First draft

.gitlab-ci.yml

+.before-script-build: &before-script-build
+  - |
+    if [[ ! -z "$CI_BUILD_PLATFORMS" ]]; then
+      export OS_ARCH=$(echo $CI_BUILD_PLATFORMS | tr ' ' '\n' | \
+      sed 's|\/||2' | sed 's|\/|-|' | tr '\n' ' ')
+    fi
+  - export CI_APP_REPO=${CI_APP_REPO:-$CI_REGISTRY_IMAGE}
+  - >
+    echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER
+    --password-stdin $CI_REGISTRY
+  - |
+    if [[ -z "$IMAGE" ]]; then
+      export IMAGE=$(sed -n "s|IMAGE=\(.*\)|\1|p" sample..env)
+    fi
+  - |
+    if [[ -z "$GHC_VERSION" ]]; then
+      export GHC_VERSION=$(sed -n "s|GHC_VERSION=\(.*\)|\1|p" sample..env)
+    fi
+  - |
+    if [[ -z "$CABAL_VERSION" ]]; then
+      export CABAL_VERSION_BUILD=$(sed -n "s|CABAL_VERSION=\(.*\)|\1|p" sample..env)
+    fi
+  - |
+    if [[ -z "$STACK_VERSION" ]]; then
+      export STACK_VERSION_BUILD=$(sed -n "s|STACK_VERSION=\(.*\)|\1|p" sample..env)
+    fi
+
+.build:
+  image: glcr.b-data.ch/docker/docker:dind
+  stage: build
+  services:
+    - name: glcr.b-data.ch/docker/docker:dind
+      alias: docker
+  variables:
+    DOCKER_DRIVER: overlay2
+    DOCKER_TLS_CERTDIR: "/certs"
+    BUILDX_NO_DEFAULT_ATTESTATIONS: "true"
+  before_script:
+    - *before-script-build
+
+build:version-linux-amd64:
+  extends: .build
+  tags:
+    - arch:amd64
+    - os:linux
+  script:
+    - >
+      docker build
+      --build-arg IMAGE
+      --build-arg GHC_VERSION
+      --build-arg CABAL_VERSION_BUILD
+      --build-arg STACK_VERSION_BUILD
+      -t $CI_APP_REPO:$STACK_VERSION_BUILD-linux-amd64
+      -f build.Dockerfile .
+    - docker push $CI_APP_REPO:$STACK_VERSION_BUILD-linux-amd64
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main" && $CI_BUILD_PLATFORMS =~ /(linux\/amd64)/
+      changes:
+        - build.Dockerfile
+        - sample..env
+
+build:version-linux-arm64v8:
+  extends: .build
+  tags:
+    - arch:arm64/v8
+    - os:linux
+  script:
+    - >
+      docker build
+      --build-arg IMAGE
+      --build-arg GHC_VERSION
+      --build-arg CABAL_VERSION_BUILD
+      --build-arg STACK_VERSION_BUILD
+      -t $CI_APP_REPO:$STACK_VERSION_BUILD-linux-arm64v8
+      -f build.Dockerfile .
+    - docker push $CI_APP_REPO:$STACK_VERSION_BUILD-linux-arm64v8
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main" && $CI_BUILD_PLATFORMS =~ /(linux\/arm64\/v8)/
+      changes:
+        - build.Dockerfile
+        - sample..env
+
+build-manifest:version-linux-multiarch:
+  extends: .build
+  needs: ["build:version-linux-amd64", "build:version-linux-arm64v8"]
+  script:
+    - |
+      for i in $OS_ARCH; do
+        export CI_MANIFEST_LIST="$CI_MANIFEST_LIST $CI_APP_REPO:$STACK_VERSION_BUILD-$i"
+      done
+    - |
+      docker manifest create $CI_APP_REPO:$STACK_VERSION_BUILD $CI_MANIFEST_LIST
+      if echo $OS_ARCH | grep "linux-arm64v8" >/dev/null ; then
+        docker manifest annotate --variant v8 $CI_APP_REPO:$STACK_VERSION_BUILD \
+          $CI_APP_REPO:$STACK_VERSION_BUILD-linux-arm64v8
+      fi
+      docker manifest push $CI_APP_REPO:$STACK_VERSION_BUILD
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main"
+      changes:
+        - build.Dockerfile
+        - sample..env

CODE_OF_CONDUCT.md

+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for
+moderation decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail
+address, posting via an official social media account, or acting as an
+appointed representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+<olivier.benz@b-data.ch>. All complaints will be reviewed and investigated
+promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior,  harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.0, available at
+https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct
+enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.

README.md

+# Containerised Stack source installation

SECURITY.md

+## Supported Versions
+
+THE PROGRAM IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.
+
+The docker images are built from
+[tagged Stack releases](https://github.com/commercialhaskell/stack/tags).
+
+## Reporting a Vulnerability
+
+To report a vulnerability, contact one of the many Stack
+[contributors](https://github.com/commercialhaskell/stack/graphs/contributors).

build.Dockerfile

+ARG IMAGE
+ARG GHC_VERSION
+ARG PREFIX=/usr/local
+
+FROM ${IMAGE}:${GHC_VERSION} as builder
+
+ARG CABAL_VERSION_BUILD
+ARG STACK_VERSION_BUILD
+ARG PREFIX
+ARG MODE=install
+
+COPY scripts/*.sh /usr/bin/
+
+RUN mkdir -p "/tmp$PREFIX/bin" \
+ && start.sh
+
+FROM scratch
+
+LABEL org.opencontainers.image.licenses="MIT" \
+      org.opencontainers.image.source="https://gitlab.b-data.ch/commercialhaskell/ssi" \
+      org.opencontainers.image.vendor="Olivier Benz" \
+      org.opencontainers.image.authors="Olivier Benz <olivier.benz@b-data.ch>"
+
+ARG PREFIX
+
+COPY --from=builder "/tmp$PREFIX/bin/stack" "$PREFIX/bin/stack"

scripts/start.sh

+#!/bin/bash
+# Copyright (c) 2023 b-data GmbH.
+# Distributed under the terms of the MIT License.
+
+set -e
+
+# Test if PREFIX location is whithin limits
+if [[ ! "$PREFIX" == "/usr/local" && ! "$PREFIX" =~ ^"/opt" ]]; then
+  echo "ERROR:  PREFIX set to '$PREFIX'. Must either be '/usr/local' or within '/opt'."
+  exit 1
+fi
+
+# Test if there is a bin folder at PREFIX
+if [[ ! -d "/tmp$PREFIX/bin" ]]; then
+  echo "ERROR:  There is no 'bin' folder in '$PREFIX'."
+  echo "INFO:   Execute 'mkdir -p $PREFIX/bin'" to create one.
+  exit 1
+fi
+
+if [[ "$MODE" == "install" ]]; then
+  # Install Cabal
+  cabal update
+  cabal install "cabal-install-$CABAL_VERSION_BUILD"
+  echo "Copying 'cabal' to '$(which cabal)'"
+  cp -aL /root/.cabal/bin/cabal "$(which cabal)"
+
+  # Download and extract source code
+  cd /tmp
+  curl -sSL https://github.com/commercialhaskell/stack/archive/refs/tags/v"$STACK_VERSION_BUILD".tar.gz \
+    -o stack.tar.gz
+  tar -xzf stack.tar.gz
+  cd stack-*
+
+  # Modify config
+  sed -i /stack/d cabal.config
+
+  # Build and install
+  cabal build \
+    --allow-older \
+    --enable-executable-static \
+    --ghc-options='-split-sections -optl=-pthread'
+
+  strip "$(find dist-newstyle -name stack -type f)"
+
+  cp -aL "$(find dist-newstyle -name stack -type f)" "/tmp$PREFIX/bin"
+  echo "INFO:   Stack v$STACK_VERSION_BUILD installed in '$PREFIX/bin'."
+elif [[ "$MODE" == "uninstall" ]]; then
+  if [[ -f "/tmp$PREFIX/bin/stack" ]]; then
+    rm -f "/tmp$PREFIX/bin/stack"
+    echo "INFO:   Stack uninstalled from '$PREFIX/bin'."
+  else
+    echo "ERROR:  Stack not found in '$PREFIX/bin'!"
+    exit 1
+  fi
+else
+  echo "ERROR:  Execution mode '$MODE' not supported!"
+  exit 1
+fi