://github.com/haskell/cabal/issues/7639 is resolved
 ARG CABAL_INSTALL=3.4
+ARG DEBIAN_KEY=427CB69AAC9D00F2A43CAF1CBA3CBA3FFE22B574
 
 RUN export GNUPGHOME="$(mktemp -d)" && \
     gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${DEBIAN_KEY} && \
@@ -30,20 +35,39 @@ RUN export GNUPGHOME="$(mktemp -d)" && \
     echo 'deb http://downloads.haskell.org/debian buster main' > /etc/apt/sources.list.d/ghc.list && \
     apt-get update && \
     apt-get install -y --no-install-recommends \
-        cabal-install-${CABAL_INSTALL} \
-        ghc-${GHC} && \
+        cabal-install-${CABAL_INSTALL} && \
     rm -rf "$GNUPGHOME" /var/lib/apt/lists/*
 
+ARG GHC=8.10.5
+ARG GHC_RELEASE_KEY=88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4
+# get from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
+ARG GHC_RELEASE_SHA256=BC623C20CA4C5C18E952071BA14AA0CFC5C94D34219BFFAA615F7B491F376787
+
+RUN cd /tmp && \
+  export GNUPGHOME="$(mktemp -d)" && \
+  curl -sSLO https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-x86_64-deb10-linux.tar.xz && \
+  curl -sSLO https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-x86_64-deb10-linux.tar.xz.sig && \
+  gpg --batch --keyserver keyserver.ubuntu.com --receive-keys ${GHC_RELEASE_KEY} && \
+  gpg --batch --trusted-key 588764FBE22D19C4 --verify ghc-$GHC-x86_64-deb10-linux.tar.xz.sig ghc-$GHC-x86_64-deb10-linux.tar.xz && \
+  tar xf ghc-$GHC-x86_64-deb10-linux.tar.xz && \
+  echo "$GHC_RELEASE_SHA256 ghc-$GHC-x86_64-deb10-linux.tar.xz" | sha256sum --strict --check && \
+  cd ghc-$GHC && \
+  ./configure --prefix /opt/ghc/$GHC && \
+  make install && \
+  find /opt/ghc/$GHC/ \( -name "*_p.a" -o -name "*.p_hi" \) -type f -delete && \
+  rm -rf "$GNUPGHOME" /tmp/*
+
 ARG STACK=2.7.3
-ARG STACK_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
-ARG STACK_RELEASE_KEY=2C6A674E85EE3FB896AFC9B965101FF31C5C154D
+ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
+# get from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-x86_64.tar.gz.sha256
+ARG STACK_RELEASE_SHA256=A6C090555FA1C64AA61C29AA4449765A51D79E870CF759CDE192937CD614E72B
 
 RUN export GNUPGHOME="$(mktemp -d)" && \
-    gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${STACK_KEY} && \
     gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${STACK_RELEASE_KEY} && \
     curl -fSL https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-x86_64.tar.gz -o stack.tar.gz && \
     curl -fSL https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-x86_64.tar.gz.asc -o stack.tar.gz.asc && \
     gpg --batch --trusted-key 0x575159689BEFB442 --verify stack.tar.gz.asc stack.tar.gz && \
+    echo "$STACK_RELEASE_SHA256 stack.tar.gz" | sha256sum --strict --check && \
     tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 && \
     /usr/local/bin/stack config set system-ghc --global true && \
     /usr/local/bin/stack config set install-ghc --global false && \
diff --git a/8.10/stretch/Dockerfile b/8.10/stretch/Dockerfile
@@ -2,14 +2,19 @@ FROM debian:stretch
 
 ENV LANG C.UTF-8
 
+# common haskell + stack dependencies
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
         dirmngr \
-        g++ \
         git \
+        gcc \
         gnupg \
+        g++ \
+        libc6-dev \
+        libffi-dev \
+        libgmp-dev \
         libsqlite3-dev \
         libtinfo-dev \
         make \
@@ -19,9 +24,10 @@ RUN apt-get update && \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
 
-ARG GHC=8.10.4
-ARG DEBIAN_KEY=427CB69AAC9D00F2A43CAF1CBA3CBA3FFE22B574
+
+# The cabal install process will also move away from the debian package once https://github.com/haskell/cabal/issues/7639 is resolved
 ARG CABAL_INSTALL=3.4
+ARG DEBIAN_KEY=427CB69AAC9D00F2A43CAF1CBA3CBA3FFE22B574
 
 RUN export GNUPGHOME="$(mktemp -d)" && \
     gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${DEBIAN_KEY} && \
@@ -30,20 +36,39 @@ RUN export GNUPGHOME="$(mktemp -d)" && \
     echo 'deb http://downloads.haskell.org/debian stretch main' > /etc/apt/sources.list.d/ghc.list && \
     apt-get update && \
     apt-get install -y --no-install-recommends \
-        cabal-install-${CABAL_INSTALL} \
-        ghc-${GHC} && \
+        cabal-install-${CABAL_INSTALL} && \
     rm -rf "$GNUPGHOME" /var/lib/apt/lists/*
 
+ARG GHC=8.10.5
+ARG GHC_RELEASE_KEY=88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4
+# get from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
+ARG GHC_RELEASE_SHA256=15E71325C3BDFE3804BE0F84C2FC5C913D811322D19B0F4D4CFF20F29CDD804D
+
+RUN cd /tmp && \
+  export GNUPGHOME="$(mktemp -d)" && \
+  curl -sSLO https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-x86_64-deb9-linux.tar.xz && \
+  curl -sSLO https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-x86_64-deb9-linux.tar.xz.sig && \
+  gpg --batch --keyserver keyserver.ubuntu.com --receive-keys ${GHC_RELEASE_KEY} && \
+  gpg --batch --trusted-key 588764FBE22D19C4 --verify ghc-$GHC-x86_64-deb9-linux.tar.xz.sig ghc-$GHC-x86_64-deb9-linux.tar.xz && \
+  tar xf ghc-$GHC-x86_64-deb9-linux.tar.xz && \
+  echo "$GHC_RELEASE_SHA256 ghc-$GHC-x86_64-deb9-linux.tar.xz" | sha256sum --strict --check && \
+  cd ghc-$GHC && \
+  ./configure --prefix /opt/ghc/$GHC && \
+  make install && \
+  find /opt/ghc/$GHC/ \( -name "*_p.a" -o -name "*.p_hi" \) -type f -delete && \
+  rm -rf "$GNUPGHOME" /tmp/*
+
 ARG STACK=2.7.3
-ARG STACK_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
-ARG STACK_RELEASE_KEY=2C6A674E85EE3FB896AFC9B965101FF31C5C154D
+ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
+# get from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-x86_64.tar.gz.sha256
+ARG STACK_RELEASE_SHA256=A6C090555FA1C64AA61C29AA4449765A51D79E870CF759CDE192937CD614E72B
 
 RUN export GNUPGHOME="$(mktemp -d)" && \
-    gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${STACK_KEY} && \
     gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${STACK_RELEASE_KEY} && \
     curl -fSL https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-x86_64.tar.gz -o stack.tar.gz && \
     curl -fSL https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-x86_64.tar.gz.asc -o stack.tar.gz.asc && \
     gpg --batch --trusted-key 0x575159689BEFB442 --verify stack.tar.gz.asc stack.tar.gz && \
+    echo "$STACK_RELEASE_SHA256 stack.tar.gz" | sha256sum --strict --check && \
     tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 && \
     /usr/local/bin/stack config set system-ghc --global true && \
     /usr/local/bin/stack config set install-ghc --global false && \
