haskell · AlistairB · Jan 6, 2022 · Dec 26, 2021 · Dec 26, 2021 · Dec 26, 2021
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1,14 +1,17 @@
-name: Build and Smoke Test
+name: Validate Docker
 
 on:
   pull_request:
     branches:
       - master
+    paths:
+      - '**/Dockerfile'
+      - '.github/workflows/**'
 
 jobs:
-  ci:
+  build-smoke-test:
     timeout-minutes: 30
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     name: ${{ matrix.ghc }}-${{ matrix.deb }}
     strategy:
       fail-fast: false
@@ -24,8 +27,8 @@ jobs:
             ghc_minor: '9.2'
     steps:
       - uses: actions/checkout@v2
-      - name: docker build [${{ matrix.ghc }}]
-        uses: nick-invision/retry@v1
+      - name: build + smoke test [${{ matrix.ghc }}]
+        uses: nick-invision/retry@v2
         with:
           timeout_minutes: 8
           max_attempts: 3
@@ -39,3 +42,62 @@ jobs:
           path: official-images
       - name: run official-images tests
         run: ./official-images/test/run.sh haskell:${{ matrix.ghc }}-${{ matrix.deb }}
+
+  hadolint:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - uses: hadolint/hadolint-action@v1.6.0
+      with:
+        recursive: true
+
+  emulated-architecture-tests:
+    timeout-minutes: 60
+    runs-on: ubuntu-latest
+    name: ${{ matrix.arch }}-${{ matrix.ghc }}-${{ matrix.deb }}
+    strategy:
+      fail-fast: false
+      matrix:
+        ghc: ['8.10.7', '9.0.2', '9.2.1']
+        deb: ['buster']
+        arch: ['aarch64']
+        include:
+          - ghc: '8.10.7'
+            ghc_minor: '8.10'
+          - ghc: '9.0.2'
+            ghc_minor: '9.0'
+          - ghc: '9.2.1'
+            ghc_minor: '9.2'
+          - arch: aarch64
+            docker_platform: arm64
+    steps:
+      - uses: actions/checkout@v2
+      - name: docker build [ ${{ matrix.arch }} ${{ matrix.ghc }}]
+        uses: uraimo/run-on-arch-action@e9117b926d001f8683802c315b5a134f8c5da3d3
+        with:
+          arch: ${{ matrix.arch }}
+          distro: ${{ matrix.deb }}
+          githubToken: ${{ github.token }}
+          dockerRunArgs:
+            --volume /var/run/docker.sock:/var/run/docker.sock
+          install: |
+            apt-get update
+            apt-get install -y curl
+            curl -fsSL https://get.docker.com | sh
+          run: |
+            docker build --pull \
+              --platform "linux/${{ matrix.docker_platform }}" \
+              -t haskell:${{ matrix.ghc }}-${{ matrix.deb }} \
+              ${{ matrix.ghc_minor }}/${{ matrix.deb }}
+            echo 'testing..'
+            docker run \
+              --platform "linux/${{ matrix.docker_platform }}" \
+              -t haskell:${{ matrix.ghc }}-${{ matrix.deb }} \
+              bash -c "cabal update && cabal install --lib hashable"
+            docker run \
+              --platform "linux/${{ matrix.docker_platform }}" \
+              -t haskell:${{ matrix.ghc }}-${{ matrix.deb }} \
+              bash -c "echo | ghci"
+
+# Running the official tests does not work as we need to hardcode the plaform due to the emulated nature.
+# This solution is fairly hacky, but gets us most of benefit of the official tests.
diff --git a/.hadolint.yaml b/.hadolint.yaml
@@ -0,0 +1,10 @@
+ignored:
+  # https://github.com/hadolint/hadolint/wiki/DL3008
+  # Don't want to micro manage the dependency versions.
+  - DL3008
+  # https://github.com/hadolint/hadolint/wiki/DL3003
+  # Using cd /tmp is a very convenient way to clean up after a step.
+  - DL3003
+  # https://github.com/hadolint/hadolint/wiki/DL4006
+  # The set -eux; pattern is common in many of the official images. It likely is a better approach here.
+  - DL4006
diff --git a/7.10/Dockerfile b/7.10/Dockerfile
diff --git a/7.8/Dockerfile b/7.8/Dockerfile
diff --git a/8.0/Dockerfile b/8.0/Dockerfile
diff --git a/8.10/buster/Dockerfile b/8.10/buster/Dockerfile
@@ -7,13 +7,15 @@ RUN apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
+        dpkg-dev \
         git \
         gcc \
         gnupg \
         g++ \
         libc6-dev \
         libffi-dev \
         libgmp-dev \
+        libnuma-dev \
         libsqlite3-dev \
         libtinfo-dev \
         make \
@@ -25,56 +27,129 @@ RUN apt-get update && \
 
 ARG CABAL_INSTALL=3.6.2.0
 ARG CABAL_INSTALL_RELEASE_KEY=A970DF3AC3B9709706D74544B3D9F94B8DCAE210
-# get from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS
-ARG CABAL_INSTALL_RELEASE_SHA256=4759B56E9257E02F29FA374A6B25D6CB2F9D80C7E3A55D4F678A8E570925641C
 
-RUN cd /tmp && \
-    export GNUPGHOME="$(mktemp -d)" && \
-    gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${CABAL_INSTALL_RELEASE_KEY} && \
-    curl -fSLO https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS && \
-    curl -fSLO https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS.sig && \
-    gpg --batch --trusted-key B3D9F94B8DCAE210 --verify SHA256SUMS.sig SHA256SUMS && \
-    curl -fSL https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/cabal-install-$CABAL_INSTALL-x86_64-linux-deb10.tar.xz -o cabal-install.tar.gz && \
-    echo "$CABAL_INSTALL_RELEASE_SHA256 cabal-install.tar.gz" | sha256sum --strict --check && \
-    tar -xf cabal-install.tar.gz -C /usr/local/bin && \
-    rm -rf "$GNUPGHOME" /var/lib/apt/lists/* /tmp/*
+RUN set -eux; \
+    cd /tmp; \
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
+    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/cabal-install-$CABAL_INSTALL-$ARCH-linux-deb10.tar.xz"; \
+    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
+    # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS
+    case "$ARCH" in \
+        'aarch64') \
+            CABAL_INSTALL_SHA256='d9acee67d4308bc5c22d27bee034d388cc4192a25deff9e7e491e2396572b030'; \
+            ;; \
+        'x86_64') \
+            CABAL_INSTALL_SHA256='4759b56e9257e02f29fa374a6b25d6cb2f9d80c7e3a55d4f678a8e570925641c'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
+    esac; \
+    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz; \
+    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check; \
+    \
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"; \
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"; \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"; \
+    gpg --batch --verify SHA256SUMS.sig SHA256SUMS; \
+    gpgconf --kill all; \
+    \
+    tar -xf cabal-install.tar.gz -C /usr/local/bin; \
+    \
+    rm -rf /tmp/*; \
+    \
+    cabal --version
+
+# GHC 8.10 requires LLVM version 9 - 12 on aarch64
+ARG LLVM_VERSION=12
+
+RUN set -eux; \
+    if [ "$(dpkg-architecture --query DEB_BUILD_GNU_CPU)" = "aarch64" ]; then \
+        # adapted from https://apt.llvm.org/llvm.sh
+        curl -sSL https://apt.llvm.org/llvm-snapshot.gpg.key | apt-key add -; \
+        echo "deb http://apt.llvm.org/buster/ llvm-toolchain-buster-$LLVM_VERSION main" > /etc/apt/sources.list.d/llvm.list; \
+        apt-get update; \
+        apt-get install -y --no-install-recommends llvm-$LLVM_VERSION; \
+        rm -rf /var/lib/apt/lists/*; \
+    fi
 
 ARG GHC=8.10.7
 ARG GHC_RELEASE_KEY=88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4
-# get from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
-ARG GHC_RELEASE_SHA256=A13719BCA87A0D3AC0C7D4157A4E60887009A7F1A8DBE95C4759EC413E086D30
 
-RUN cd /tmp && \
-  export GNUPGHOME="$(mktemp -d)" && \
-  curl -sSL https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-x86_64-deb10-linux.tar.xz -o ghc.tar.xz && \
-  curl -sSL https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-x86_64-deb10-linux.tar.xz.sig -o ghc.tar.xz.sig && \
-  gpg --batch --keyserver keyserver.ubuntu.com --receive-keys ${GHC_RELEASE_KEY} && \
-  gpg --batch --trusted-key 588764FBE22D19C4 --verify ghc.tar.xz.sig ghc.tar.xz && \
-  echo "$GHC_RELEASE_SHA256 ghc.tar.xz" | sha256sum --strict --check && \
-  tar xf ghc.tar.xz && \
-  cd ghc-$GHC && \
-  ./configure --prefix /opt/ghc/$GHC && \
-  make install && \
-  find /opt/ghc/$GHC/ \( -name "*_p.a" -o -name "*.p_hi" \) -type f -delete && \
-  rm -rf /opt/ghc/$GHC/share/ && \
-  rm -rf "$GNUPGHOME" /tmp/*
+RUN set -eux; \
+    cd /tmp; \
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb10-linux.tar.xz"; \
+    # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
+    case "$ARCH" in \
+        'aarch64') \
+            GHC_SHA256='fad2417f9b295233bf8ade79c0e6140896359e87be46cb61cd1d35863d9d0e55'; \
+            ;; \
+        'x86_64') \
+            GHC_SHA256='a13719bca87a0d3ac0c7d4157a4e60887009a7f1a8dbe95c4759ec413e086d30'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
+    esac; \
+    curl -sSL "$GHC_URL" -o ghc.tar.xz; \
+    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check; \
+    \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"; \
+    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz; \
+    gpgconf --kill all; \
+    \
+    tar xf ghc.tar.xz; \
+    cd "ghc-$GHC"; \
+    ./configure --prefix "/opt/ghc/$GHC"; \
+    make install; \
+    # remove profiling support to save space
+    find "/opt/ghc/$GHC/" \( -name "*_p.a" -o -name "*.p_hi" \) -type f -delete; \
+    # remove some docs
+    rm -rf "/opt/ghc/$GHC/share/"; \
+    \
+    rm -rf /tmp/*; \
+    \
+    "/opt/ghc/$GHC/bin/ghc" --version
 
 ARG STACK=2.7.3
 ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
-# get from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-x86_64.tar.gz.sha256
-ARG STACK_RELEASE_SHA256=A6C090555FA1C64AA61C29AA4449765A51D79E870CF759CDE192937CD614E72B
 
-RUN cd /tmp && \
-    export GNUPGHOME="$(mktemp -d)" && \
-    gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${STACK_RELEASE_KEY} && \
-    curl -fSL https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-x86_64.tar.gz -o stack.tar.gz && \
-    curl -fSL https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-x86_64.tar.gz.asc -o stack.tar.gz.asc && \
-    gpg --batch --trusted-key 575159689BEFB442 --verify stack.tar.gz.asc stack.tar.gz && \
-    echo "$STACK_RELEASE_SHA256 stack.tar.gz" | sha256sum --strict --check && \
-    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 stack-$STACK-linux-x86_64/stack && \
-    /usr/local/bin/stack config set system-ghc --global true && \
-    /usr/local/bin/stack config set install-ghc --global false && \
-    rm -rf "$GNUPGHOME" /var/lib/apt/lists/* /tmp/*
+RUN set -eux; \
+    cd /tmp; \
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
+    INSTALL_STACK="true"; \
+    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
+    # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
+    case "$ARCH" in \
+        'aarch64') \
+            # Stack does not officially support ARM64, nor do the binaries that exist work.
+            # Hitting https://github.com/commercialhaskell/stack/issues/2103#issuecomment-972329065 when trying to use
+            # stack-2.7.1-linux-aarch64.tar.gz
+            INSTALL_STACK="false"; \
+            ;; \
+        'x86_64') \
+            STACK_SHA256='a6c090555fa1c64aa61c29aa4449765a51d79e870cf759cde192937cd614e72b'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
+    esac; \
+    if [ "$INSTALL_STACK" = "true" ]; then \
+        curl -sSL "$STACK_URL" -o stack.tar.gz; \
+        echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
+        \
+        curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
+        GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+        gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
+        gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
+        gpgconf --kill all; \
+        \
+        tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
+        stack config set system-ghc --global true; \
+        stack config set install-ghc --global false; \
+        \
+        rm -rf /tmp/*; \
+        \
+        stack --version; \
+    fi
 
 ENV PATH /root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
 

diff --git a/8.2/Dockerfile b/8.2/Dockerfile