f

.gitlab-ci.yml

@@ -16,7 +16,7 @@ variables:
 ############################################################
 
 .debian:
-  image: "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-deb10:$DOCKER_REV"
+  image: "debian:11"
   tags:
     - x86_64-linux
   variables:
@@ -44,7 +44,7 @@ variables:
     CABAL_DIR: "$CI_PROJECT_DIR/cabal"
 
 .linux:armv7:
-  image: "registry.gitlab.haskell.org/ghc/ci-images/armv7-linux-deb10:$DOCKER_REV"
+  image: "arm32v7/debian:11"
   tags:
     - armv7-linux
   variables:
@@ -54,7 +54,7 @@ variables:
   retry: 2
 
 .linux:aarch64:
-  image: "registry.gitlab.haskell.org/ghc/ci-images/aarch64-linux-deb10:$DOCKER_REV"
+  image: "aarch64/debian:11"
   tags:
     - aarch64-linux
   variables:

.gitlab/before_script/linux/install_deps.sh

@@ -6,16 +6,49 @@ set -eux
 
 mkdir -p "${TMPDIR}"
 
-sudo apt-get update -y
-sudo apt-get install -y libnuma-dev zlib1g-dev libgmp-dev libgmp10 libssl-dev liblzma-dev libbz2-dev git wget lsb-release software-properties-common gnupg2 apt-transport-https gcc autoconf automake build-essential
+apt-get update -y
+apt-get install -y \
+    apt-transport-https \
+    autoconf \
+    automake \
+    build-essential \
+    curl \
+    gcc \
+    git \
+    gnupg2 \
+    libbz2-dev \
+    libffi-dev \
+    libffi7 \
+    libgmp-dev \
+    libgmp10 \
+    liblzma-dev \
+    libncurses-dev \
+    libncurses5 \
+    libnuma-dev \
+    libssl-dev \
+    libtinfo5 \
+    lsb-release \
+    pkg-config \
+    software-properties-common \
+    wget \
+    zlib1g-dev
+
 
 if [ "${CROSS}" = "arm-linux-gnueabihf" ] ; then
-	sudo apt-get install -y gcc-arm-linux-gnueabihf
-	sudo dpkg --add-architecture armhf
-	sudo apt-get update -y
-	sudo apt-get install -y libncurses-dev:armhf
+    apt-get install -y gcc-arm-linux-gnueabihf
+    dpkg --add-architecture armhf
+    apt-get update -y
+    apt-get install -y libncurses-dev:armhf
 fi
 
+apt-get install -y libseccomp-dev
+curl -L https://dev.exherbo.org/~alip/sydbox/sydbox-2.1.0.tar.bz2 | tar -xj
+cd sydbox-2.1.0
+./configure
+make
+make install
+cd ..
+
 export BOOTSTRAP_HASKELL_NONINTERACTIVE=1
 export BOOTSTRAP_HASKELL_GHC_VERSION=$GHC_VERSION
 export BOOTSTRAP_HASKELL_CABAL_VERSION=$CABAL_VERSION

.gitlab/script/ghcup_cross.sh

@@ -5,6 +5,8 @@ set -eux
 . "$( cd "$(dirname "$0")" ; pwd -P )/../ghcup_env"
 
 mkdir -p "$CI_PROJECT_DIR"/.local/bin
+mkdir -p data/
+git clone https://github.com/haskell/ghcup-metadata.git data/metadata
 
 CI_PROJECT_DIR=$(pwd)
 

.gitlab/script/ghcup_git.sh

@@ -5,6 +5,8 @@ set -eux
 . "$( cd "$(dirname "$0")" ; pwd -P )/../ghcup_env"
 
 mkdir -p "$CI_PROJECT_DIR"/.local/bin
+mkdir -p data/
+git clone https://github.com/haskell/ghcup-metadata.git data/metadata
 
 CI_PROJECT_DIR=$(pwd)
 

.gitlab/script/ghcup_hls.sh

@@ -5,6 +5,8 @@ set -eux
 . "$( cd "$(dirname "$0")" ; pwd -P )/../ghcup_env"
 
 mkdir -p "$CI_PROJECT_DIR"/.local/bin
+mkdir -p data/
+git clone https://github.com/haskell/ghcup-metadata.git data/metadata
 
 CI_PROJECT_DIR=$(pwd)
 

.gitlab/script/ghcup_version.sh

@@ -5,6 +5,8 @@ set -eux
 . "$( cd "$(dirname "$0")" ; pwd -P )/../ghcup_env"
 
 mkdir -p "$CI_PROJECT_DIR"/.local/bin
+mkdir -p data/
+git clone https://github.com/haskell/ghcup-metadata.git data/metadata
 
 CI_PROJECT_DIR=$(pwd)
 
@@ -13,14 +15,100 @@ ecabal() {
 }
 
 raw_eghcup() {
-	ghcup -v -c "$@"
+	if command -v sydbox 1>/dev/null ; then
+        sydbox \
+            -m core/sandbox/read:deny \
+            -m core/sandbox/write:deny \
+            -m core/sandbox/network:allow \
+            -m allowlist/read+/usr/lib/os-release \
+            -m "allowlist/read+${GHCUP_INSTALL_BASE_PREFIX}/.ghcup/***" \
+            -m "allowlist/write+${GHCUP_INSTALL_BASE_PREFIX}/.ghcup/***" \
+            -m "allowlist/read+${TMPDIR}/***" \
+            -m "allowlist/write+${TMPDIR}/***" \
+            -m "allowlist/read+/usr/lib/***" \
+            -m 'allowlist/read+/etc/ld.so.cache' \
+            -m "allowlist/read+/lib/***" \
+            -m 'allowlist/read+/etc/ssl/openssl.cnf' \
+            -m 'allowlist/read+/proc/sys/crypto/fips_enabled' \
+            -m 'allowlist/read+/etc/nsswitch.conf' \
+            -m 'allowlist/read+/etc/host.conf' \
+            -m 'allowlist/read+/etc/resolv.conf' \
+            -m 'allowlist/read+/etc/hosts' \
+            -m 'allowlist/read+/etc/gai.conf' \
+            -m 'allowlist/read+/etc/ssl/certs/ca-certificates.crt' \
+            -m 'allowlist/read+/usr/share/zoneinfo/Etc/UTC' \
+            -m 'allowlist/read+/dev/urandom' \
+            -m 'core/violation/decision:killall' \
+		    -- ghcup -v -c "$@"
+	else
+		ghcup -v -c "$@"
+	fi
 }
 
 eghcup() {
 	if [ "${OS}" = "WINDOWS" ] ; then
+        sydbox \
+            -m core/sandbox/read:deny \
+            -m core/sandbox/write:deny \
+            -m core/sandbox/network:allow \
+            -m allowlist/read+/usr/lib/os-release \
+            -m "allowlist/read+${GHCUP_INSTALL_BASE_PREFIX}/.ghcup/***" \
+            -m "allowlist/write+${GHCUP_INSTALL_BASE_PREFIX}/.ghcup/***" \
+            -m "allowlist/read+${TMPDIR}/***" \
+            -m "allowlist/write+${TMPDIR}/***" \
+            -m "allowlist/read+/usr/lib/***" \
+            -m 'allowlist/read+/etc/ld.so.cache' \
+            -m "allowlist/read+/lib/***" \
+            -m 'allowlist/read+/etc/ssl/openssl.cnf' \
+            -m 'allowlist/read+/proc/sys/crypto/fips_enabled' \
+            -m 'allowlist/read+/etc/nsswitch.conf' \
+            -m 'allowlist/read+/etc/host.conf' \
+            -m 'allowlist/read+/etc/resolv.conf' \
+            -m 'allowlist/read+/etc/hosts' \
+            -m 'allowlist/read+/etc/gai.conf' \
+            -m 'allowlist/read+/etc/ssl/certs/ca-certificates.crt' \
+            -m 'allowlist/read+/usr/share/zoneinfo/Etc/UTC' \
+            -m 'allowlist/read+/dev/urandom' \
+            -m 'core/violation/decision:killall' \
+    
 		ghcup -v -c -s file:/$CI_PROJECT_DIR/data/metadata/ghcup-${JSON_VERSION}.yaml "$@"
 	else
-		ghcup -v -c -s file://$CI_PROJECT_DIR/data/metadata/ghcup-${JSON_VERSION}.yaml "$@"
+		if command -v sydbox 1>/dev/null ; then
+			ghcup -v -c -s file://$CI_PROJECT_DIR/data/metadata/ghcup-${JSON_VERSION}.yaml "$@"
+		else
+			ghcup -v -c -s file://$CI_PROJECT_DIR/data/metadata/ghcup-${JSON_VERSION}.yaml "$@"
+		fi
+	fi
+}
+
+eghcup_offline() {
+	if command -v sydbox 1>/dev/null ; then
+        sydbox \
+            -m core/sandbox/read:deny \
+            -m core/sandbox/write:deny \
+            -m core/sandbox/network:deny \
+            -m allowlist/read+/usr/lib/os-release \
+            -m "allowlist/read+${GHCUP_INSTALL_BASE_PREFIX}/.ghcup/***" \
+            -m "allowlist/write+${GHCUP_INSTALL_BASE_PREFIX}/.ghcup/***" \
+            -m "allowlist/read+${TMPDIR}/***" \
+            -m "allowlist/write+${TMPDIR}/***" \
+            -m "allowlist/read+/usr/lib/***" \
+            -m 'allowlist/read+/etc/ld.so.cache' \
+            -m "allowlist/read+/lib/***" \
+            -m 'allowlist/read+/etc/ssl/openssl.cnf' \
+            -m 'allowlist/read+/proc/sys/crypto/fips_enabled' \
+            -m 'allowlist/read+/etc/nsswitch.conf' \
+            -m 'allowlist/read+/etc/host.conf' \
+            -m 'allowlist/read+/etc/resolv.conf' \
+            -m 'allowlist/read+/etc/hosts' \
+            -m 'allowlist/read+/etc/gai.conf' \
+            -m 'allowlist/read+/etc/ssl/certs/ca-certificates.crt' \
+            -m 'allowlist/read+/usr/share/zoneinfo/Etc/UTC' \
+            -m 'allowlist/read+/dev/urandom' \
+            -m 'core/violation/decision:killall' \
+			-- ghcup -v --offline "$@"
+	else
+		ghcup -v --offline "$@"
 	fi
 }
 
@@ -131,7 +219,7 @@ else
 	# https://gitlab.haskell.org/haskell/ghcup-hs/issues/7
 	if [ "${OS}" = "LINUX" ] ; then
 		eghcup --downloader=wget prefetch ghc 8.10.3
-		eghcup --offline install ghc 8.10.3
+		eghcup_offline install ghc 8.10.3
 		if [ "${ARCH}" = "64" ] ; then
 			expected=$(cat "$( cd "$(dirname "$0")" ; pwd -P )/../ghc-8.10.3-linux.files" | sort)
 			actual=$(cd "${GHCUP_DIR}/ghc/8.10.3/" && find | sort)
@@ -140,17 +228,17 @@ else
 		fi
 	elif [ "${OS}" = "WINDOWS" ] ; then
 		eghcup prefetch ghc 8.10.3
-		eghcup --offline install ghc 8.10.3
+		eghcup_offline install ghc 8.10.3
 		expected=$(cat "$( cd "$(dirname "$0")" ; pwd -P )/../ghc-8.10.3-windows.files" | sort)
 		actual=$(cd "${GHCUP_DIR}/ghc/8.10.3/" && find | sort)
 		[ "${actual}" = "${expected}" ]
 		unset actual expected
 	else
 		eghcup prefetch ghc 8.10.3
-		eghcup --offline install ghc 8.10.3
+		eghcup_offline install ghc 8.10.3
 	fi
 	[ "$(ghc --numeric-version)" = "${ghc_ver}" ]
-	eghcup --offline set 8.10.3
+	eghcup_offline set 8.10.3
 	eghcup set 8.10.3
 	[ "$(ghc --numeric-version)" = "8.10.3" ]
 	eghcup set ${GHC_VERSION}
@@ -158,7 +246,7 @@ else
 	eghcup unset ghc
     "$GHCUP_BIN"/ghc --numeric-version && exit || echo yes
 	eghcup set ${GHC_VERSION}
-	eghcup --offline rm 8.10.3
+	eghcup_offline rm 8.10.3
 	[ "$(ghc --numeric-version)" = "${ghc_ver}" ]
 
 

cabal.project

@@ -9,14 +9,9 @@ package ghcup
     flags: +tui
 
 constraints: http-io-streams -brotli,
-             any.Cabal ==3.4.0.0 || ==3.6.2.0,
+             any.Cabal ==3.4.1.0 || ==3.6.2.0,
              any.aeson >= 2.0.1.0
 
-source-repository-package
-    type: git
-    location: https://github.com/hasufell/aeson-pretty.git
-    tag: e902ab866bb41d990b66af3644aeb352ff7aaf6f
-
 package libarchive
   flags: -system-libarchive
 

docs/dev.md

@@ -66,18 +66,14 @@ Some light suggestions:
 
 ### Adding a new GHC version
 
-1. open the latest `data/metadata/ghcup-<yaml-ver>.yaml`
-2. find the latest ghc version (in yaml tree e.g. `ghcupDownloads -> GHC -> 8.10.7`)
-3. copy-paste it
-4. adjust the version, tags, changelog, source url
-5. adjust the various bindist urls (make sure to also change the yaml anchors)
-6. run `cabal run exe:ghcup-gen -- check          -f data/metadata/ghcup-<yaml-ver>.yaml`
-7. run `cabal run exe:ghcup-gen -- check-tarballs -f data/metadata/ghcup-<yaml-ver>.yaml -u 'ghc-8\.10\.8'`
+Head over to: [https://github.com/haskell/ghcup-metadata#adding-a-new-ghc-version](https://github.com/haskell/ghcup-metadata#adding-a-new-ghc-version)
 
 ### Adding a new CLI command
 
 An example illustration on how to deal with [optparse-applicative](https://hackage.haskell.org/package/optparse-applicative) can be seen here: [https://gitlab.haskell.org/haskell/ghcup-hs/-/commit/c19dd5ee8b2edbaf0336af143f1c75b6f4843e26](https://gitlab.haskell.org/haskell/ghcup-hs/-/commit/c19dd5ee8b2edbaf0336af143f1c75b6f4843e26)
 
+Every subcommand now lives in its own module under [GHCup.OptParse.MyCommand](https://gitlab.haskell.org/haskell/ghcup-hs/-/tree/master/app/ghcup/GHCup/OptParse).
+
 ## Major refactors
 
 1. First major refactor included adding cross support. This added
@@ -89,6 +85,7 @@ An example illustration on how to deal with [optparse-applicative](https://hacka
    The major changes here were switching `hpath` library out for `filepath`/`directory` (sadly) and
    introducing a non-unix way of handling processes via the `process` library. It also introduced considerable
    amounts of CPP wrt file handling, installation etc.
+3. This refactor split up the huge `Main.hs` and put every subcommand in its own module: [#212](https://gitlab.haskell.org/haskell/ghcup-hs/-/merge_requests/212)
 
 # Releasing
 
@@ -98,7 +95,7 @@ An example illustration on how to deal with [optparse-applicative](https://hacka
 
 3. Add ChangeLog entry
 
-4. Add/fix downloads in `ghcup-<ver>.yaml` (under `data/metadata`), then verify with `ghcup-gen check -f data/metadata/ghcup-<ver>.yaml` and possibly (example only) `ghcup-gen check-tarballs -f data/metadata/ghcup-<ver>.yaml -u 'ghc-8.10.7'`. Generally, new GHC/cabal/stack/hls versions are only added to the latest yaml file. New GHCup versions are added to all (great care must be taken here to not break the parser... e.g. ARM platforms don't parse in all older formats).
+4. Add/fix downloads in `ghcup-<ver>.yaml` ([ghcup-metadata repo](https://github.com/haskell/ghcup-metadata)), then verify with `ghcup-gen check -f ghcup-<ver>.yaml` and possibly (example only) `ghcup-gen check-tarballs -f ghcup-<ver>.yaml -u 'ghc-8.10.7'`. Generally, new GHC/cabal/stack/hls versions are only added to the latest yaml file. New GHCup versions are added to all (great care must be taken here to not break the parser... e.g. ARM platforms don't parse in all older formats).
 
 5. Commit and git push with tag. Wait for tests to succeed and release artifacts to build.
 
@@ -106,9 +103,9 @@ An example illustration on how to deal with [optparse-applicative](https://hacka
 
 7. Add ghcup release artifacts to ALL yaml files (see point 4.)
 
-8. Upload the final `data/metadata/ghcup-<ver>.yaml` (and a detached GPG sig of it) to `webhost.haskell.org/ghcup/data/`.
+8. Upload the final `ghcup-<ver>.yaml` (and a detached GPG sig of it) to `webhost.haskell.org/ghcup/data/` (for yaml versions <= 0.0.6) as well as [https://github.com/haskell/ghcup-metadata](https://github.com/haskell/ghcup-metadata) (for all versions).
 
-9. Update `bootstrap-haskell` and `bootstrap-haskell.ps1` to `webhost.haskell.org/ghcup/sh/`
+9. Upload `bootstrap-haskell` and `bootstrap-haskell.ps1` to `webhost.haskell.org/ghcup/sh/`
 
 10. Update the top-level ghcup symlinks at `downloads.haskell.org/~ghcup`
 

lib/GHCup/Version.hs

@@ -28,7 +28,7 @@ import qualified Data.Text                     as T
 -- Note that when updating this, CI requires that the file exsists AND the same file exists at
 -- 'https://www.haskell.org/ghcup/exp/ghcup-<ver>.yaml' with some newlines added.
 ghcupURL :: URI
-ghcupURL = [uri|https://www.haskell.org/ghcup/data/ghcup-0.0.6.yaml|]
+ghcupURL = [uri|https://raw.githubusercontent.com/haskell/ghcup-metadata/master/ghcup-0.0.6.yaml|]
 
 -- | The current ghcup version.
 ghcUpVer :: PVP

scripts/bootstrap/bootstrap-haskell

@@ -201,10 +201,10 @@ download_ghcup() {
 				i*86)
 					_url=${base_url}/${ghver}/i386-linux-ghcup-${ghver}
 					;;
-				armv7*)
+				armv7*|*armv8l*)
 					_url=${base_url}/${ghver}/armv7-linux-ghcup-${ghver}
 					;;
-				aarch64|arm64|armv8l)
+				aarch64|arm64)
 					# we could be in a 32bit docker container, in which
 					# case uname doesn't give us what we want
 					if [ "$(getconf LONG_BIT)" = "32" ] ; then