Merge branch 'master' into add-crypto-srp-restore-web-cookiejar

2026-07-10 07:05:42 +02:00 · 2026-07-07 12:56:32 +09:00 · 2026-07-07 12:56:32 +09:00 · 123ed5bf06
commit 123ed5bf06
parent 6657960042 da4bc21262
21 changed files with 3191 additions and 2956 deletions
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@ -9,11 +9,15 @@ permissions:

 jobs:
  build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
    name: Stackage check
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/cache@v4
+      - uses: actions/checkout@v7
+      - name: Install system deps
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgmp-dev
+      - uses: actions/cache@v6
        with:
          path: |
            ~/.stack
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@ -4,8 +4,8 @@ on:
  push:
    branches:
      - nightly
+      - lts24
      - lts23
-      - lts22

 jobs:
  push:
@ -13,15 +13,14 @@ jobs:
    if: github.event_name == 'push'

    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7

      - name: Log into Github registry
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login docker.pkg.github.com -u ${{ github.actor }} --password-stdin
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

      - name: Build image
        run: |
-          IMAGE_ID=docker.pkg.github.com/${{ github.repository }}/build:${GITHUB_REF#refs/heads/}
-          #IMAGE_ID=${{ github.repository }}:${GITHUB_REF#refs/heads/}
+          IMAGE_ID=ghcr.io/${{ github.repository }}/build:${GITHUB_REF#refs/heads/}
          docker build . -f Dockerfile --tag $IMAGE_ID
          docker push $IMAGE_ID
          echo Pushed new build image $IMAGE_ID
--- a/CURATORS.md
+++ b/CURATORS.md
@ -19,16 +19,16 @@ process works:
 * [build-constraints.yaml](https://github.com/commercialhaskell/stackage/blob/master/build-constraints.yaml) specifies packages to be included in Stackage
 * [curator](https://github.com/commercialhaskell/curator) combines build-constraints.yaml with the current state of Hackage to create a build plan for a Stackage Nightly
 * `curator` can check that build plan to ensure all version bounds are consistent
-    * The [Travis job](https://github.com/commercialhaskell/stackage/blob/master/.travis.yml) performs these two steps to provide immediate feedback on pull requests
-* Docker builds [builds](https://github.com/commercialhaskell/stackage/actions/workflows/image.yml)
-* The stackage-build server (described below) is able to run automated builds using the [build.sh script](https://github.com/commercialhaskell/stackage/blob/master/automated/build.sh)
+    * On pull requests, the GitHub action [performs these two steps](https://github.com/commercialhaskell/stackage/blob/master/etc/check.sh) to provide immediate feedback on pull requests
+* Docker [builds](https://github.com/commercialhaskell/stackage/actions/workflows/image.yml)
+* The stackage-build server (described below) is able to run automated builds using the [build.sh script](https://github.com/commercialhaskell/stackage/blob/master/automated/build.sh). Note it is wrapped by `run-night.sh` and `run-lts.sh`.
 * When a new (nightly or LTS) build is completed, it is uploaded to [stackage-snapshots](https://github.com/commercialhaskell/stackage-snapshots)
 * Once a week, we run an LTS minor bump. Instead of using build-constraints.yaml, that job takes the previous LTS release, turns it into `^>=` constraints, and then bumps the version numbers to the latest on Hackage, in accordance with the generated constraint.
-* Cutting a new LTS major release is essentially just a Stackage Nightly that gets rebuilt and uploaded as an LTS
+* Cutting a new LTS major release is essentially just a Stackage Nightly that gets rebuilt using lts-haskell with constraints setup with etc/lts-constraints.

 ## Pull requests

-The typical story on pull requests is: If Travis accepts it and the
+The typical story on pull requests is: If the checks pass and the
 author only added packages under his/her own name, merge it.  If the
 build later fails (see [Adding Debian packages]), then block the
 package until it's fixed.
@ -39,16 +39,15 @@ If benchmarks, haddocks, or test suites fails at this point we
 typically also block the package until these issues are fixed. This in
 order to add packages with a clean slate.

-Optionally we can check if packdeps says the package is up to date.
-Visit http://packdeps.haskellers.com/feed?needle=<package-name>
+Optionally we can check what [packdeps](https://hackage.haskell.org/package/packdeps) and [hackage-revdeps](https://hackage.haskell.org/package/hackage-revdeps) say about the package.

 Builds may fail because of unrelated bounds changes. If this happens,
 first add any version bounds to get master into a passing state (see
-"Fixing bounds issues"), then re-run the travis build.
+"Fixing bounds issues").

-A common issue is that authors submit newly uploaded packages, it can
-take up to an hour before this has synced across the stack
-infrastructure. You can usually compare the versions of the package in
+A common issue is that authors submit newly uploaded packages. It can
+take up to an hour before the package has synced from Hackage across the
+Stackage infrastructure. You can usually compare the versions of the package in
 https://github.com/commercialhaskell/all-cabal-metadata/tree/master/packages/
 to what's on hackage to see if this is the case. Wait an hour and
 re-run the pull request.
@ -174,7 +173,7 @@ issue.

 If a package needs to be disabled due to build failures: Add a `< 0`
 bound to the package to exclude it, and add a comment stating why it
-was disabled: `- swagger < 0 # compile failure againts aeson 1.0`
+was disabled: `- swagger < 0 # compile failure against aeson 1.0`

 If a package needs to be disabled due to bounds issues, see the "Large
 scale enabling/disabling of packages" section below.
@ -207,8 +206,10 @@ If a new package fails to build because of missing system libraries we often ask


 ### Upgrading GHC version
-The nightly branch is used for nightlies. For LTSes, we use the ltsX branch,
-where X is the major version number (e.g., lts20 for lts-20.\*).)
+Branches are only used for the container build image:
+
+- The nightly branch is used for the nightly build image.
+- For LTSes, we use the ltsX branch, where X is the major version number (e.g., lts20 for lts-20.\*).)

 Note that when starting a new LTS major release, you'll need to modify `.github/workflows/image.yml` to add a new lts branch.

@ -217,7 +218,7 @@ file](https://github.com/commercialhaskell/stackage-content/blob/master/stack/gl
 is updated with information on the latest GHC release by cloning that
 repo and running `./update-global-hints.hs ghc-X.Y.Z`.

-If enountering an error like the following, this means that the [Stack metadata](https://github.com/commercialhaskell/stackage-content)
+If encountering an error like the following, this means that the [Stack metadata](https://github.com/commercialhaskell/stackage-content)
 has not yet been updated, so wait some time until this happens:

 ```
@ -226,33 +227,34 @@ Supported versions: ...
 update-global-hints.hs: Received ExitFailure 1 when running
 ```

-Also required to build an LTS minor bump with a ghc version change: modify <https://github.com/commercialhaskell/lts-haskell/tree/master/build-constraints> and update the ghc-version.  Then run `automated/build.sh lts-$THIS_LTS_MINOR_BUMP` to build the LTS.
+Also required to build an LTS minor bump with a ghc version change: modify <https://github.com/commercialhaskell/lts-haskell/tree/master/build-constraints> and update the ghc-version.  Then run `automated/run-lts.sh lts-$THIS_LTS_MINOR_BUMP` to build the LTS.

-### Getting the new image to the build server
-Once a new Docker image is available, you'll need to pull it onto the stackage-build server (see
-below). Instead of pulling an unbounded number of images, I typically just
-delete all of the old images and let the new ones get downloaded:
+### Docker image management
+The latest image is pulled automatically.
+
+If diskspace is tight, one can delete all of the old images and
+let the new ones get downloaded:

 ```
 docker rm $(docker ps -a -q)
 docker rmi $(docker images -q)
 ```

-but `docker pull ghcr.io/commercialhaskell/stackage/build:nightly` can also be run instead just to update the nightly image say.
+To pull the nightly image manually run `docker pull ghcr.io/commercialhaskell/stackage/build:nightly`.

-For a new GHC version you should also delete the ~~cache~~ .stack-work snapshot install directories on the stackage-build server to
-~~force all packages to be rebuilt~~ clear up some space. See: [issue#746](https://github.com/commercialhaskell/stackage/issues/746). Eg:
+(For a new GHC version you can also delete the .stack-work snapshot install directories on the stackage-build server to clear up some space. See: [issue#746](https://github.com/commercialhaskell/stackage/issues/746). Eg:

 ```
 # for example
-SNAP_SERIES=nightly # or lts16
-OLD_GHCVER=8.10.1
+SNAP_SERIES=nightly # or ltsXX
+OLD_GHCVER=9.10.2
 rm -r work/$SNAP_SERIES/unpack-dir/.stack-work/install/x86_64-linux-tinfo6/*/$OLD_GHCVER/
 ```
-This should also be done when moving the Nightly docker image to a new version of Ubuntu.

-If you're impatient and would like to build the Docker image on the
-build server instead of waiting for Docker Hub, you can run the
+
+When moving to a new version of Ubuntu: all the packages should be rebuilt from scratch: therefore normally only change Ubuntu version at the same time as doing a ghc bump.
+
+In an emergency the Docker image can be built on the build server, by the
 following command (replacing `BRANCH=nightly` if the image for a different branch is desired):

 ```
@ -262,16 +264,16 @@ DIR=$(mktemp -d)
  && git clone https://github.com/commercialhaskell/stackage \
  && cd stackage \
  && git checkout $BRANCH \
-  && docker build --tag commercialhaskell/stackage:$BRANCH .)
+  && docker build --tag commercialhaskell/stackage/build:$BRANCH .)
 rm -rf $DIR
 ```

-Note that we do a clean clone of the `stackage` repo instead of using
+(Note that we do a clean clone of the `stackage` repo instead of using
 the existing checkout because of how `docker build` works: it will
 send the entire local directory contents as context to the Docker
 daemon, which in the case of the build tree is a _lot_ of content. (We
 can discuss the wisdom&mdash;or lack thereof&mdash;of Docker's
-approach separately.)
+approach separately.))

 ## stackage-build server

@ -294,10 +296,10 @@ we're just not there yet.
 /var/stackage/stackage/automated/run-nightly.sh

 # Run an LTS minor bump
-/var/stackage/stackage/automated/build.sh lts-15.1
+/var/stackage/stackage/automated/run-lts.sh lts-15.1

 # Run an LTS major bump
-/var/stackage/stackage/automated/build.sh lts-16.0
+/var/stackage/stackage/automated/run-lts.sh lts-16.0
 ```

 Recommended: run these from inside a `tmux` session. If you get version bound
@ -307,7 +309,9 @@ info above).
 ### Building LTS minor releases
 Before running the build, please make sure that the Dockerfile in `automated/dockerfiles/lts-X.Y` is up to date, where X is the major version that you're building and Y is the latest minor version of X for which a Dockerfile exists.
  * If any changes need to be made, (eg, new GHC version), copy `automated/lts-X.Y/Dockerfile` to `automated/lts-X.Z/Dockerfile`, where Z is the minor version you're building, and include the new changes.
-  * If you are building the first release of a new LTS major version, create a new `lts-X.0/Dockerfile` based on the previous LTS's, and adjust the variables at the top to match the requirements of the snapshot.  Ensure that `STACK_VERSION` is the latest release of Stack, and `BOOTSTRAP_COMMIT` is the commit ID of this repo containing the version of the `docker/*.sh` used to build the snapshot.  Also ensure the FROM image's Ubuntu version matches that used in the [root Dockerfile](Dockerfile) used to build this snapshot.
+  * If you are building the first release of a new LTS major version:
+    * create a new `build-constraints/ltsX-build-constraints.yaml` in lts-haskell using `stackage/etc/lts-constraints`
+    * create a new `lts-X.0/Dockerfile` based on the previous LTS's, and adjust the variables at the top to match the requirements of the snapshot.  Ensure that `STACK_VERSION` is the latest release of Stack, and `BOOTSTRAP_COMMIT` is the commit ID of this repo containing the version of the `docker/*.sh` used to build the snapshot.  Also ensure the FROM image's Ubuntu version matches that used in the [root Dockerfile](Dockerfile) used to build this snapshot.

 For an LTS minor bump, you'll typically want to update <https://github.com/commercialhaskell/lts-haskell/tree/master/build-constraints> as needed:

@ -315,7 +319,7 @@ For an LTS minor bump, you'll typically want to update <https://github.com/comme
 * add new packages
 * enable/disable test, benchmark, haddock when needed

-Then run `./build.sh lts-X.Z` to generate an updated snapshot.
+Then run `./run-lts.sh lts-X.Z` to generate an updated snapshot.

 If a build fails for bounds reasons, see all of the advice above. If the code
 itself doesn't build, or tests fail, open up an issue and then either put in a
@ -339,22 +343,23 @@ resolve any issues before the next curator shift the coming monday.

 ### Diskspace errors (and website sync debugging)

-* You can detect the problem by running `df`. If you see that `/` is out of space, we have a problem.
-* If you see that `/var/stackage/` is out of space, you can:
-  * run `./etc/diskspace/remove-old-stack-work-libs.hs [nightly|lts-XX]`
-  * If that is insufficient then remove all the old builds under the previous ghc/Cabal version:
-    * `rm -r /var/stackage/stackage/automated/work/[nightly|lts-XX]/unpack-dir/unpacked/*/.stack-work/dist/x86_64-linux/Cabal-X.Y.0.0/`
-
-  optionally:
-  * `rm -r /var/stackage/stackage/automated/work/lts*/unpack-dir/unpacked/`
-  * `rm -r /var/stackage/stackage/automated/work/nightly/unpack-dir/unpacked/`
+* You can check stackage disk usage with `df -h ~`.
+* If you see that stackage `$HOME` is out of space, you can use `stack-clean-old` to clean up (note it defaults to "dry-run" mode):
+  * Enter `nix-shell -p haskellPackages.stack-clean-old` and then:
+    * `cd ~/stackage/automated/work/[nightly|ltsXX]/unpack-dir`
+    * `stack-clean-old list` to show shared `.stack-work/install` usage
+    * `stack-clean-old remove 9.X.Y` to remove its `.stack-work/install` subdir
+    * `cd unpacked`
+    * `stack-clean-old delete-work --subdir --yes` to remove each package's `.stack-work` subdir
+  * If that is still really insufficient then optionally:
+    * `rm -r /var/stackage/stackage/automated/work/[nightly|ltsXX]/unpack-dir/unpacked/`

 ### Wiping the cache

 Sometimes the cache can get corrupted which might manifest as `can't load .so/.DLL`.
-You can wipe the nightly cache and rebuild everything by doing
+As a last resort you can wipe the whole build cache to rebuild everything by doing
 `rm -rf /var/stackage/stackage/automated/nightly`.
-Replace nightly with `lts7` to wipe the LTS 7 cache.
+Replace `nightly` with `lts7` to wipe the LTS 7 cache.

 ### Force a single package rebuild

@ -400,14 +405,14 @@ This can be used to make sure all version bounds are in place, including for
 test suites and benchmarks, to check whether bounds can be lifted, and to get
 [tell-me-when-its-released] notifications.

-`curator` does not build anything, so you wont see any compilation
+`curator` does not build anything, so you won't see any compilation
 errors for builds, tests and benchmarks.

 [tell-me-when-its-released]: https://github.com/commercialhaskell/stackage/blob/master/CURATORS.md#waiting-for-new-releases

 ### Large scale enabling/disabling of packages

-`etc/commenter` is a binary that automates `build-constraints.yaml` workflows.
+`./commenter` is a [tool](https://github.com/bergmark/commenter/) that automates `build-constraints.yaml` workflows.

 #### Setup
 This is currently a rust program, You can install the rust toolchain
@ -434,6 +439,7 @@ Now run:
 ```
 ./check 2>&1 >/dev/null | ./commenter add
 ```
+(or easier just use `commenter add-loop`).

 You will get this output:
 ```
@ -583,19 +589,16 @@ packages compatible with the new GHC release.

 Every 3-6 months, we make a new major release of LTS. The procedure we follow for this is:

-1. Write a blog post on stackage.org announcing the intent to cut a major
-   release. Give an estimated date two weeks in the future from the publication
-   date of the post.
-2. Spread the blog post on social media and mailing lists as much as possible.
-3. Expect maintainers to send significant requests for added packages and
-   relaxed upper bounds. There will likely be some hard decisions to be made
-   regarding relaxing a bound versus keeping more packages. All of these changes
-   occur on master and affect nightly.
-4. Once the estimated date hits, push a new `ltsXX` and wait for the docker image build.
-5. Run the build procedure for the new LTS release.
-6. After the LTS build completes, more aggressively prune upper bounds from
-   `build-constraints.yaml`.
-7. Once both (5) and (6) are done, publish a new blog post on stackage.org
+1. Once Stackage Nightly and its ghc version is considered mature enough and
+   there is newer ghc version that has somewhat stabilized to bring next into
+   nightly
+2. First push a new `ltsXX` branch and wait for the docker image to build.
+3. Add the new ltsXX build-constraints file in lts-haskell,
+   generated from nightly using etc/lts-constraints.
+4. Run the build procedure for the new LTS release.
+5. After the new LTS is pushed, it is time to prune nightly upper bounds from
+   `build-constraints.yaml` and bump nightly to the newer major ghc version.
+6. Once both (5) and (6) are done, publish a new blog post on stackage.org
   announcing the new LTS and Nightly, with links to the change pages on
-   stackage.org. Include a reminder that requests for packages to be added to LTS
-   may be made on commercialhaskell/lts-haskell.
+   stackage.org. Include a reminder that requests for packages to be added
+   to LTS may be made on commercialhaskell/lts-haskell.
--- a/19
+++ b/19
@ -1,19 +1,22 @@
-FROM fpco/pid1:22.04
+FROM ubuntu:24.04

-ENV HOME /home/stackage
-ENV LANG en_US.UTF-8
+ENV HOME=/home/stackage
+ENV LANG=en_US.UTF-8

-ADD docker/01-build-server.sh /tmp/01-build-server.sh
+COPY docker/01-build-server.sh /tmp/01-build-server.sh
 RUN /tmp/01-build-server.sh && rm /tmp/01-build-server.sh

-ADD docker/02-apt-get-install.sh /tmp/02-apt-get-install.sh
+COPY docker/02-apt-get-install.sh /tmp/02-apt-get-install.sh
 RUN /tmp/02-apt-get-install.sh && rm /tmp/02-apt-get-install.sh

-ADD docker/03-custom-install.sh /tmp/03-custom-install.sh
+COPY docker/03-custom-install.sh /tmp/03-custom-install.sh
 RUN /tmp/03-custom-install.sh && rm /tmp/03-custom-install.sh

-ADD docker/04-cleanup.sh /tmp/04-cleanup.sh
+COPY docker/04-cleanup.sh /tmp/04-cleanup.sh
 RUN /tmp/04-cleanup.sh && rm /tmp/04-cleanup.sh

 # Include file path
-ENV CPATH /usr/lib/jvm/java-8-openjdk-amd64/include:/usr/lib/jvm/java-8-openjdk-amd64/include/linux:/usr/lib/llvm-3.7/include
+ENV CPATH=/usr/lib/jvm/java-8-openjdk-amd64/include:/usr/lib/jvm/java-8-openjdk-amd64/include/linux:/usr/lib/llvm-3.7/include
+
+# Download libtorch into mounted work volume (so that artifact is shared on rebuilds)
+ENV LIBTORCH_HOME=/home/curators/work/libtorch
--- a/MAINTAINERS.md
+++ b/MAINTAINERS.md
@ -1,9 +1,11 @@
+*(this file is a bit dated and needs some revisions)*
+
 This project is built around the concept of maintainers taking responsibility for making their packages work with the rest of the stable ecosystem, usually meaning the newest version of all dependencies. This is a social contract, and is not reflected in the codebase in any way.

 The idea behind Stackage is that, if all packages work with the newest versions of dependencies, we avoid dependency hell. Specifically, we aim for:

-* All packages are buildable and testable from Hackage. We recommend [the Stack Travis script](https://docs.haskellstack.org/en/stable/travis_ci/), which ensures a package is not accidentally incomplete.
-* All packages are compatible with the newest versions of all dependencies (You can find restrictive upper bounds by visiting http://packdeps.haskellers.com/feed?needle=PACKAGENAME).
+* All packages are buildable and testable from Hackage. We recommend using CI, which ensures a package is not accidentally incomplete.
+* All packages are compatible with the newest versions of all dependencies (You can check restrictive upper bounds [packdeps](https://hackage.haskell.org/package/packdeps).
 * All packages in a snapshot are compatible with the versions of libraries that ship with the GHC used in the snapshot ([more information on lenient lower bounds](https://tech.fpcomplete.com/blog/2014/05/lenient-lower-bounds)).

 Packages in Stackage are not patched: all package changes occur upstream in Hackage.
@ -44,10 +46,12 @@ of:

 * It won't notify you of restrictive upper bounds in your package if
  Stackage has the same upper bounds. For that reason, we recommend
-  using [Packdeps](http://packdeps.haskellers.com/) (see "Following
-  dependency upgrades" below). You can also run `cabal outdated`.
+  using `cabal outdated` or
+  [Packdeps](https://hackage.haskell.org/package/packdeps)
+  (see "Following dependency upgrades" below).
+
 * If the latest Stackage Nightly is missing some of the latest
-  packages, your build above may succeed whereas the Travis job may
+  packages, your build above may succeed whereas the CI job may
  fail. Again: Packdeps will help you detect this situation.

 ## Github and Notifications
@ -87,14 +91,14 @@ the dependency so that your package remains in nightly. We'll also
 create a github issue pinging you with the bounds issues or give build
 logs showing failures. It's then up to you to modify your package.

-We recommend that you also follow the dependencies of your packages on
-[Packdeps](http://packdeps.haskellers.com/) (typically using the RSS
-feeds) as well as that often gives you notice ahead of stackage
-issues. There are cases where we will not notice a new release of a
-package because of other upper bounds that are in place.
+We recommend that you also follow the dependencies of your packages with
+[Packdeps](https://hackage.haskell.org/package/packdeps)
+as well as that often gives you notice ahead of stackage issues.
+There are cases where we will not notice a new release of a package
+because of other upper bounds that are in place.

 If a package is not updated in time, it may be temporarily removed
-from Stackage by the curator team. We strive to notify you when this
+from Stackage by the curator team. We aim to notify you when this
 happens. If it does you are always welcome to file another pull
 request to add it back.

--- a/README.md
+++ b/README.md
@ -6,27 +6,32 @@ Stable sets of Haskell Packages from Hackage

 _This repository is for package authors and maintainers to get their packages into Stackage._

-If you simply want to use Stackage as an end user, please follow the instructions on [https://www.stackage.org/](https://www.stackage.org).
+If you simply want to use Stackage as an end user, please follow the instructions in the  [stack documentation](https://docs.haskellstack.org/en/stable/) or via <https://www.stackage.org/#about>.

-We strongly recommend using the Haskell [stack](https://github.com/commercialhaskell/stack) tool for doing builds, which
+We highly recommend using the Haskell [stack](https://github.com/commercialhaskell/stack) tool for doing builds, which
 includes built-in Stackage support.

 Add your package
 ----------------
+- To add your package in Stackage Nightly: edit the [build-constraints file](https://github.com/commercialhaskell/stackage/blob/master/build-constraints.yaml) and open a PR.
+- To add you package to Stackage LTS: you need to open a pull request for changing [lts-haskell](https://github.com/commercialhaskell/lts-haskell/tree/master/build-constraints) build-constraints.

 We welcome all packages, provided:

-* The package author/maintainer agrees to the [maintainers agreement](https://github.com/commercialhaskell/stackage/blob/master/MAINTAINERS.md).
-* The package is buildable and testable from Hackage. We recommend [the Stack Travis script](https://docs.haskellstack.org/en/stable/travis_ci/), which ensures a package is not accidentally incomplete.
-* The package is compatible with the newest versions of all dependencies (You can find restrictive upper bounds by visiting http://packdeps.haskellers.com/feed?needle=PACKAGENAME).
-* The package is compatible with the versions of libraries that ship with GHC ([more information on lenient lower bounds](https://tech.fpcomplete.com/blog/2014/05/lenient-lower-bounds)).
+* The package from Hackage builds in current Stackage snapshots
+  * Stackage only uses pristine sources from Hackage (no patches of packages are allowed, including bounds, other than Hackage revisions)
+  * In particular the package MUST be compatible with the versions of core libraries that ship with GHC ([more information on lenient lower bounds](https://tech.fpcomplete.com/blog/2014/05/lenient-lower-bounds)).
+* The package's tests and benchmark code SHOULD also build: if possible the testsuite SHOULD also pass.
+  * We recommend setting up CI, which ensures a package is not accidentally incomplete, etc.
+* The package should stay compatible with the newest versions of its dependencies.
+* The package author/maintainer aims to follow [MAINTAINERS.md](https://github.com/commercialhaskell/stackage/blob/master/MAINTAINERS.md).

-Full details on how to add and test a package can be found in the [maintainers agreement](https://github.com/commercialhaskell/stackage/blob/master/MAINTAINERS.md#adding-a-package).
+Full details on how to add and test a package can be found in the [here](https://github.com/commercialhaskell/stackage/blob/master/MAINTAINERS.md#adding-a-package).

 __NOTE__: There is an approximate 30 minute delay between a package uploading
 to Hackage and being available to the Github workflow action to check upper
 bounds. If a pull request is marked as failed due to using an older version,
-please close and reopen the PR to retrigger a Travis build.
+please close and reopen the PR to retrigger a CI build.

 Other repos
 -----------
@ -35,13 +40,13 @@ The Stackage project consists of multiple repositories. This repository
 contains the metadata on packages to be included in future builds and some
 project information. In addition, we have the following repositories:

-* [stackage-server](https://github.com/fpco/stackage-server) [![Base image](https://github.com/fpco/stackage-server/actions/workflows/base.yml/badge.svg)](https://github.com/fpco/stackage-server/actions/workflows/base.yml)
+* [stackage-server](https://github.com/commercialhaskell/stackage-server)
 * [curator](https://github.com/commercialhaskell/curator) ![Build Status](https://github.com/commercialhaskell/curator/workflows/Runtime%20image/badge.svg)
 * [lts-haskell](https://github.com/commercialhaskell/lts-haskell)
 * [stackage-snapshots](https://github.com/commercialhaskell/stackage-snapshots/)

 Curious how it all fits together? See the [Stackage data
-flow](https://github.com/commercialhaskell/stackage/blob/master/DATA-FLOW.md).
+flow](https://github.com/commercialhaskell/stackage/blob/master/DATA-FLOW.md) (slightly outdated)

 Build the package set
 ---------------------
@ -68,6 +73,11 @@ The following describes at a high level the series of steps for processing
 6. Verify that the build plan can be compiled
 7. Perform the build

+__NOTE__: Packages in Nightly that are holding newer versions of other
+packages back for an extended period of time will eventually get disabled,
+depending on the impact but at latest usually right after the branching of the
+next major LTS version.
+
 ### LTS

 1. Load up most recent build plan
--- a/automated/build.sh
+++ b/automated/build.sh
@ -1,19 +1,21 @@
 #!/usr/bin/env bash

-# shellcheck disable=SC2086,SC1091
+# shellcheck disable=SC2086,SC1091,SC2001
 # SC2086: We actually want some word splitting to happen
 # SC1091: Secrets are sourced from a file that doesn't exist in the tree.
+# SC2001: Pattern substitution is too hard to use; don't recommend it.

+LANG=C date
 set -eu +x -o pipefail

-ROOT=$(cd $(dirname $0) ; pwd)
+ROOT=$(cd "$(dirname $0)" ; pwd)
 TARGET=$1

 # Home on the container
-: ${C_HOME:=$HOME}
+: "${C_HOME:=$HOME}"

 # User to run as on the container
-: ${USERID:=$(id -u)}
+: "${USERID:=$(id -u)}"

 source work/aws.sh

@ -57,7 +59,7 @@ cat >$GITCONFIG <<EOF
 	name = Stackage Build host
 EOF

-HACKAGE_CREDS=$ROOT/work/hackage-creds
+HACKAGE_TOKEN=$ROOT/work/hackage-distro-token

 function require_400_file {
    if [ ! -f "$1" ]
@ -70,39 +72,29 @@ function require_400_file {
 }

 require_400_file "$SSH_DIR/id_rsa"
-require_400_file "$HACKAGE_CREDS"
+require_400_file "$HACKAGE_TOKEN"

-mkdir -p $ROOT/work/bin
-BINDIR=$(cd $ROOT/work/bin ; pwd)
+mkdir -p $WORKDIR/bin
+BINDIR=$(cd $WORKDIR/bin ; pwd)
 (
 cd $BINDIR
-rm -f curator stack *.bz2
+rm -f curator stack -- *.bz2

-if [ $SHORTNAME = "lts" ]; then
-    # drop for lts24 at least if not before
-    curl -L "https://github.com/commercialhaskell/curator/releases/download/commit-54cc5a95a7e29550e0fd7a48b24ddad105d223b2/curator.bz2" | bunzip2 > curator
-else
-    # needed for ghc-9.10
-    curl -L "https://github.com/commercialhaskell/curator/releases/download/commit-6689440033b12182c0853bdd23880a84849eb6b2/curator.bz2" | bunzip2 > curator
-fi
+curl -L "https://github.com/commercialhaskell/curator/releases/download/commit-57858287bcb07f57810b7967deb52f6033fbe322/curator.bz2" | bunzip2 > curator
 chmod +x curator

-if [ $SHORTNAME = "lts" ]; then
-    STACK_VERSION=3.1.1
-else
-    STACK_VERSION=3.3.1
-fi
+STACK_VERSION=3.9.3
 # rc url
 #curl -L https://github.com/commercialhaskell/stack/releases/download/rc%2Fv${STACK_VERSION}/stack-${STACK_VERSION}-linux-x86_64-bin > stack
 curl -L https://github.com/commercialhaskell/stack/releases/download/v${STACK_VERSION}/stack-${STACK_VERSION}-linux-x86_64-bin > stack
 chmod +x stack

-docker run --rm -v $(pwd)/curator:/curator -v $(pwd)/stack:/stack $IMAGE /bin/bash -c "
-    echo -n 'curator version: '
-    /curator --version
-    echo -n 'stack version: '
-    /stack --version
-    "
+# docker run --rm -v "$(pwd)"/curator:/curator -v "$(pwd)"/stack:/stack $IMAGE /bin/bash -c "
+#     echo -n 'curator version: '
+#     /curator --version
+#     echo -n 'stack version: '
+#     /stack --version
+#     "
 )

 # We share pantry directory between snapshots while the other content in .stack
@ -111,9 +103,7 @@ docker run --rm -v $(pwd)/curator:/curator -v $(pwd)/stack:/stack $IMAGE /bin/ba
 ARGS_COMMON="--rm -v $WORKDIR:$C_HOME/work -w $C_HOME/work -v $BINDIR/curator:/usr/bin/curator:ro -v /etc/passwd:/etc/passwd:ro -v /etc/group:/etc/group:ro -v $BINDIR/stack:/usr/bin/stack:ro -v $STACK_DIR:$C_HOME/.stack -v $PANTRY_DIR:$C_HOME/.stack/pantry -v $HOME/.aws/config:$C_HOME/.aws/config:ro"
 ARGS_PREBUILD="$ARGS_COMMON -u $USERID -e HOME=$C_HOME -v $DOT_STACKAGE_DIR:$C_HOME/.stackage"
 ARGS_BUILD="$ARGS_COMMON"
-# instance-data is an undocumented feature of S3 used by amazonka,
-# see https://github.com/brendanhay/amazonka/issues/271
-ARGS_UPLOAD="$ARGS_PREBUILD -v $HACKAGE_CREDS:/hackage-creds:ro -v $SSH_DIR:$C_HOME/.ssh:ro -v $GITCONFIG:$C_HOME/.gitconfig:ro -e AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY ${AWS_ENDPOINT_URL:+-e AWS_ENDPOINT_URL=$AWS_ENDPOINT_URL} -v $DOT_STACKAGE_DIR:/dot-stackage"
+ARGS_UPLOAD="$ARGS_PREBUILD -v $HACKAGE_TOKEN:/hackage-distro-token:ro -v $SSH_DIR:$C_HOME/.ssh:ro -v $GITCONFIG:$C_HOME/.gitconfig:ro -e AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY ${AWS_ENDPOINT_URL:+-e AWS_ENDPOINT_URL=$AWS_ENDPOINT_URL} -v $DOT_STACKAGE_DIR:/dot-stackage"

 # for debugging etc
 if [ -n "${2:-}" ]
@ -160,18 +150,13 @@ case $SHORTNAME in
    nightly) JOBS=16 ;;
 esac

-if [ -e "$SHORTNAME-build.log" ]
-then
-    cp -p $SHORTNAME-build.log $SHORTNAME-build.log-previous
-fi
-
 # Now do the actual build. We need to first set the owner of the home directory
 # correctly, so we run the command as root, change owner, and then use sudo to
 # switch back to the current user
-docker run $ARGS_BUILD $IMAGE nice -n 15 /bin/bash -c "
+docker run -t $ARGS_BUILD $IMAGE nice -n 15 /bin/bash -c "
    chown $USER $HOME
    exec sudo -E -u $USER env \"HOME=$HOME\" \"PATH=\$PATH\" curator build --jobs $JOBS
-    " 2>&1 | tee $SHORTNAME-build.log
+    "

 # Make sure we actually need this snapshot. We used to perform this check
 # exclusively before building. Now we perform it after as well for the case of
@ -184,17 +169,22 @@ docker run $ARGS_UPLOAD $IMAGE curator check-target-available --target $TARGET
 #
 # * Upload the docs to S3
 # * Upload the new snapshot .yaml file to the appropriate Github repo, also upload its constraints
-date
+LANG=C date
 docker run $ARGS_UPLOAD -e "CURATOR_AWS_OPTIONS=--only-show-errors" $IMAGE /bin/bash -c "
    set -e
    ulimit -n hard
    curator upload-docs --target $TARGET ${DOCS_BUCKET:+--bucket $DOCS_BUCKET}
    curator upload-github --target $TARGET
    "
-date
+LANG=C date

-# was fixed in https://github.com/commercialhaskell/curator/pull/24
-docker run $ARGS_UPLOAD $IMAGE curator hackage-distro --target $TARGET
+case $TARGET in
+    lts-22.*) ;;
+    lts-23.*) ;;
+    *)
+        docker run $ARGS_UPLOAD $IMAGE curator hackage-distro --target $TARGET
+        ;;
+esac

 # Build and push docker image fpco/stack-build & fpco/stack-build-small for current release

@ -206,4 +196,4 @@ then
 fi

 echo -n "Completed at "
-date
+LANG=C date
--- a/automated/dockerfiles/README.md
+++ b/automated/dockerfiles/README.md
@ -1,9 +1,7 @@
 dockerfiles/stack-build
 =======================

-Build [fpco/stack-build](https://hub.docker.com/r/fpco/stack-build/) Docker
-images. This script and its Dockerfiles are used for building images for LTS >=
-8.0.
+Build [ghcr.io/commercialhaskell/stackage/build](https://github.com/commercialhaskell/stackage/pkgs/container/stackage%2Fbuild) Docker images.

 Usage
 -----
--- a/automated/dockerfiles/build.sh
+++ b/automated/dockerfiles/build.sh
@ -69,7 +69,7 @@ while [[ $# -gt 0 ]]; do
            ;;
        *)
            if [[ -n "$LTS_SLUG_ARG" ]]; then
-                usage "Cannot specify multiple snaphots: $1"
+                usage "Cannot specify multiple snapshots: $1"
            fi
            LTS_SLUG_ARG="$1"
            shift
--- a/automated/dockerfiles/lts-22.44/Dockerfile
+++ b/automated/dockerfiles/lts-22.44/Dockerfile
@ -0,0 +1,90 @@
+FROM ubuntu:22.04
+
+LABEL maintainer="manny@fpcomplete.com"
+
+ARG GHC_VERSION=9.6.7
+ARG LTS_SLUG=lts-22.44
+ARG PID1_VERSION=0.1.2.0
+ARG STACK_VERSION=2.15.7
+ARG CUDA_VERSION=10.0
+ARG JVM_PATH=/usr/lib/jvm/java-8-openjdk-amd64
+ARG LLVM_PATH=/usr/lib/llvm-9
+ARG BOOTSTRAP_COMMIT=00440d8b56167281e30dd9d292f2a223adeb2a34
+
+ARG DEBIAN_FRONTEND=noninteractive
+ARG VARIANT=build
+ARG STACK_ROOT=/home/stackage/.stack
+
+#
+# Set encoding to UTF-8 and PATH to find GHC and cabal/stack-installed binaries.
+#
+
+ENV LANG=C.UTF-8 \
+    LC_ALL=C.UTF-8 \
+    PATH=/root/.local/bin:/usr/local/cuda-$CUDA_VERSION/bin:$STACK_ROOT/programs/x86_64-linux/ghc-$GHC_VERSION/bin:$PATH \
+    CUDA_PATH=/usr/local/cuda-$CUDA_VERSION \
+    CPATH=$JVM_PATH/include:$JVM_PATH/include/linux:$LLVM_PATH/include
+
+#
+# Install pre-requisites
+#
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        wget netbase ca-certificates g++ gcc libc6-dev libffi-dev libgmp-dev \
+        make xz-utils zlib1g-dev git gnupg libtinfo-dev jq && \
+    rm -rf /var/lib/apt/lists/*
+
+#
+# Use Stackage's docker/*.sh scripts to install system libraries and
+# tools required to build any Stackage package.
+# Re-installs 'stack' *after* running docker/*.sh since that may have
+# installed a different version.
+# In the case of 'small' image, just install Stack and GHC.
+#
+
+RUN if [ "$VARIANT" != "small" ]; then \
+        wget -qO- https://raw.githubusercontent.com/commercialhaskell/stackage/$BOOTSTRAP_COMMIT/docker/01-build-server.sh https://raw.githubusercontent.com/commercialhaskell/stackage/$BOOTSTRAP_COMMIT/docker/02-apt-get-install.sh https://raw.githubusercontent.com/commercialhaskell/stackage/$BOOTSTRAP_COMMIT/docker/03-custom-install.sh https://raw.githubusercontent.com/commercialhaskell/stackage/$BOOTSTRAP_COMMIT/docker/04-cleanup.sh | sed "s/^GHCVER=9.0.1$/GHCVER=$GHC_VERSION/" | GHCVER=$GHC_VERSION bash; \
+    fi && \
+    wget -qO- https://github.com/commercialhaskell/stack/releases/download/v$STACK_VERSION/stack-$STACK_VERSION-linux-x86_64.tar.gz | tar xz --wildcards --strip-components=1 -C /usr/bin '*/stack' && \
+    if [ "$VARIANT" = "small" ]; then \
+        stack setup --resolver ghc-$GHC_VERSION; \
+    fi && \
+    rm -rf /var/lib/apt/lists/* && \
+    cd $STACK_ROOT && \
+    find . -type f -not -path "./programs/x86_64-linux/ghc-$GHC_VERSION/*" -exec rm '{}' \; && \
+    find . -type d -print0 |sort -rz |xargs -0 rmdir 2>/dev/null || true
+
+#
+# Configure Stack to use the GHC installed in the Docker image rather than installing its own
+#
+
+RUN mkdir /etc/stack/ && \
+    echo "system-ghc: true" >/etc/stack/config.yaml
+
+#
+# Use 'stack' to install basic Haskell tools like alex, happy, and cpphs. We
+# remove most of the STACK_ROOT afterward to save space, but keep the 'share'
+# files that some of these tools require.
+#
+
+RUN stack --resolver=$LTS_SLUG --local-bin-path=/usr/bin install \
+        happy alex cpphs gtk2hs-buildtools hscolour hlint hindent && \
+    cd $STACK_ROOT && \
+    find . -type f -not -path './snapshots/*/share/*' -and -not -path "./programs/x86_64-linux/ghc-$GHC_VERSION/*" -exec rm '{}' \; && \
+    find . -type d -print0 |sort -rz |xargs -0 rmdir 2>/dev/null || true
+
+#
+# Install 'pid1' init daemon
+#
+
+RUN wget -O- "https://github.com/fpco/pid1/releases/download/v$PID1_VERSION/pid1-$PID1_VERSION-linux-x86_64.tar.gz" | tar xzf - -C /usr/local && \
+    chown root:root /usr/local/sbin && \
+    chown root:root /usr/local/sbin/pid1
+
+#
+# Set up pid1 entrypoint and default command
+#
+
+ENTRYPOINT ["/usr/local/sbin/pid1"]
+CMD ["bash"]
--- a/automated/dockerfiles/lts-24.0/Dockerfile
+++ b/automated/dockerfiles/lts-24.0/Dockerfile
@ -0,0 +1,90 @@
+FROM ubuntu:24.04
+
+LABEL maintainer="manny@fpcomplete.com"
+
+ARG GHC_VERSION=9.10.2
+ARG LTS_SLUG=lts-24.0
+ARG PID1_VERSION=0.1.2.0
+ARG STACK_VERSION=3.7.1
+ARG CUDA_VERSION=10.0
+ARG JVM_PATH=/usr/lib/jvm/java-8-openjdk-amd64
+ARG LLVM_PATH=/usr/lib/llvm-9
+ARG BOOTSTRAP_COMMIT=150da98401bd014e9ed248a035d8af12de614f1c
+
+ARG DEBIAN_FRONTEND=noninteractive
+ARG VARIANT=build
+ARG STACK_ROOT=/home/stackage/.stack
+
+#
+# Set encoding to UTF-8 and PATH to find GHC and cabal/stack-installed binaries.
+#
+
+ENV LANG=C.UTF-8 \
+    LC_ALL=C.UTF-8 \
+    PATH=/root/.local/bin:/usr/local/cuda-$CUDA_VERSION/bin:$STACK_ROOT/programs/x86_64-linux/ghc-$GHC_VERSION/bin:$PATH \
+    CUDA_PATH=/usr/local/cuda-$CUDA_VERSION \
+    CPATH=$JVM_PATH/include:$JVM_PATH/include/linux:$LLVM_PATH/include
+
+#
+# Install pre-requisites
+#
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        wget netbase ca-certificates g++ gcc libc6-dev libffi-dev libgmp-dev \
+        make xz-utils zlib1g-dev git gnupg libtinfo-dev jq && \
+    rm -rf /var/lib/apt/lists/*
+
+#
+# Use Stackage's docker/*.sh scripts to install system libraries and
+# tools required to build any Stackage package.
+# Re-installs 'stack' *after* running docker/*.sh since that may have
+# installed a different version.
+# In the case of 'small' image, just install Stack and GHC.
+#
+
+RUN if [ "$VARIANT" != "small" ]; then \
+        wget -qO- https://raw.githubusercontent.com/commercialhaskell/stackage/$BOOTSTRAP_COMMIT/docker/01-build-server.sh https://raw.githubusercontent.com/commercialhaskell/stackage/$BOOTSTRAP_COMMIT/docker/02-apt-get-install.sh https://raw.githubusercontent.com/commercialhaskell/stackage/$BOOTSTRAP_COMMIT/docker/03-custom-install.sh https://raw.githubusercontent.com/commercialhaskell/stackage/$BOOTSTRAP_COMMIT/docker/04-cleanup.sh | sed "s/^GHCVER=9.0.1$/GHCVER=$GHC_VERSION/" | GHCVER=$GHC_VERSION bash; \
+    fi && \
+    wget -qO- https://github.com/commercialhaskell/stack/releases/download/v$STACK_VERSION/stack-$STACK_VERSION-linux-x86_64.tar.gz | tar xz --wildcards --strip-components=1 -C /usr/bin '*/stack' && \
+    if [ "$VARIANT" = "small" ]; then \
+        stack setup --resolver ghc-$GHC_VERSION; \
+    fi && \
+    rm -rf /var/lib/apt/lists/* && \
+    cd $STACK_ROOT && \
+    find . -type f -not -path "./programs/x86_64-linux/ghc*-$GHC_VERSION/*" -exec rm '{}' \; && \
+    find . -type d -print0 |sort -rz |xargs -0 rmdir 2>/dev/null || true
+
+#
+# Configure Stack to use the GHC installed in the Docker image rather than installing its own
+#
+
+RUN mkdir /etc/stack/ && \
+    echo "system-ghc: true" >/etc/stack/config.yaml
+
+#
+# Use 'stack' to install basic Haskell tools like alex, happy, and cpphs. We
+# remove most of the STACK_ROOT afterward to save space, but keep the 'share'
+# files that some of these tools require.
+#
+
+RUN stack --resolver=$LTS_SLUG --local-bin-path=/usr/bin install \
+        happy alex cpphs gtk2hs-buildtools hscolour hlint hindent && \
+    cd $STACK_ROOT && \
+    find . -type f -not -path './snapshots/*/share/*' -and -not -path "./programs/x86_64-linux/ghc-$GHC_VERSION/*" -exec rm '{}' \; && \
+    find . -type d -print0 |sort -rz |xargs -0 rmdir 2>/dev/null || true
+
+#
+# Install 'pid1' init daemon
+#
+
+RUN wget -O- "https://github.com/fpco/pid1/releases/download/v$PID1_VERSION/pid1-$PID1_VERSION-linux-x86_64.tar.gz" | tar xzf - -C /usr/local && \
+    chown root:root /usr/local/sbin && \
+    chown root:root /usr/local/sbin/pid1
+
+#
+# Set up pid1 entrypoint and default command
+#
+
+ENTRYPOINT ["/usr/local/sbin/pid1"]
+CMD ["bash"]
--- a/automated/dockerfiles/lts-24.12/Dockerfile
+++ b/automated/dockerfiles/lts-24.12/Dockerfile
@ -0,0 +1,91 @@
+FROM ubuntu:24.04
+
+LABEL maintainer="manny@fpcomplete.com"
+
+ARG GHC_VERSION=9.10.3
+ARG LTS_SLUG=lts-24.12
+# update to 0.1.3.1 for lts-25
+ARG PID1_VERSION=0.1.2.0
+# update to 3.9.1 for lts-25
+ARG STACK_VERSION=3.7.1
+ARG CUDA_VERSION=10.0
+ARG JVM_PATH=/usr/lib/jvm/java-8-openjdk-amd64
+ARG LLVM_PATH=/usr/lib/llvm-9
+
+ARG DEBIAN_FRONTEND=noninteractive
+ARG VARIANT=build
+ARG STACK_ROOT=/home/stackage/.stack
+
+#
+# Set encoding to UTF-8 and PATH to find GHC and cabal/stack-installed binaries.
+#
+
+ENV LANG=C.UTF-8 \
+    LC_ALL=C.UTF-8 \
+    PATH=/root/.local/bin:/usr/local/cuda-$CUDA_VERSION/bin:$STACK_ROOT/programs/x86_64-linux/ghc-$GHC_VERSION/bin:$PATH \
+    CUDA_PATH=/usr/local/cuda-$CUDA_VERSION \
+    CPATH=$JVM_PATH/include:$JVM_PATH/include/linux:$LLVM_PATH/include
+
+#
+# Install pre-requisites
+#
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        wget netbase ca-certificates g++ gcc libc6-dev libffi-dev libgmp-dev \
+        make xz-utils zlib1g-dev git gnupg libtinfo-dev jq && \
+    rm -rf /var/lib/apt/lists/*
+
+#
+# Use Stackage's docker/*.sh scripts to install system libraries and
+# tools required to build any Stackage package.
+# Re-installs 'stack' *after* running docker/*.sh since that may have
+# installed a different version.
+# In the case of 'small' image, just install Stack and GHC.
+#
+
+RUN if [ "$VARIANT" != "small" ]; then \
+        wget -qO- https://raw.githubusercontent.com/commercialhaskell/stackage/$BOOTSTRAP_COMMIT/docker/01-build-server.sh https://raw.githubusercontent.com/commercialhaskell/stackage/$BOOTSTRAP_COMMIT/docker/02-apt-get-install.sh https://raw.githubusercontent.com/commercialhaskell/stackage/$BOOTSTRAP_COMMIT/docker/03-custom-install.sh https://raw.githubusercontent.com/commercialhaskell/stackage/$BOOTSTRAP_COMMIT/docker/04-cleanup.sh | sed "s/^GHCVER=9.0.1$/GHCVER=$GHC_VERSION/" | GHCVER=$GHC_VERSION bash; \
+    fi && \
+    wget -qO- https://github.com/commercialhaskell/stack/releases/download/v$STACK_VERSION/stack-$STACK_VERSION-linux-x86_64.tar.gz | tar xz --wildcards --strip-components=1 -C /usr/bin '*/stack' && \
+    if [ "$VARIANT" = "small" ]; then \
+        stack setup --resolver ghc-$GHC_VERSION; \
+    fi && \
+    rm -rf /var/lib/apt/lists/* && \
+    cd $STACK_ROOT && \
+    find . -type f -not -path "./programs/x86_64-linux/ghc*-$GHC_VERSION/*" -exec rm '{}' \; && \
+    find . -type d -print0 |sort -rz |xargs -0 rmdir 2>/dev/null || true
+
+#
+# Configure Stack to use the GHC installed in the Docker image rather than installing its own
+#
+
+RUN mkdir /etc/stack/ && \
+    echo "system-ghc: true" >/etc/stack/config.yaml
+
+#
+# Use 'stack' to install basic Haskell tools like alex, happy, and cpphs. We
+# remove most of the STACK_ROOT afterward to save space, but keep the 'share'
+# files that some of these tools require.
+#
+
+RUN stack --resolver=$LTS_SLUG --local-bin-path=/usr/bin install \
+        happy alex cpphs gtk2hs-buildtools hscolour hlint hindent && \
+    cd $STACK_ROOT && \
+    find . -type f -not -path './snapshots/*/share/*' -and -not -path "./programs/x86_64-linux/ghc-$GHC_VERSION/*" -exec rm '{}' \; && \
+    find . -type d -print0 |sort -rz |xargs -0 rmdir 2>/dev/null || true
+
+#
+# Install 'pid1' init daemon
+#
+
+RUN wget -O- "https://github.com/fpco/pid1/releases/download/v$PID1_VERSION/pid1-$PID1_VERSION-linux-x86_64.tar.gz" | tar xzf - -C /usr/local && \
+    chown root:root /usr/local/sbin && \
+    chown root:root /usr/local/sbin/pid1
+
+#
+# Set up pid1 entrypoint and default command
+#
+
+ENTRYPOINT ["/usr/local/sbin/pid1"]
+CMD ["bash"]
--- a/automated/run-lts.sh
+++ b/automated/run-lts.sh
@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+git pull
+LOG_FILE="logs/$1-build-$(date -u +%F+%T).log"
+if [ -L $1-build.log ]; then
+    mv -f $1-build.log $1-build.log-prev
+fi
+ln -sf $LOG_FILE lts-build.log
+time script -c "./build.sh $*" $LOG_FILE
+touch -h lts-build.log
+LANG=C date
--- a/automated/run-nightly.sh
+++ b/automated/run-nightly.sh
@ -9,10 +9,17 @@ esac

 while true; do
    git pull
-    ./build.sh nightly-$(date -u +%F) $cmd
+    LOG_FILE="logs/nightly-build-$(date -u +%F+%T).log"
+    if [ -L nightly-build.log ]; then
+        mv -f nightly-build.log nightly-build.log-prev
+    fi
+    ln -sf $LOG_FILE nightly-build.log
+    time script -c "./build.sh nightly-$(date -u +%F) $cmd" $LOG_FILE
+    touch -h nightly-build.log
    ${cmd:+exit 0}
-    date
+    LANG=C echo "$0: run completed at $(LANG=C date)"
    ${once:+exit 0}
-    sleep 60m
+    echo
+    sleep 90m
    echo
 done
--- a/build-constraints.yaml
+++ b/build-constraints.yaml
--- a/docker/01-build-server.sh
+++ b/docker/01-build-server.sh
@ -23,3 +23,7 @@ unzip -q awscliv2.zip
 ./aws/install --bin-dir /usr/bin
 )
 rm -rf /tmp/awscli
+
+STACK_VERSION=3.9.1
+curl -L https://github.com/commercialhaskell/stack/releases/download/v${STACK_VERSION}/stack-${STACK_VERSION}-linux-x86_64-bin > /usr/bin/stack
+chmod +x /usr/bin/stack
--- a/docker/02-apt-get-install.sh
+++ b/docker/02-apt-get-install.sh
@ -18,27 +18,32 @@ apt-get install -y \
    cmake \
    coinor-libclp-dev \
    curl \
+    cvc5 \
    dvipng \
+    erlang \
    freeglut3-dev \
    freetds-dev \
    fsharp \
    g++ \
    gawk \
-    gir1.2-javascriptcoregtk-4.0 \
+    gir1.2-javascriptcoregtk-4.1 \
    gir1.2-javascriptcoregtk-6.0 \
+    gir1.2-soup-2.4 \
+    gir1.2-soup-3.0 \
    git \
    gnupg \
+    gobject-introspection \
    gradle \
    hscolour \
    libadns1-dev \
-    libaio1 \
+    libaio-dev \
    libalut-dev \
    libasound2-dev \
    libblas-dev \
    libbrotli-dev \
    libbz2-dev \
    libcairo2-dev \
-    libclang-12-dev \
+    libclang-14-dev \
    libcurl4-openssl-dev \
    libcwiid-dev \
    libdbusmenu-glib-dev \
@ -64,7 +69,9 @@ apt-get install -y \
    libgsl-dev \
    libgtk-3-dev \
    libgtk-4-dev \
+    libgtk-layer-shell-dev \
    libgtk2.0-dev \
+    libgtksourceview-3.0-dev \
    libgtksourceview-5-dev \
    libhidapi-dev \
    libi2c-dev \
@ -72,6 +79,7 @@ apt-get install -y \
    libimlib2-dev \
    libjack-jackd2-dev \
    libjansson-dev \
+    libjavascriptcoregtk-4.1-dev \
    libjavascriptcoregtk-6.0-dev \
    libjudy-dev \
    liblapack-dev \
@ -79,6 +87,7 @@ apt-get install -y \
    liblmdb-dev \
    liblz4-tool \
    liblzma-dev \
+    liblua5.4-dev \
    libmagic-dev \
    libmagickcore-dev \
    libmagickwand-dev \
@ -99,6 +108,9 @@ apt-get install -y \
    libpapi-dev \
    libpcap0.8-dev \
    libpcre2-dev \
+    libpcre3-dev \
+    libpipewire-0.3-dev \
+    libportmidi-dev \
    libpq-dev \
    libprimecount-dev \
    libprotobuf-dev \
@ -114,6 +126,7 @@ apt-get install -y \
    libsnappy-dev \
    libsndfile1-dev \
    libsodium-dev \
+    libsoup2.4-dev \
    libsoup-3.0-dev \
    libsox-dev \
    libsqlite3-dev \
@ -122,9 +135,10 @@ apt-get install -y \
    libtagc0-dev \
    libtre-dev \
    libudev-dev \
+    libuhd-dev \
    libusb-1.0-0-dev \
    libvte-2.91-dev \
-    libwebkit2gtk-4.0-dev \
+    libwebkit2gtk-4.1-dev \
    libxau-dev \
    libxml2-dev \
    libxrandr-dev \
@ -134,11 +148,11 @@ apt-get install -y \
    libzip-dev \
    libzmq3-dev \
    libzstd-dev \
-    llvm-11 \
-    llvm-12 \
-    llvm-13 \
+    llvm-14 \
+    llvm-15 \
    locales \
    m4 \
+    meson \
    minisat \
    mono-mcs \
    nettle-dev \
@ -147,7 +161,7 @@ apt-get install -y \
    nodejs \
    nvidia-cuda-toolkit \
    openjdk-8-jdk \
-    python-mpltoolkits.basemap \
+    pkg-config \
    python3-matplotlib \
    python3-numpy \
    python3-pip \
--- a/docker/03-custom-install.sh
+++ b/docker/03-custom-install.sh
@ -10,66 +10,47 @@ export DEBIAN_FRONTEND=noninteractive

 locale-gen en_US.UTF-8

-# Buggy versions of ld.bfd fail to link some Haskell packages:
-# https://sourceware.org/bugzilla/show_bug.cgi?id=17689. Gold is
-# faster anyways and uses less RAM.
+# upstream ghc still defaults to ld.gold (though we should really switch to ld.bfd)
 update-alternatives --install "/usr/bin/ld" "ld" "/usr/bin/ld.gold" 20
 update-alternatives --install "/usr/bin/ld" "ld" "/usr/bin/ld.bfd" 10

-# install ocilib dependencies then build and install ocilib
-cd /tmp \
-    && wget https://storage.googleapis.com/oracle.fpinsight.com/instantClient/oracle-instantclient12.1-basiclite_12.1.0.2.0-2_amd64.deb \
-    && dpkg -i oracle-instantclient12.1-basiclite_12.1.0.2.0-2_amd64.deb \
-    && rm -f oracle-instantclient12.1-basiclite_12.1.0.2.0-2_amd64.deb \
-    && wget https://storage.googleapis.com/oracle.fpinsight.com/instantClient/oracle-instantclient12.1-devel_12.1.0.2.0-2_amd64.deb \
-    && dpkg -i oracle-instantclient12.1-devel_12.1.0.2.0-2_amd64.deb \
-    && rm -f oracle-instantclient12.1-devel_12.1.0.2.0-2_amd64.deb \
-    && wget https://github.com/vrogier/ocilib/archive/v4.3.2.tar.gz \
-    && tar xvf v4.3.2.tar.gz \
-    && cd /tmp/ocilib-4.3.2 \
-    && ./configure --with-oracle-import=linkage \
-                   --with-oracle-charset=ansi \
-                   --with-oracle-headers-path=/usr/include/oracle/12.1/client64 \
-                   --with-oracle-lib-path=/usr/lib/oracle/12.1/client64/lib \
-    && make \
-    && make install \
-    && cd \
-    && rm -rf /tmp/ocilib-4.3.2 \
-    && echo "/usr/local/lib" > /etc/ld.so.conf.d/usr-local.conf \
-    && echo "/usr/lib/oracle/12.1/client64/lib" > /etc/ld.so.conf.d/oracle-client.conf \
-    && ldconfig
+# Install WirePlumber 0.5 for gi-wireplumber and taffybar.
+# Ubuntu 24.04 only packages WirePlumber 0.4.
+WIREPLUMBER_VER=0.5.14
+WIREPLUMBER_TARBALL=wireplumber-${WIREPLUMBER_VER}.tar.gz
+(
+  cd /tmp \
+    && curl -L -o ${WIREPLUMBER_TARBALL} https://gitlab.freedesktop.org/pipewire/wireplumber/-/archive/${WIREPLUMBER_VER}/${WIREPLUMBER_TARBALL} \
+    && echo "e91f04cd8cec75d72b8a2aaa7e90b1ba0a5e2094b7a882fc3a29a484a48a87e9  ${WIREPLUMBER_TARBALL}" | sha256sum -c - \
+    && tar -xzf ${WIREPLUMBER_TARBALL} \
+    && cd wireplumber-${WIREPLUMBER_VER} \
+    && meson setup build -Ddoc=disabled -Dsystem-lua=true \
+    && meson compile -C build \
+    && meson install -C build \
+    && ldconfig \
+    && cd /tmp \
+    && rm -rf wireplumber-${WIREPLUMBER_VER} ${WIREPLUMBER_TARBALL}
+)

-# Add JDK to system paths.
-echo "/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/server/" > /etc/ld.so.conf.d/openjdk.conf \
-    && ldconfig
+# # Add JDK to system paths.
+# echo "/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/server" > /etc/ld.so.conf.d/openjdk.conf \
+#     && ldconfig

-# Install erlang/otp platform and its dependencies
-ERLANG_DEB_FILE="esl-erlang_21.1-1~ubuntu~bionic_amd64.deb"
-pushd /tmp \
-    && wget https://packages.erlang-solutions.com/erlang/debian/pool/${ERLANG_DEB_FILE} \
-    && (dpkg -i ${ERLANG_DEB_FILE}; apt-get install -yf) \
-    && rm ${ERLANG_DEB_FILE} \
-    && popd
-
-# Install the TensorFlow C API.
-curl https://storage.googleapis.com/tensorflow/libtensorflow/libtensorflow-cpu-linux-x86_64-1.1.0.tar.gz > libtensorflow.tar.gz \
-    && sudo tar zxf libtensorflow.tar.gz -C /usr \
-    && rm libtensorflow.tar.gz \
-    && ldconfig
-
-export CLANG_PURE_LLVM_LIB_DIR=/usr/lib/llvm-9/lib;
-export CLANG_PURE_LLVM_INCLUDE_DIR=/usr/lib/llvm-9/include;
+# # Install erlang/otp platform and its dependencies
+# ERLANG_DEB_FILE="esl-erlang_21.1-1~ubuntu~bionic_amd64.deb"
+# pushd /tmp \
+#     && wget https://packages.erlang-solutions.com/erlang/debian/pool/${ERLANG_DEB_FILE} \
+#     && (dpkg -i ${ERLANG_DEB_FILE}; apt-get install -yf) \
+#     && rm ${ERLANG_DEB_FILE} \
+#     && popd

 # protoc, for proto-lens-combinators test suite
 # Instructions from: https://google.github.io/proto-lens/installing-protoc.html
-PROTOC_ZIP=protoc-3.3.0-linux-x86_64.zip
-curl -OL https://github.com/google/protobuf/releases/download/v3.3.0/$PROTOC_ZIP
+PROTOC_ZIP=protoc-28.0-linux-x86_64.zip
+curl -OL https://github.com/google/protobuf/releases/download/v28.0/$PROTOC_ZIP
 sudo unzip -o $PROTOC_ZIP -d /usr bin/protoc
 rm -f $PROTOC_ZIP

-
-echo /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/server > /etc/ld.so.conf.d/java.conf
-
 # Install librdkafka (Apache Kafka C/C++ library)
 wget -qO - https://packages.confluent.io/deb/5.2/archive.key | apt-key add -
 add-apt-repository "deb https://packages.confluent.io/deb/5.2 stable main"
@ -84,17 +65,3 @@ Z3_VER=4.13.4
    && rm z3-${Z3_VER}-x64-glibc-2.35.zip \
    && ln -s /usr/local/z3-${Z3_VER}-x64-glibc-2.35/bin/z3 /usr/bin/z3
 )
-
-LIBJWT_VER=1.12.1
-(
-pushd /tmp \
-    && wget https://github.com/benmcollins/libjwt/archive/v${LIBJWT_VER}.zip \
-    && unzip v${LIBJWT_VER}.zip \
-    && pushd libjwt-${LIBJWT_VER} \
-       && autoreconf -fiv \
-       && ./configure --disable-valgrind --disable-doxygen-doc --prefix /usr \
-       && make \
-       && sudo make install \
-       && popd \
-    && popd
-)
--- a/etc/check.sh
+++ b/etc/check.sh
@ -11,7 +11,7 @@ export PATH=$HOME/.local/bin:$PATH
 curl -L https://www.stackage.org/stack/linux-x86_64 | tar xz --wildcards --strip-components=1 -C ~/.local/bin '*/stack'

 # Get new Stackage curator
-curl -L "https://github.com/commercialhaskell/curator/releases/download/commit-6689440033b12182c0853bdd23880a84849eb6b2/curator.bz2" | bunzip2 > curator
+curl -L "https://github.com/commercialhaskell/curator/releases/download/commit-8232601683259e224beda15918399af803009db0/curator.bz2" | bunzip2 > curator
 chmod +x curator

 # Install GHC
--- a/etc/diskspace/remove-old-stack-work-libs.hs
+++ b/etc/diskspace/remove-old-stack-work-libs.hs
@ -1,123 +0,0 @@
-#!/usr/bin/env stack
-- stack --resolver lts-19.33 script
-
-- Utility to remove old libs installed under .stack-work/ to save diskspace
-
-import Control.Monad
-import Data.List
-import System.Directory
-import System.FilePath
-import System.Environment
-import Text.Regex.TDFA
-
-- keep 2 latest builds
-keepBuilds :: Int
-keepBuilds = 2
-
-main :: IO ()
-main = do
-  args <- getArgs
-  case args of
-    [stream] -> do
-      home <- getHomeDirectory
-      withCurrentDirectory (home </> "stackage/automated/work" </> stream </> "unpack-dir") $ do
-        cleanStackWorkInstall
-        putStrLn ""
-        cleanStackWorkPackages
-    _ -> error "arg should be 'lts-XX' or 'nightly'"
-
-  -- navigates to: .stack-work/install/x86_64-linux*/*/*/lib/x86_64-linux-ghc-*
-cleanStackWorkInstall :: IO ()
-cleanStackWorkInstall =
-  withCurrentDirectory ".stack-work/install"
-  $ withOneDirectory_ -- "x86_64-linux*"
-  $ withOneDirectory_ -- hash
-  $ withOneDirectory $ \ghcver ->
-  withCurrentDirectory ("lib" </> "x86_64-linux-ghc-" ++ ghcver) $ do
-  getCurrentDirectory >>= putStrLn
-  files <- sort <$> listDirectory "."
-  let (dynlibs,libdirs) = partition (".so" `isExtensionOf`) files
-      pkglibdirs = groupBy samePkgLibDir libdirs
-      pkgdynlibs = groupBy samePkgDynLib dynlibs
-  mapM_ (removeOlder removeDirectoryRecursive) pkglibdirs
-  mapM_ (removeOlder removeFile) pkgdynlibs
-  where
-    samePkgLibDir l1 l2 = pkgDirName l1 == pkgDirName l2
-      where
-        pkgDirName p =
-          if length p < 25
-          then error $ p ++ " too short to be in correct name-version-hash format"
-          else extractNameInternal p
-
-    extractNameInternal :: String -> String
-    extractNameInternal p =
-      let (name,match',internal) = p =~ "-[0-9.]+-[0-9A-Za-z]{19,22}" :: (String, String, String)
-      in if null match' || null name then error $ p ++ " not in correct name-version-hash format"
-         else name ++ internal
-
-    samePkgDynLib d1 d2 = pkgDynName d1 == pkgDynName d2
-      where
-        pkgDynName p =
-          if length p < 42
-          then error $ p ++ " too short to be libHSname-version-hash-ghc*.so format"
-          else (extractNameInternal . removeDashSegment) p
-
-    removeDashSegment = dropWhileEnd (/= '-')
-
-
-removeOlder :: (FilePath -> IO ()) -> [FilePath] -> IO ()
-removeOlder remover files = do
-  oldfiles <- drop keepBuilds . reverse <$> sortByAge files
-  mapM_ remover oldfiles
-
-sortByAge :: [FilePath] -> IO [FilePath]
-sortByAge files = do
-  timestamps <- mapM getModificationTime files
-  let fileTimes = zip files timestamps
-  return $ map fst $ sortBy compareSnd fileTimes
-  where
-    compareSnd (_,t1) (_,t2) = compare t1 t2
-
-- navigates to:
-- unpacked/*/.stack-work/dist/x86_64-linux-tinfo6/Cabal-3.8.1.0/build/
-cleanStackWorkPackages :: IO ()
-cleanStackWorkPackages =
-  withCurrentDirectory "unpacked" $ do
-  getCurrentDirectory >>= putStrLn
-  pkgs <- listDirectory "."
-  forM_ pkgs $ \pkg ->
-    withCurrentDirectory (pkg </> ".stack-work/dist") $ do
-    -- [(dyn,stat)]
-    libs <- do
-      platforms <- listDirectory "." -- "x86_64-linux-tinfo6*"
-      forM platforms $ \pl ->
-        withCurrentDirectory pl $
-        withOneDirectory -- "Cabal-*"
-        $ \cbl ->
-        withCurrentDirectory "build" $ do
-        ls <- sort <$> listDirectory "."
-        files <- filterM doesFileExist ls
-        let (dynlibs,others) = partition (".so" `isExtensionOf`) files
-            statlibs = filter (".a" `isExtensionOf`) others
-        let dir = pl </> cbl </> "build"
-        return (map (dir </>) dynlibs, map (dir </>) statlibs)
-    removeOlder removeFile $ concatMap fst libs
-    removeOlder removeFile $ concatMap snd libs
-
-withOneDirectory_ :: IO a -> IO a
-withOneDirectory_ act = do
-  ls <- listDirectory "."
-  case ls of
-    [l] -> withCurrentDirectory l act
-    _ -> do
-      cwd <- getCurrentDirectory
-      error $ show (length ls) ++ " directories found in " ++ cwd ++ ": " ++ unwords ls
-
-withOneDirectory :: (FilePath -> IO a) -> IO a
-withOneDirectory act = do
-  ls <- listDirectory "."
-  case ls of
-    [l] -> withCurrentDirectory l $ act l
-    _ -> do
-      cwd <- getCurrentDirectory
-      error $ show (length ls) ++ " directories found in " ++ cwd ++ ": " ++ unwords ls
--- a/etc/lts-constraints/README.md
+++ b/etc/lts-constraints/README.md
@ -1 +1,8 @@
 # lts-constraints
+
+Usage example:
+
+```shellsession
+$ lts-constraints --major 24 --baseSnapshotPath snapshot.yaml
+Done. Wrote to lts-24-build-constraints.yaml
+```