Code sign binaries after stripping wrt #318

This reverts commit 8cc333d8d5.

.gitlab/script/ghcup_release.sh

@@ -37,6 +37,9 @@ binary=$(ecabal new-exec -w ghc-${GHC_VERSION} --verbose=0 --offline sh -- -c 'c
 ver=$("${binary}" --numeric-version)
 if [ "${OS}" = "DARWIN" ] ; then
 	strip "${binary}"
+	# https://gitlab.haskell.org/haskell/ghcup-hs/-/issues/318
+	codesign -s - -o linker-signed -i ghcup -v "${binary}"
+	:
 else
 	strip -s "${binary}"
 fi

.gitmodules

@@ -1,4 +1,4 @@
 [submodule "data/metadata"]
 	path = data/metadata
 	url = https://github.com/haskell/ghcup-metadata.git
-	branch = ghcup-0.1.17.5
+	branch = master

CHANGELOG.md

@@ -4,7 +4,7 @@
 
 * Implement `ghcup run` subcommand wrt [#137](https://gitlab.haskell.org/haskell/ghcup-hs/-/issues/137)
 * Support installation of dynamic HLS bindists wrt [HLS #2675](https://github.com/haskell/haskell-language-server/pull/2675) and [#237](https://gitlab.haskell.org/haskell/ghcup-hs/-/merge_requests/237)
-* Fix XDG support when `~/.local/bin` is a symlink wrt [#311](https://gitlab.haskell.org/haskell/ghcup-hs/-/merge_requests/311)
+* Fix XDG support when `~/.local/bin` is a symlink wrt [#311](https://gitlab.haskell.org/haskell/ghcup-hs/-/issues/311)
 * Add support for quilt-style patches wrt [#230](https://gitlab.haskell.org/haskell/ghcup-hs/-/merge_requests/230), by James Hobson
 * Fix redundant upgrade warnings in `ghcup upgrade`
 * Fix `ghcup whereis ghc` for non-standard versions wrt [#289](https://gitlab.haskell.org/haskell/ghcup-hs/-/issues/289)

docs/dev.md

@@ -94,21 +94,27 @@ Every subcommand now lives in its own module under [GHCup.OptParse.MyCommand](ht
 
 3. Add ChangeLog entry
 
-4. Commit and git push with tag. Wait for tests to succeed and release artifacts to build.
+4. If a new ghcup yaml version is needed, create one at [ghcup-metadata repo](https://github.com/haskell/ghcup-metadata) and push to a temporary release branch, then update the `data/metadata` submodule in ghcup-hs repo to that branch, so CI can pass
 
-5. Download release artifacts and upload them `downloads.haskell.org/~ghcup` along with checksum files (`sha256sum --tag * > SHA256SUMS && gpg --detach-sign -u <your-email> SHA256SUMS`)
+5. Commit and git push with tag. Wait for tests to succeed and release artifacts to build.
 
-6. Add ghcup release artifacts to ALL yaml files, see [ghcup-metadata repo](https://github.com/haskell/ghcup-metadata)
+6. Download release artifacts and upload them `downloads.haskell.org/~ghcup` along with checksum files (also check `scripts/releasing/pull_release_artifacts.sh` and `scripts/releasing/sftp-upload-artifacts.sh`)
 
-7. Upload the final `ghcup-<ver>.yaml` (and a detached GPG sig of it) to `webhost.haskell.org/ghcup/data/` (for yaml versions <= 0.0.6) as well as [https://github.com/haskell/ghcup-metadata](https://github.com/haskell/ghcup-metadata) (for all versions).
+7. Add ghcup release artifacts to ALL yaml files, see [ghcup-metadata repo](https://github.com/haskell/ghcup-metadata)
 
-8. Update version in `scripts/bootstrap/bootstrap-haskell` (`ghver` variable at the top of the script)
+8. Upload the final `ghcup-<ver>.yaml` (and a detached GPG sig of it) to `webhost.haskell.org/ghcup/data/` (for yaml versions <= 0.0.6) as well as [https://github.com/haskell/ghcup-metadata](https://github.com/haskell/ghcup-metadata) (for all versions).
 
-9. Upload `scripts/bootstrap/bootstrap-haskell` and `scripts/bootstrap/bootstrap-haskell.ps1` to `webhost.haskell.org/ghcup/sh/`
+9. Update version in `scripts/bootstrap/bootstrap-haskell` (`ghver` variable at the top of the script)
 
-10. Update the top-level ghcup symlinks at `downloads.haskell.org/~ghcup` (see `scripts/update-sftp.sh`)
+10. Upload `scripts/bootstrap/bootstrap-haskell` and `scripts/bootstrap/bootstrap-haskell.ps1` to `webhost.haskell.org/ghcup/sh/`
 
-11. Post on reddit/discourse/etc. and collect rewards
+11. Update the top-level ghcup symlinks at `downloads.haskell.org/~ghcup` (see `scripts/releasing/sftp-symlink-artifacts.sh`)
+
+12. Update the `data/metadata` submodule in ghcup-hs repo to master
+
+13. Do hackage release
+
+14. Post on reddit/discourse/etc. and collect rewards
 
 # Documentation
 

docs/guide.md

@@ -259,48 +259,14 @@ You can also pass the mode via `ghcup --gpg <strict|lax|none>`.
    
 ## Tips and tricks
 
-### with_ghc wrapper (e.g. for HLS)
+### Execute command with certain GHC in PATH
 
-Due to some HLS [bugs](https://github.com/mpickering/hie-bios/issues/194) it's necessary that the `ghc` in PATH
-is the one defined in `cabal.project`. With some simple shell functions, we can start our editor with the appropriate
-path prepended.
-
-For bash, in e.g. `~/.bashrc` define:
+If you don't want to explicitly switch the active GHC all the time and are using
+tools that rely on the plain `ghc` binary, GHCup provides an easy way to execute
+commands with a certain toolchain prepended to PATH, e.g.:
 
 ```sh
-with_ghc() {
-  local np=$(ghcup --offline whereis -d ghc $1 || { ghcup --cache install ghc $1 && ghcup whereis -d ghc $1 ;})
-  if [ -e "${np}" ] ; then
-    shift
-    PATH="$np:$PATH" "$@"
-  else
-    >&2 echo "Cannot find or install GHC version $1"
-    return 1
-  fi
-}
+ghcup run --ghc 8.10.7 --cabal latest --hls latest --stack latest --install -- code Setup.hs
 ```
 
-For fish shell, in e.g. `~/.config/fish/config.fish` define:
-
-```fish
-function with_ghc
-  set --local np (ghcup --offline whereis -d ghc $argv[1] ; or begin ghcup --cache install ghc $argv[1] ; and ghcup whereis -d ghc $argv[1] ; end)
-  if test -e "$np"
-    PATH="$np:$PATH" $argv[2..-1]
-  else
-    echo "Cannot find or install GHC version $argv[1]" 1>&2
-    return 1
-  end
-end
-```
-
-Then start a new shell and issue:
-
-```sh
-# replace 'code' with your editor
-with_ghc 8.10.5 code path/to/haskell/source
-```
-
-Cabal and HLS will now see `8.10.5` as the primary GHC, without the need to
-run `ghcup set` all the time when switching between projects.
-
+This will execute vscode with GHC set to 8.10.7 and all other tools to their latest version.

ghcup.cabal

@@ -50,7 +50,7 @@ flag no-exe
 
 flag disable-upgrade
   description:
-    Build the brick powered tui (ghcup tui). This is disabled on windows.
+    Disable upgrade functionality. This is mainly to support brew packagers.
 
   default:     False
   manual:      True

scripts/bootstrap/bootstrap-haskell

@@ -25,7 +25,7 @@
 
 plat="$(uname -s)"
 arch=$(uname -m)
-ghver="0.1.17.4"
+ghver="0.1.17.5"
 base_url="https://downloads.haskell.org/~ghcup"
 
 export GHCUP_SKIP_UPDATE_CHECK=yes

scripts/releasing/pull_release_artifacts.sh

@@ -0,0 +1,49 @@
+
+set -eu
+
+tag=v$1
+ver=$1
+
+dest=$2
+gpg_user=$3
+
+mkdir -p "${dest}"
+
+cd "${dest}"
+
+base_url="https://gitlab.haskell.org/api/v4/projects/618/jobs/artifacts/${tag}/raw"
+
+curl -f -o "x86_64-apple-darwin-ghcup-${ver}" \
+	"${base_url}/out/x86_64-apple-darwin-ghcup-${ver}?job=release:darwin"
+
+curl -f -o "aarch64-apple-darwin-ghcup-${ver}" \
+	"${base_url}/out/aarch64-apple-darwin-ghcup-${ver}?job=release:darwin:aarch64"
+
+curl -f -o "x86_64-freebsd12-ghcup-${ver}" \
+	"${base_url}/out/x86_64-portbld-freebsd-ghcup-${ver}?job=release:freebsd12"
+
+curl -f -o "x86_64-freebsd13-ghcup-${ver}" \
+	"${base_url}/out/x86_64-portbld-freebsd-ghcup-${ver}?job=release:freebsd13"
+
+curl -f -o "i386-linux-ghcup-${ver}" \
+	"${base_url}/out/i386-linux-ghcup-${ver}?job=release:linux:32bit"
+
+curl -f -o "x86_64-linux-ghcup-${ver}" \
+	"${base_url}/out/x86_64-linux-ghcup-${ver}?job=release:linux:64bit"
+
+curl -f -o "aarch64-linux-ghcup-${ver}" \
+	"${base_url}/out/aarch64-linux-ghcup-${ver}?job=release:linux:aarch64"
+
+curl -f -o "armv7-linux-ghcup-${ver}" \
+	"${base_url}/out/armv7-linux-ghcup-${ver}?job=release:linux:armv7"
+
+curl -f -o "x86_64-mingw64-ghcup-${ver}.exe" \
+	"${base_url}/out/x86_64-mingw64-ghcup-${ver}.exe?job=release:windows"
+
+rm -f *.sig
+sha256sum *-ghcup-* > SHA256SUMS
+gpg --detach-sign -u ${gpg_user} SHA256SUMS
+for f in *-ghcup-* ; do gpg --detach-sign -u ${gpg_user} $f ; done
+
+
+

scripts/releasing/sftp-symlink-artifacts.sh

@@ -36,3 +36,4 @@ symlink ${ver}/x86_64-mingw64-ghcup-${ver}.exe x86_64-mingw64-ghcup.exe
 EOF
 
 curl -X PURGE https://downloads.haskell.org/~ghcup/
+curl -X PURGE https://downloads.haskell.org/ghcup/

scripts/releasing/sftp-upload-artifacts.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+
+url=$1
+ver=$2
+artifacts_dir=$3
+
+die() {
+    (>&2 printf "%s\\n" "$1")
+    exit 2
+}
+
+[ -z $url ] && die "no url set"
+[ -z $ver ] && die "no version set"
+[ -z "${artifacts_dir}" ] && die "artifacts_dir not set"
+[ -e "${artifacts_dir}" ] || die "artifacts_dir \"${artifacts_dir}\" does not exist"
+
+cd "${artifacts_dir}"
+
+sftp $url <<EOF
+cd ghcup
+
+mkdir ${ver}
+cd ${ver}
+put SHA256SUMS
+put SHA256SUMS.sig
+put aarch64-apple-darwin-ghcup-${ver}
+put aarch64-apple-darwin-ghcup-${ver}.sig
+put aarch64-linux-ghcup-${ver}
+put aarch64-linux-ghcup-${ver}.sig
+put armv7-linux-ghcup-${ver}
+put armv7-linux-ghcup-${ver}.sig
+put i386-linux-ghcup-${ver}
+put i386-linux-ghcup-${ver}.sig
+put x86_64-apple-darwin-ghcup-${ver}
+put x86_64-apple-darwin-ghcup-${ver}.sig
+put x86_64-freebsd12-ghcup-${ver}
+put x86_64-freebsd12-ghcup-${ver}.sig
+put x86_64-freebsd13-ghcup-${ver}
+put x86_64-freebsd13-ghcup-${ver}.sig
+put x86_64-linux-ghcup-${ver}
+put x86_64-linux-ghcup-${ver}.sig
+put x86_64-mingw64-ghcup-${ver}.exe
+put x86_64-mingw64-ghcup-${ver}.exe.sig
+EOF
+
+curl -X PURGE https://downloads.haskell.org/~ghcup/${ver}/
+curl -X PURGE https://downloads.haskell.org/ghcup/${ver}/