Fix TLS issues related to unintended dep bumping on arm64 build

lamdera · Apr 10, 2024 · 509d8ee · 509d8ee
1 parent 9a37020
commit 509d8ee
Show file tree

Hide file tree

Showing 3 changed files with 233 additions and 12 deletions.
diff --git a/cabal.project b/cabal.project
@@ -5,6 +5,23 @@ packages:
     ./vendor/elm-format/avh4-lib
     ./vendor/elm-format
 
+-- In order to match stack's allow-newer behaviour, we have to syncronise from stack
+-- output the advisory of which packages get shifted bounds applied, i.e.:
+-- $ stack ghci
+-- Using main module:
+-- Warning: Ignoring elm-format-lib's bounds on text (>=2.0 && <3) and using text-1.2.5.0.
+--          Reason: allow-newer enabled.
+--
+-- This is slightly weird as its marked allow-newer in stack.yaml but it's actually allow-older behaviour?
+-- But in any case, replicating the bounds changes here works for the OS' where we have to do cabal builds
+allow-older:
+  , elm-format-lib:text
+  , elm-format-markdown:text
+  , avh4-lib:text
+  , elm-format-lib:aeson
+  , elm-format:text
+  , elm-format:aeson
+
 source-repository-package
     type: git
     location: https://github.com/noteed/language-glsl.git

diff --git a/cabal.project.freeze b/cabal.project.freeze
@@ -0,0 +1,208 @@
+active-repositories: hackage.haskell.org:merge
+
+-- generated from `stack ls dependencies cabal`
+constraints:
+  , Cabal ==3.6.3.0
+  , HTTP ==4000.4.1
+  , HUnit ==1.6.2.0
+  , OneTuple ==0.3.1
+  , QuickCheck ==2.14.3
+  , SHA ==1.6.4.4
+  , StateVar ==1.2.2
+  , aeson ==2.0.3.0
+  , ansi-terminal ==0.11
+  , ansi-wl-pprint ==0.6.9
+  , appar ==0.1.8
+  , array ==0.5.4.0
+  , asn1-encoding ==0.9.6
+  , asn1-parse ==0.9.5
+  , asn1-types ==0.3.4
+  , assoc ==1.0.2
+  , async ==2.2.4
+  , attoparsec ==0.14.4
+  , auto-update ==0.1.6
+  , avh4-lib ==0.0.0.1
+  , base ==4.16.4.0
+  , base-compat ==0.12.2
+  , base-compat-batteries ==0.12.2
+  , base-orphans ==0.8.8.2
+  , base64-bytestring ==1.2.1.0
+  , basement ==0.0.16
+  , bifunctors ==5.5.15
+  , bimap ==0.5.0
+  , binary ==0.8.9.0
+  , blaze-builder ==0.4.2.2
+  , broadcast-chan ==0.2.1.2
+  , bsb-http-chunked ==0.0.0.4
+  , byteorder ==1.0.4
+  , bytestring ==0.11.4.0
+  , bytestring-builder ==0.10.8.2.0
+  , cabal-doctest ==1.0.9
+  , call-stack ==0.4.0
+  , case-insensitive ==1.2.1.0
+  , cereal ==0.5.8.3
+  , charset ==0.3.9
+  , clock ==0.8.3
+  , colour ==2.3.6
+  , command ==0.1.1
+  , comonad ==5.0.8
+  , concurrent-split ==0.0.1.1
+  , conduit ==1.3.5
+  , conduit-extra ==1.3.6
+  , connection ==0.3.1
+  , containers ==0.6.5.1
+  , contravariant ==1.5.5
+  , cookie ==0.4.6
+  , cryptohash-md5 ==0.11.101.0
+  , cryptohash-sha1 ==0.11.101.0
+  , cryptonite ==0.30
+  , data-array-byte ==0.1.0.1
+  , data-default-class ==0.1.2.0
+  , data-fix ==0.3.2
+  , deepseq ==1.4.6.1
+  , digest ==0.0.1.7
+  , directory ==1.3.6.2
+  , distributive ==0.6.2.1
+  , dlist ==1.0
+  , double-conversion ==2.0.4.2
+  , easy-file ==0.2.5
+  , edit-distance ==0.2.2.1
+  , elm ==0.19.1
+  , elm-format ==0.8.7
+  , elm-format-lib ==0.0.0.1
+  , elm-format-markdown ==0.0.0.1
+  , entropy ==0.4.1.10
+  , exceptions ==0.10.4
+  , fast-logger ==3.1.2
+  , file-embed ==0.0.15.0
+  , filelock ==0.1.1.6
+  , filemanip ==0.3.6.3
+  , filepath ==1.4.2.2
+  , fold-debounce ==0.2.0.11
+  , formatting ==7.1.3
+  , fsnotify ==0.4.1.0
+  , ghc-bignum ==1.2
+  , ghc-boot-th ==9.2.8
+  , ghc-prim ==0.8.0
+  , githash ==0.1.6.3
+  , hashable ==1.4.2.0
+  , haskeline ==0.8.2.1
+  , hfsevents ==0.1.6
+  , hourglass ==0.2.12
+  , http-client ==0.7.13.1
+  , http-client-tls ==0.3.6.1
+  , http-date ==0.0.11
+  , http-types ==0.12.3
+  , http2 ==3.0.3
+  , indexed-traversable ==0.1.2.1
+  , indexed-traversable-instances ==0.1.1.2
+  , integer-gmp ==1.1
+  , integer-logarithms ==1.0.3.1
+  , io-streams ==1.5.2.2
+  , io-streams-haproxy ==1.0.1.0
+  , iproute ==1.7.12
+  , language-glsl ==0.4.0.0
+  , lifted-base ==0.2.3.12
+  , listsafe ==0.1.0.1
+  , main-tester ==0.2.0.1
+  , megaparsec ==9.2.2
+  , memory ==0.17.0
+  , mime-types ==0.1.0.9
+  , monad-control ==1.0.3.1
+  , mono-traversable ==1.0.15.3
+  , mtl ==2.2.2
+  , natural-sort ==0.1.2
+  , neat-interpolation ==0.5.1.3
+  , network ==3.1.4.0
+  , network-byte-order ==0.1.6
+  , network-info ==0.2.1
+  , network-uri ==2.6.4.2
+  , old-locale ==1.0.0.7
+  , old-time ==1.1.0.3
+  , optparse-applicative ==0.17.1.0
+  , parsec ==3.1.15.0
+  , parser-combinators ==1.3.0
+  , parsers ==0.12.11
+  , pem ==0.2.4
+  , pooled-io ==0.0.2.3
+  , pretty ==1.1.3.6
+  , prettyclass ==1.0.0.0
+  , primitive ==0.7.3.0
+  , process ==1.6.16.0
+  , psqueues ==0.2.7.3
+  , random ==1.2.1.1
+  , raw-strings-qq ==1.1
+  , readable ==0.3.1
+  , recv ==0.0.0
+  , regex-base ==0.94.0.2
+  , regex-posix ==0.96.0.1
+  , regex-posix-clib ==2.7
+  , relude ==1.1.0.0
+  , resourcet ==1.2.6
+  , rts ==1.0.2
+  , safe ==0.3.19
+  , safe-exceptions ==0.1.7.3
+  , scientific ==0.3.7.0
+  , semialign ==1.2.0.1
+  , semigroupoids ==5.3.7
+  , simple-sendfile ==0.2.31
+  , snap-core ==1.0.5.1
+  , snap-server ==1.1.2.1
+  , socks ==0.6.1
+  , split ==0.2.3.5
+  , splitmix ==0.1.0.4
+  , stm ==2.5.0.2
+  , stm-delay ==0.1.1.1
+  , streaming-commons ==0.2.2.6
+  , strict ==0.4.0.1
+  , stringsearch ==0.3.6.6
+  , tagged ==0.8.6.1
+  , template-haskell ==2.18.0.0
+  , temporary ==1.3
+  , terminfo ==0.4.1.5
+  , text ==1.2.5.0
+  , text-short ==0.1.5
+  , th-abstraction ==0.4.5.0
+  , th-compat ==0.1.4
+  , these ==1.1.1.1
+  , time ==1.11.1.1
+  , time-compat ==1.9.6.1
+  , time-manager ==0.0.0
+  , timeout ==0.1.1
+  , tls ==1.5.8
+  , transformers ==0.5.6.2
+  , transformers-base ==0.4.6
+  , transformers-compat ==0.7.2
+  , tree-diff ==0.2.2
+  , typed-process ==0.2.11.0
+  , unicode-show ==0.1.1.1
+  , unix ==2.7.2.2
+  , unix-compat ==0.5.4
+  , unix-time ==0.4.9
+  , unliftio ==0.2.25.0
+  , unliftio-core ==0.2.1.0
+  , unordered-containers ==0.2.19.1
+  , unsafe ==0.0
+  , utf8-string ==1.0.2
+  , utility-ht ==0.0.17
+  , uuid ==1.3.15
+  , uuid-types ==1.0.5
+  , vault ==0.3.1.5
+  , vector ==0.12.3.1
+  , vector-algorithms ==0.8.0.4
+  , wai ==3.2.3
+  , wai-logger ==2.4.0
+  , warp ==3.3.23
+  , websockets ==0.12.7.3
+  , websockets-snap ==0.10.3.1
+  , witherable ==0.4.2
+  , word8 ==0.1.3
+  , x509 ==1.7.7
+  , x509-store ==1.6.9
+  , x509-system ==1.6.7
+  , x509-validation ==1.6.12
+  , zip-archive ==0.4.3
+  , zlib ==0.6.3.0
+  , zlib-bindings ==0.1.1.5
+
+index-state: hackage.haskell.org 2024-04-09T22:25:06Z
diff --git a/distribution/build-linux-arm64-musl.sh b/distribution/build-linux-arm64-musl.sh
@@ -20,8 +20,8 @@ if [ "$GITHUB_ACTIONS" == "true" ]; then
 else
     mountRoot="/root/compiler"
     cacheRoot="/home/github/cabal-caches/linux-arm64"
-    rsyncCompilerPath="root@lamdera-falkenstein-arm64-1:$mountRoot"
-    dockerHost="-H ssh://root@lamdera-falkenstein-arm64-1"
+    rsyncCompilerPath="root@lamdera-community-build-arm64:$mountRoot"
+    dockerHost="-H ssh://root@lamdera-community-build-arm64"
 fi
 
 cd "$compilerRoot"                                                   # Move into the project root
@@ -41,7 +41,7 @@ else
         --exclude="elm-stuff" \
         ./ $rsyncCompilerPath
 
-    ssh root@lamdera-falkenstein-arm64-1 "mkdir -p $cacheRoot || true"
+    ssh root@lamdera-community-build-arm64 "mkdir -p $cacheRoot || true"
 fi
 
 
@@ -70,10 +70,10 @@ build_binary_docker() {
     ln -sf /root/cache ~/.cabal
 
     # GOAL: pin our dependencies so we can build them one by one
-    cabal update
+    # cabal update
     # We have to freeze the deps to get a cohesive deps set, otherwise `cabal build <dep>` will install the latest version instead of the one we need
-    rm cabal.project.freeze || true # Remove the freeze file so we can update the deps
-    cabal freeze
+    # rm cabal.project.freeze || true # Remove the freeze file so we can update the deps
+    # cabal freeze
 
     # Our options required for static linking
     CABALOPTS="--allow-newer -f-export-dynamic -fembed_data_files --enable-executable-static -j4"
@@ -99,19 +99,15 @@ declare -f build_binary_docker
 
 # GOAL: get a suitable build environment with GHC & Cabal build for arm64 in an Alpine container using MUSL instead of GLIBC, so we can build portable static binaries
 
-# Use it without the bash injection for manual testing
-# docker -H ssh://root@lamdera-falkenstein-arm64-1 run \
-#     -v /root/compiler:/root/compiler \
-#     -it registry.gitlab.b-data.ch/ghc/ghc4pandoc:9.2.7 \
-#     /usr/bin/env bash
+# For manual testing drop a `bash` line wherever you'd like within build_binary_docker and re-run this script
 
 mkdir -p $dist
 
 [ "$GITHUB_ACTIONS" == "true" ] && runMode="--rm -i" || runMode="-it"
 docker $dockerHost run \
     -v "$mountRoot:/root/compiler" \
     -v "$cacheRoot:/root/cache" \
-    $runMode registry.gitlab.b-data.ch/ghc/ghc4pandoc:9.2.7 \
+    $runMode glcr.b-data.ch/ghc/ghc-musl:9.2.8 \
     bash -c "$(declare -f build_binary_docker); build_binary_docker '$bin' '$GITHUB_ACTIONS' '$(id -u)' '$(id -g)'"