haskell · develop7 · Dec 25, 2025
diff --git a/.github/workflows/debian.yml b/.github/workflows/debian.yml
@@ -26,9 +26,21 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ghc: ['9.12.2', '9.10.3', '9.8.4', '9.6.7']
+        ghc: ['9.14.1', '9.12.2', '9.10.3', '9.8.4', '9.6.7']
         deb: ['bullseye', 'slim-bullseye']
         include:
+          - ghc: '9.14.1'
+            ghc_minor: '9.14'
+            deb: 'bookworm'
+          - ghc: '9.14.1'
+            ghc_minor: '9.14'
+            deb: 'slim-bookworm'
+          - ghc: '9.14.1'
+            ghc_minor: '9.14'
+            deb: 'bullseye'
+          - ghc: '9.14.1'
+            ghc_minor: '9.14'
+            deb: 'slim-bullseye'
           - ghc: '9.12.2'
             ghc_minor: '9.12'
             deb: 'bookworm'
@@ -73,10 +85,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ghc: ['9.6.7', '9.8.4', '9.10.3', '9.12.2']
+        ghc: ['9.6.7', '9.8.4', '9.10.3', '9.12.2', '9.14.1']
         # native arm runner; still avoid slim variants here
         deb: ['bullseye']
         include:
+          - ghc: '9.14.1'
+            ghc_minor: '9.14'
+            deb: 'bookworm'
           # bookworm (debian 12)
           - ghc: '9.12.2'
             ghc_minor: '9.12'
@@ -91,6 +106,8 @@ jobs:
         exclude:
           - ghc: '9.12.2'
             deb: 'bullseye'
+          - ghc: '9.14.1'
+            deb: 'bullseye'
 
     steps:
       - uses: actions/checkout@v4

diff --git a/9.14/_globals.yaml b/9.14/_globals.yaml
@@ -0,0 +1,9 @@
+stack:
+  version: "3.3.1"
+  release_key: "C5705533DA4F78D8664B5DC0575159689BEFB442"
+  sha256sum:
+    "aarch64": 'bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'
+    "x86_64": '88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'
+cabal_install:
+  version: "3.16.1.0"
+  release_key: "1E07C9A1A3088BAD47F74A3E227EE1942B0BDB95"
diff --git a/9.14/bookworm.yaml b/9.14/bookworm.yaml
@@ -0,0 +1,16 @@
+---
+distro:
+  codename: 'bookworm'
+  abbr: 'deb12'
+  image: 'debian:bookworm'
+ghc:
+  version: "9.14.1"
+  release_key: "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4"
+  sha256sum:
+    "aarch64": '6aa27a377451851c851eefdd869e8f5a9217b02ce66c6ca9b418b72efee28427'
+    "x86_64": '60f7ab75f28df892729fbaff3a54f58ee3ad7e731929f1b2f3eb0208f73de841'
+cabal_install:
+  sha256sum:
+    "aarch64": '41d8fc43de1c652c00d85799d0273f8b6600bc71603126bc651ca4e3917a1b84'
+    "x86_64": '209987f6abdd1119f6b2674a0d1012857a783464774708cb4f3fd9e156ea7bea'
+_globals: !include '_globals.yaml'
diff --git a/9.14/bookworm/Dockerfile b/9.14/bookworm/Dockerfile
@@ -0,0 +1,136 @@
+FROM debian:bookworm
+
+ENV LANG=C.UTF-8
+
+# common haskell + stack dependencies
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        dpkg-dev \
+        git \
+        gcc \
+        gnupg \
+        g++ \
+        libc6-dev \
+        libffi-dev \
+        libgmp-dev \
+        libnuma-dev \
+        libtinfo-dev \
+        make \
+        netbase \
+        xz-utils \
+        zlib1g-dev && \
+    rm -rf /var/lib/apt/lists/*
+
+
+ARG STACK='3.3.1'
+ARG STACK_RELEASE_KEY='C5705533DA4F78D8664B5DC0575159689BEFB442'
+
+RUN set -eux; \
+    cd /tmp; \
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
+    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
+    # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256 \
+    case "$ARCH" in \
+        'aarch64') \
+            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'; \
+            ;; \
+        'x86_64') \
+            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
+    esac; \
+    curl -sSL "$STACK_URL" -o stack.tar.gz; \
+    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
+    \
+    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
+    GNUPGHOME="$(mktemp -d)"; \
+    export GNUPGHOME; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
+    gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
+    gpgconf --kill all; \
+    \
+    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
+    stack config set system-ghc --global true; \
+    stack config set install-ghc --global false; \
+    \
+    rm -rf /tmp/*; \
+    \
+    stack --version;
+
+ARG CABAL_INSTALL='3.16.1.0'
+ARG CABAL_INSTALL_RELEASE_KEY='1E07C9A1A3088BAD47F74A3E227EE1942B0BDB95'
+
+RUN set -eux; \
+    cd /tmp; \
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
+    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb12.tar.xz"; \
+    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"; \
+    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
+    # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS \
+    case "$ARCH" in \
+        'aarch64') \
+            CABAL_INSTALL_SHA256='41d8fc43de1c652c00d85799d0273f8b6600bc71603126bc651ca4e3917a1b84'; \
+            ;; \
+        'x86_64') \
+            CABAL_INSTALL_SHA256='209987f6abdd1119f6b2674a0d1012857a783464774708cb4f3fd9e156ea7bea'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
+    esac; \
+    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz; \
+    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check; \
+    \
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"; \
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"; \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"; \
+    gpg --batch --verify SHA256SUMS.sig SHA256SUMS; \
+    # confirm we are verifying SHA256SUMS that matches the release + sha256 \
+    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS; \
+    gpgconf --kill all; \
+    \
+    tar -xf cabal-install.tar.gz -C /usr/local/bin; \
+    \
+    rm -rf /tmp/*; \
+    \
+    cabal --version
+
+ARG GHC='9.14.1'
+ARG GHC_RELEASE_KEY='88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4'
+
+RUN set -eux; \
+    cd /tmp; \
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb12-linux.tar.xz"; \
+    # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS \
+    case "$ARCH" in \
+        'aarch64') \
+            GHC_SHA256='6aa27a377451851c851eefdd869e8f5a9217b02ce66c6ca9b418b72efee28427'; \
+            ;; \
+        'x86_64') \
+            GHC_SHA256='60f7ab75f28df892729fbaff3a54f58ee3ad7e731929f1b2f3eb0208f73de841'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
+    esac; \
+    curl -sSL "$GHC_URL" -o ghc.tar.xz; \
+    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check; \
+    \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"; \
+    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz; \
+    gpgconf --kill all; \
+    \
+    tar xf ghc.tar.xz; \
+    cd "ghc-$GHC-$ARCH-unknown-linux"; \
+    ./configure --prefix "/opt/ghc/$GHC"; \
+    make install; \
+    \
+    rm -rf /tmp/*; \
+    \
+    "/opt/ghc/$GHC/bin/ghc" --version
+
+ENV PATH=/root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
+
+CMD ["ghci"]
diff --git a/9.14/bullseye.yaml b/9.14/bullseye.yaml
@@ -0,0 +1,22 @@
+---
+distro:
+  codename: 'bullseye'
+  abbr: 'deb11'
+  image: 'debian:bullseye'
+ghc:
+  version: "9.14.1"
+  release_key: "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4"
+  sha256sum:
+    "aarch64": '526c352cceddbf6c580e17ade7e782e3b21b4182d328b2d454c9f13ca7c08992' # hash from deb10 bindist
+    "x86_64": '98f42ba5b44e50d680434b9d3c7ad51b257678899cf7f806a0c85cf63b6d1095'
+cabal_install:
+  sha256sum:
+    "aarch64": '6c5b74781d64266fa060099502d33b1f8297f269a5f71eda871b7db7fb3bf8e4'
+    "x86_64": '0af41eac80718dc4396340cffa2dbf525e777ec3e877f689718a9ef5aedcb6ab'
+overrides:
+  ghc:
+    "aarch64":
+      # GHC 9.14.1 doesn't have a deb11 bindist for aarch64 for some reason, so we're using the deb10 one instead
+      url: "https://downloads.haskell.org/~ghc/9.14.1/ghc-9.14.1-aarch64-deb10-linux.tar.xz"
+_globals: !include '_globals.yaml'
+
diff --git a/9.14/bullseye/Dockerfile b/9.14/bullseye/Dockerfile
@@ -0,0 +1,137 @@
+FROM debian:bullseye
+
+ENV LANG=C.UTF-8
+
+# common haskell + stack dependencies
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        dpkg-dev \
+        git \
+        gcc \
+        gnupg \
+        g++ \
+        libc6-dev \
+        libffi-dev \
+        libgmp-dev \
+        libnuma-dev \
+        libtinfo-dev \
+        make \
+        netbase \
+        xz-utils \
+        zlib1g-dev && \
+    rm -rf /var/lib/apt/lists/*
+
+
+ARG STACK='3.3.1'
+ARG STACK_RELEASE_KEY='C5705533DA4F78D8664B5DC0575159689BEFB442'
+
+RUN set -eux; \
+    cd /tmp; \
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
+    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
+    # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256 \
+    case "$ARCH" in \
+        'aarch64') \
+            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'; \
+            ;; \
+        'x86_64') \
+            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
+    esac; \
+    curl -sSL "$STACK_URL" -o stack.tar.gz; \
+    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
+    \
+    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
+    GNUPGHOME="$(mktemp -d)"; \
+    export GNUPGHOME; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
+    gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
+    gpgconf --kill all; \
+    \
+    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
+    stack config set system-ghc --global true; \
+    stack config set install-ghc --global false; \
+    \
+    rm -rf /tmp/*; \
+    \
+    stack --version;
+
+ARG CABAL_INSTALL='3.16.1.0'
+ARG CABAL_INSTALL_RELEASE_KEY='1E07C9A1A3088BAD47F74A3E227EE1942B0BDB95'
+
+RUN set -eux; \
+    cd /tmp; \
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
+    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb11.tar.xz"; \
+    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"; \
+    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
+    # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS \
+    case "$ARCH" in \
+        'aarch64') \
+            CABAL_INSTALL_SHA256='6c5b74781d64266fa060099502d33b1f8297f269a5f71eda871b7db7fb3bf8e4'; \
+            ;; \
+        'x86_64') \
+            CABAL_INSTALL_SHA256='0af41eac80718dc4396340cffa2dbf525e777ec3e877f689718a9ef5aedcb6ab'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
+    esac; \
+    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz; \
+    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check; \
+    \
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"; \
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"; \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"; \
+    gpg --batch --verify SHA256SUMS.sig SHA256SUMS; \
+    # confirm we are verifying SHA256SUMS that matches the release + sha256 \
+    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS; \
+    gpgconf --kill all; \
+    \
+    tar -xf cabal-install.tar.gz -C /usr/local/bin; \
+    \
+    rm -rf /tmp/*; \
+    \
+    cabal --version
+
+ARG GHC='9.14.1'
+ARG GHC_RELEASE_KEY='88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4'
+
+RUN set -eux; \
+    cd /tmp; \
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb11-linux.tar.xz"; \
+    # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS \
+    case "$ARCH" in \
+        'aarch64') \
+            GHC_SHA256='526c352cceddbf6c580e17ade7e782e3b21b4182d328b2d454c9f13ca7c08992'; \
+            GHC_URL='https://downloads.haskell.org/~ghc/9.14.1/ghc-9.14.1-aarch64-deb10-linux.tar.xz'; \
+            ;; \
+        'x86_64') \
+            GHC_SHA256='98f42ba5b44e50d680434b9d3c7ad51b257678899cf7f806a0c85cf63b6d1095'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
+    esac; \
+    curl -sSL "$GHC_URL" -o ghc.tar.xz; \
+    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check; \
+    \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"; \
+    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz; \
+    gpgconf --kill all; \
+    \
+    tar xf ghc.tar.xz; \
+    cd "ghc-$GHC-$ARCH-unknown-linux"; \
+    ./configure --prefix "/opt/ghc/$GHC"; \
+    make install; \
+    \
+    rm -rf /tmp/*; \
+    \
+    "/opt/ghc/$GHC/bin/ghc" --version
+
+ENV PATH=/root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
+
+CMD ["ghci"]
diff --git a/9.14/slim-bookworm.yaml b/9.14/slim-bookworm.yaml
@@ -0,0 +1,16 @@
+---
+distro:
+  codename: 'bookworm'
+  abbr: 'deb12'
+  image: 'debian:bookworm-slim'
+ghc:
+  version: "9.14.1"
+  release_key: "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4"
+  sha256sum:
+    "aarch64": '6aa27a377451851c851eefdd869e8f5a9217b02ce66c6ca9b418b72efee28427'
+    "x86_64": '60f7ab75f28df892729fbaff3a54f58ee3ad7e731929f1b2f3eb0208f73de841'
+cabal_install:
+  sha256sum:
+    "aarch64": '41d8fc43de1c652c00d85799d0273f8b6600bc71603126bc651ca4e3917a1b84'
+    "x86_64": '209987f6abdd1119f6b2674a0d1012857a783464774708cb4f3fd9e156ea7bea'
+_globals: !include '_globals.yaml'