haskellPackages: GHC 9.10 fix, infrastructure improvements

doc/languages-frameworks/haskell.section.md

@@ -923,14 +923,59 @@ for this to work.
 
 `justStaticExecutables drv`
 : Only build and install the executables produced by `drv`, removing everything
-that may refer to other Haskell packages' store paths (like libraries and
-documentation). This dramatically reduces the closure size of the resulting
-derivation. Note that the executables are only statically linked against their
-Haskell dependencies, but will still link dynamically against libc, GMP and
-other system library dependencies. If dependencies use their Cabal-generated
-`Paths_*` module, this may not work as well if GHC's dead code elimination
-is unable to remove the references to the dependency's store path that module
-contains.
+  that may refer to other Haskell packages' store paths (like libraries and
+  documentation). This dramatically reduces the closure size of the resulting
+  derivation. Note that the executables are only statically linked against their
+  Haskell dependencies, but will still link dynamically against libc, GMP and
+  other system library dependencies.
+
+  If the library being built or its dependencies use their Cabal-generated
+  `Paths_*` module, this may not work as well if GHC's dead code elimination is
+  unable to remove the references to the dependency's store path that module
+  contains. (See [nixpkgs#164630][164630] for more information.)
+
+  Importing the `Paths_*` module may cause builds to fail with this message:
+
+  ```
+  error: output '/nix/store/64k8iw0ryz76qpijsnl9v87fb26v28z8-my-haskell-package-1.0.0.0' is not allowed to refer to the following paths:
+           /nix/store/5q5s4a07gaz50h04zpfbda8xjs8wrnhg-ghc-9.6.3
+  ```
+
+  If that happens, first disable the check for GHC references and rebuild the
+  derivation:
+
+  ```nix
+  pkgs.haskell.lib.overrideCabal
+    (pkgs.haskell.lib.justStaticExecutables my-haskell-package)
+    (drv: {
+      disallowGhcReference = false;
+    })
+  ```
+
+  Then use `strings` to determine which libraries are responsible:
+
+  ```
+  $ nix-build ...
+  $ strings result/bin/my-haskell-binary | grep /nix/store/
+  ...
+  /nix/store/n7ciwdlg8yyxdhbrgd6yc2d8ypnwpmgq-hs-opentelemetry-sdk-0.0.3.6/bin
+  ...
+  ```
+
+  Finally, use `remove-references-to` to delete those store paths from the produced output:
+
+  ```nix
+  pkgs.haskell.lib.overrideCabal
+    (pkgs.haskell.lib.justStaticExecutables my-haskell-package)
+    (drv: {
+      postInstall = ''
+        ${drv.postInstall or ""}
+        remove-references-to -t ${pkgs.haskellPackages.hs-opentelemetry-sdk}
+      '';
+    })
+  ```
+
+[164630]: https://github.com/NixOS/nixpkgs/issues/164630
 
 `enableSeparateBinOutput drv`
 : Install executables produced by `drv` to a separate `bin` output. This

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -40,6 +40,14 @@
   before changing the package to `pkgs.stalwart-mail` in
   [`services.stalwart-mail.package`](#opt-services.stalwart-mail.package).
 
+- `haskell.lib.compose.justStaticExecutables` now disallows references to GHC in the
+  output by default, to alert users to closure size issues caused by
+  [#164630](https://github.com/NixOS/nixpkgs/issues/164630). See ["Packaging
+  Helpers" in the Haskell section of the Nixpkgs
+  manual](https://nixos.org/manual/nixpkgs/unstable/#haskell-packaging-helpers)
+  for information on working around `output '...' is not allowed to refer to
+  the following paths` errors caused by this change.
+
 - The `stalwart-mail` module now uses RocksDB as the default storage backend
   for `stateVersion` ≥ 24.11. (It was previously using SQLite for structured
   data and the filesystem for blobs).

pkgs/applications/misc/gitit/default.nix

@@ -1,4 +1,4 @@
-{ lib, haskellPackages, haskell, removeReferencesTo
+{ lib, stdenv, haskellPackages, haskell
 # “Plugins” are a fancy way of saying gitit will invoke
 # GHC at *runtime*, which in turn makes it pull GHC
 # into its runtime closure. Only enable if you really need
@@ -7,55 +7,36 @@
 , pluginSupport ? false
 }:
 
-# this is similar to what we do with the pandoc executable
-
 let
-  plain = haskellPackages.gitit;
-  plugins =
-    if pluginSupport
-    then plain
-    else haskell.lib.compose.disableCabalFlag "plugins" plain;
-  static = haskell.lib.compose.justStaticExecutables plugins;
+  inherit (haskell.lib.compose)
+    enableCabalFlag
+    disableCabalFlag
+    justStaticExecutables
+    overrideCabal
+  ;
 
-in
-  (haskell.lib.compose.overrideCabal (drv: {
-    buildTools = (drv.buildTools or []) ++ [ removeReferencesTo ];
-  }) static).overrideAttrs (drv: {
+  base = (if pluginSupport then enableCabalFlag else disableCabalFlag)
+    "plugins"
+    haskellPackages.gitit;
 
-    # These libraries are still referenced, because they generate
-    # a `Paths_*` module for figuring out their version.
-    # The `Paths_*` module is generated by Cabal, and contains the
-    # version, but also paths to e.g. the data directories, which
-    # lead to a transitive runtime dependency on the whole GHC distribution.
-    # This should ideally be fixed in haskellPackages (or even Cabal),
-    # but a minimal gitit is important enough to patch it manually.
-    disallowedReferences = [
-      haskellPackages.pandoc-types
-      haskellPackages.HTTP
-      haskellPackages.pandoc
-      haskellPackages.happstack-server
-      haskellPackages.filestore
-    ];
-    postInstall = ''
-      remove-references-to \
-        -t ${haskellPackages.pandoc-types} \
-        $out/bin/gitit
-      remove-references-to \
-        -t ${haskellPackages.HTTP} \
-        $out/bin/gitit
-      remove-references-to \
-        -t ${haskellPackages.pandoc} \
-        $out/bin/gitit
-      remove-references-to \
-        -t ${haskellPackages.happstack-server} \
-        $out/bin/gitit
-      remove-references-to \
-        -t ${haskellPackages.filestore} \
-        $out/bin/gitit
-    '';
+  # Removes erroneous references from dead code that GHC can't eliminate
+  aarch64DarwinFix = overrideCabal (drv:
+    lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) {
+      postInstall = ''
+        ${drv.postInstall or ""}
+        remove-references-to -t ${haskellPackages.HTTP} "$out/bin/gitit"
+        remove-references-to -t ${haskellPackages.HTTP} "$out/bin/expireGititCache"
+        remove-references-to -t ${haskellPackages.happstack-server} "$out/bin/gitit"
+        remove-references-to -t ${haskellPackages.hoauth2} "$out/bin/gitit"
+        remove-references-to -t ${haskellPackages.pandoc} "$out/bin/gitit"
+        remove-references-to -t ${haskellPackages.pandoc-types} "$out/bin/gitit"
+      '';
+    });
+in
 
-    meta = drv.meta // {
-      maintainers = drv.meta.maintainers or []
-        ++ [ lib.maintainers.Profpatsch ];
-    };
-  })
+if pluginSupport
+then base
+else lib.pipe (base.override { ghc-paths = null; }) [
+  justStaticExecutables
+  aarch64DarwinFix
+]