Skip to content

Haskell: bump ghc 9.10 to 9.10.3 + refreshed Dockerfiles #20186

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Haskell: bump ghc 9.10 to 9.10.3 + refreshed Dockerfiles #20186

wants to merge 2 commits into from
+20 −10

Conversation

@Totto16
Copy link

@Totto16 Totto16 commented Oct 30, 2025

See haskell/docker-haskell#166

Also since the last commit a new image 9.10.3-bookworm and 9.10.3-slim-bookworm was added, chnaging the 9.10 tag to point to bookworm wouldn't be a good idea, so I didn't do that

@Totto16 Totto16 requested a review from a team as a code owner October 30, 2025 15:30
@github-actions
Copy link

Diff for a60e4a5: 
diff --git a/_bashbrew-cat b/_bashbrew-cat
index f02a682..b3ec033 100644
--- a/_bashbrew-cat
+++ b/_bashbrew-cat
@@ -3,40 +3,50 @@ GitRepo: https://github.com/haskell/docker-haskell
 
 Tags: 9.6.7-bullseye, 9.6-bullseye, 9.6.7, 9.6
 Architectures: amd64, arm64v8
-GitCommit: c34f97738d08a138ef07878a4a1402b10670f87b
+GitCommit: c60772135a83d59bf4e052a7ef05796557c205a4
 Directory: 9.6/bullseye
 
 Tags: 9.6.7-slim-bullseye, 9.6-slim-bullseye, 9.6.7-slim, 9.6-slim
 Architectures: amd64, arm64v8
-GitCommit: c34f97738d08a138ef07878a4a1402b10670f87b
+GitCommit: c60772135a83d59bf4e052a7ef05796557c205a4
 Directory: 9.6/slim-bullseye
 
 Tags: 9.8.4-bullseye, 9.8-bullseye, 9.8.4, 9.8
 Architectures: amd64, arm64v8
-GitCommit: c34f97738d08a138ef07878a4a1402b10670f87b
+GitCommit: c60772135a83d59bf4e052a7ef05796557c205a4
 Directory: 9.8/bullseye
 
 Tags: 9.8.4-slim-bullseye, 9.8-slim-bullseye, 9.8.4-slim, 9.8-slim
 Architectures: amd64, arm64v8
-GitCommit: c34f97738d08a138ef07878a4a1402b10670f87b
+GitCommit: c60772135a83d59bf4e052a7ef05796557c205a4
 Directory: 9.8/slim-bullseye
 
-Tags: 9.10.2-bullseye, 9.10-bullseye, 9-bullseye, bullseye, 9.10.2, 9.10
+Tags: 9.10.3-bookworm, 9.10-bookworm
 Architectures: amd64, arm64v8
-GitCommit: c34f97738d08a138ef07878a4a1402b10670f87b
+GitCommit: c60772135a83d59bf4e052a7ef05796557c205a4
+Directory: 9.10/bookworm
+
+Tags: 9.10.3-bullseye, 9.10-bullseye, 9-bullseye, bullseye, 9.10.3, 9.10
+Architectures: amd64, arm64v8
+GitCommit: c60772135a83d59bf4e052a7ef05796557c205a4
 Directory: 9.10/bullseye
 
-Tags: 9.10.2-slim-bullseye, 9.10-slim-bullseye, 9-slim-bullseye, slim-bullseye
+Tags: 9.10.3-slim-bookworm, 9.10-slim-bookworm
+Architectures: amd64, arm64v8
+GitCommit: c60772135a83d59bf4e052a7ef05796557c205a4
+Directory: 9.10/slim-bookworm
+
+Tags: 9.10.3-slim-bullseye, 9.10-slim-bullseye, 9-slim-bullseye, slim-bullseye
 Architectures: amd64, arm64v8
-GitCommit: c34f97738d08a138ef07878a4a1402b10670f87b
+GitCommit: c60772135a83d59bf4e052a7ef05796557c205a4
 Directory: 9.10/slim-bullseye
 
 Tags: 9.12.2-bookworm, 9.12-bookworm, 9-bookworm, bookworm, 9.12.2, 9.12, 9, latest
 Architectures: amd64, arm64v8
-GitCommit: c34f97738d08a138ef07878a4a1402b10670f87b
+GitCommit: c60772135a83d59bf4e052a7ef05796557c205a4
 Directory: 9.12/bookworm
 
 Tags: 9.12.2-slim-bookworm, 9.12-slim-bookworm, 9-slim-bookworm, slim-bookworm, 9-slim, slim
 Architectures: amd64, arm64v8
-GitCommit: c34f97738d08a138ef07878a4a1402b10670f87b
+GitCommit: c60772135a83d59bf4e052a7ef05796557c205a4
 Directory: 9.12/slim-bookworm
diff --git a/_bashbrew-list b/_bashbrew-list
index c7de251..f817179 100644
--- a/_bashbrew-list
+++ b/_bashbrew-list
@@ -21,11 +21,15 @@ haskell:9.8.4-bullseye
 haskell:9.8.4-slim
 haskell:9.8.4-slim-bullseye
 haskell:9.10
+haskell:9.10-bookworm
 haskell:9.10-bullseye
+haskell:9.10-slim-bookworm
 haskell:9.10-slim-bullseye
-haskell:9.10.2
-haskell:9.10.2-bullseye
-haskell:9.10.2-slim-bullseye
+haskell:9.10.3
+haskell:9.10.3-bookworm
+haskell:9.10.3-bullseye
+haskell:9.10.3-slim-bookworm
+haskell:9.10.3-slim-bullseye
 haskell:9.12
 haskell:9.12-bookworm
 haskell:9.12-slim-bookworm
diff --git a/_bashbrew-list-build-order b/_bashbrew-list-build-order
index 7821513..7143d9e 100644
--- a/_bashbrew-list-build-order
+++ b/_bashbrew-list-build-order
@@ -3,6 +3,8 @@ haskell:9.6-slim
 haskell:9.8
 haskell:9.8-slim
 haskell:9.10
+haskell:9.10-bookworm
+haskell:9.10-slim-bookworm
 haskell:latest
 haskell:slim
 haskell:slim-bullseye
diff --git a/haskell_latest/Dockerfile b/haskell_9.10-bookworm/Dockerfile
similarity index 41%
copy from haskell_latest/Dockerfile
copy to haskell_9.10-bookworm/Dockerfile
index 7978459..e9c0814 100644
--- a/haskell_latest/Dockerfile
+++ b/haskell_9.10-bookworm/Dockerfile
@@ -3,7 +3,8 @@ FROM debian:bookworm
 ENV LANG=C.UTF-8
 
 # common haskell + stack dependencies
-RUN apt-get update && \
+RUN <<EOT
+    apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
@@ -22,112 +23,121 @@ RUN apt-get update && \
         xz-utils \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
+EOT
 
-ARG STACK=3.3.1
-ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
+ARG STACK='3.3.1'
+ARG STACK_RELEASE_KEY='C5705533DA4F78D8664B5DC0575159689BEFB442'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"
     # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$STACK_URL" -o stack.tar.gz; \
-    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-    gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-    gpgconf --kill all; \
-    \
-    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-    stack config set system-ghc --global true; \
-    stack config set install-ghc --global false; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in 
+        'aarch64') 
+            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'
+            ;;
+        'x86_64') 
+            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" exit 1 ;
+    esac
+    curl -sSL "$STACK_URL" -o stack.tar.gz
+    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check
+    
+    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc
+    GNUPGHOME="$(mktemp -d)"
+    export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"
+    gpg --batch --verify stack.tar.gz.asc stack.tar.gz
+    gpgconf --kill all
+    
+    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"
+    stack config set system-ghc --global true
+    stack config set install-ghc --global false
+    
+    rm -rf /tmp/*
+    
     stack --version;
+EOT
 
-ARG CABAL_INSTALL=3.14.1.1
-ARG CABAL_INSTALL_RELEASE_KEY=EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF
+ARG CABAL_INSTALL='3.14.1.1'
+ARG CABAL_INSTALL_RELEASE_KEY='EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb12.tar.xz"; \
-    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"; \
-    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb12.tar.xz"
+    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"
+    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"
     # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            CABAL_INSTALL_SHA256='f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9'; \
-            ;; \
-        'x86_64') \
-            CABAL_INSTALL_SHA256='73a463306c771e18ca22c0a9469176ffab0138ec5925adb5364ef47174e1adc5'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
-    esac; \
-    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz; \
-    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"; \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"; \
-    gpg --batch --verify SHA256SUMS.sig SHA256SUMS; \
+    case "$ARCH" in
+        'aarch64')
+            CABAL_INSTALL_SHA256='f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9'
+            ;;
+        'x86_64')
+            CABAL_INSTALL_SHA256='73a463306c771e18ca22c0a9469176ffab0138ec5925adb5364ef47174e1adc5'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;;
+    esac
+    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz
+    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check
+
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"
+    gpg --batch --verify SHA256SUMS.sig SHA256SUMS
     # confirm we are verifying SHA256SUMS that matches the release + sha256
-    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS; \
-    gpgconf --kill all; \
-    \
-    tar -xf cabal-install.tar.gz -C /usr/local/bin; \
-    \
-    rm -rf /tmp/*; \
-    \
+    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS
+    gpgconf --kill all;
+
+    tar -xf cabal-install.tar.gz -C /usr/local/bin
+
+    rm -rf /tmp/*
+
     cabal --version
+EOT
 
-ARG GHC=9.12.2
-ARG GHC_RELEASE_KEY=FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD
+ARG GHC='9.10.3'
+ARG GHC_RELEASE_KEY='88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb12-linux.tar.xz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb12-linux.tar.xz"
     # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            GHC_SHA256='bee95bc91a621d8a2e9a9d86dac28ff839605e87316518dae12c779709bd58f1'; \
-            ;; \
-        'x86_64') \
-            GHC_SHA256='447ec2fcc773ae9ebc3f39766c719641631274f9b765d7426a8cbe9241677c9f'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$GHC_URL" -o ghc.tar.xz; \
-    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check; \
-    \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"; \
-    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz; \
-    gpgconf --kill all; \
-    \
-    tar xf ghc.tar.xz; \
-    cd "ghc-$GHC-$ARCH-unknown-linux"; \
-    ./configure --prefix "/opt/ghc/$GHC"; \
-    make install; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in
+        'aarch64')
+            GHC_SHA256='052789dfe7f6fba6dc3822de0da272e8a5bd358c37adae17d8e82cff39bc1008'
+            GHC_URL='https://downloads.haskell.org/~ghc/9.10.3/ghc-9.10.3-aarch64-deb11-linux.tar.xz'
+            ;;
+        'x86_64')
+            GHC_SHA256='1ac63f04eac0ad551d45cbde38f27e0e3f43ceefd98833fae1fa3f2dbd042367'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;;
+    esac
+    curl -sSL "$GHC_URL" -o ghc.tar.xz
+    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check
+
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"
+    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz
+    gpgconf --kill all
+
+    tar xf ghc.tar.xz
+    cd "ghc-$GHC-$ARCH-unknown-linux"
+    ./configure --prefix "/opt/ghc/$GHC"
+    make install
+
+    rm -rf /tmp/*
+
     "/opt/ghc/$GHC/bin/ghc" --version
+EOT
 
 ENV PATH=/root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
 
diff --git a/haskell_slim/Dockerfile b/haskell_9.10-slim-bookworm/Dockerfile
similarity index 41%
copy from haskell_slim/Dockerfile
copy to haskell_9.10-slim-bookworm/Dockerfile
index 0a3e2dc..af2605e 100644
--- a/haskell_slim/Dockerfile
+++ b/haskell_9.10-slim-bookworm/Dockerfile
@@ -3,7 +3,8 @@ FROM debian:bookworm-slim
 ENV LANG=C.UTF-8
 
 # common haskell + stack dependencies
-RUN apt-get update && \
+RUN <<EOT
+    apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
@@ -22,112 +23,121 @@ RUN apt-get update && \
         xz-utils \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
+EOT
 
-ARG STACK=3.3.1
-ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
+ARG STACK='3.3.1'
+ARG STACK_RELEASE_KEY='C5705533DA4F78D8664B5DC0575159689BEFB442'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"
     # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$STACK_URL" -o stack.tar.gz; \
-    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-    gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-    gpgconf --kill all; \
-    \
-    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-    stack config set system-ghc --global true; \
-    stack config set install-ghc --global false; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in 
+        'aarch64') 
+            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'
+            ;;
+        'x86_64') 
+            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" exit 1 ;
+    esac
+    curl -sSL "$STACK_URL" -o stack.tar.gz
+    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check
+    
+    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc
+    GNUPGHOME="$(mktemp -d)"
+    export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"
+    gpg --batch --verify stack.tar.gz.asc stack.tar.gz
+    gpgconf --kill all
+    
+    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"
+    stack config set system-ghc --global true
+    stack config set install-ghc --global false
+    
+    rm -rf /tmp/*
+    
     stack --version;
+EOT
 
-ARG CABAL_INSTALL=3.14.1.1
-ARG CABAL_INSTALL_RELEASE_KEY=EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF
+ARG CABAL_INSTALL='3.14.1.1'
+ARG CABAL_INSTALL_RELEASE_KEY='EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb12.tar.xz"; \
-    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"; \
-    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb12.tar.xz"
+    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"
+    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"
     # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            CABAL_INSTALL_SHA256='f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9'; \
-            ;; \
-        'x86_64') \
-            CABAL_INSTALL_SHA256='73a463306c771e18ca22c0a9469176ffab0138ec5925adb5364ef47174e1adc5'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
-    esac; \
-    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz; \
-    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"; \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"; \
-    gpg --batch --verify SHA256SUMS.sig SHA256SUMS; \
+    case "$ARCH" in
+        'aarch64')
+            CABAL_INSTALL_SHA256='f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9'
+            ;;
+        'x86_64')
+            CABAL_INSTALL_SHA256='73a463306c771e18ca22c0a9469176ffab0138ec5925adb5364ef47174e1adc5'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;;
+    esac
+    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz
+    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check
+
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"
+    gpg --batch --verify SHA256SUMS.sig SHA256SUMS
     # confirm we are verifying SHA256SUMS that matches the release + sha256
-    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS; \
-    gpgconf --kill all; \
-    \
-    tar -xf cabal-install.tar.gz -C /usr/local/bin; \
-    \
-    rm -rf /tmp/*; \
-    \
+    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS
+    gpgconf --kill all;
+
+    tar -xf cabal-install.tar.gz -C /usr/local/bin
+
+    rm -rf /tmp/*
+
     cabal --version
+EOT
 
-ARG GHC=9.12.2
-ARG GHC_RELEASE_KEY=FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD
+ARG GHC='9.10.3'
+ARG GHC_RELEASE_KEY='88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb12-linux.tar.xz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb12-linux.tar.xz"
     # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            GHC_SHA256='bee95bc91a621d8a2e9a9d86dac28ff839605e87316518dae12c779709bd58f1'; \
-            ;; \
-        'x86_64') \
-            GHC_SHA256='447ec2fcc773ae9ebc3f39766c719641631274f9b765d7426a8cbe9241677c9f'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$GHC_URL" -o ghc.tar.xz; \
-    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check; \
-    \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"; \
-    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz; \
-    gpgconf --kill all; \
-    \
-    tar xf ghc.tar.xz; \
-    cd "ghc-$GHC-$ARCH-unknown-linux"; \
-    ./configure --prefix "/opt/ghc/$GHC"; \
-    make install; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in
+        'aarch64')
+            GHC_SHA256='052789dfe7f6fba6dc3822de0da272e8a5bd358c37adae17d8e82cff39bc1008'
+            GHC_URL='https://downloads.haskell.org/~ghc/9.10.3/ghc-9.10.3-aarch64-deb11-linux.tar.xz'
+            ;;
+        'x86_64')
+            GHC_SHA256='1ac63f04eac0ad551d45cbde38f27e0e3f43ceefd98833fae1fa3f2dbd042367'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;;
+    esac
+    curl -sSL "$GHC_URL" -o ghc.tar.xz
+    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check
+
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"
+    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz
+    gpgconf --kill all
+
+    tar xf ghc.tar.xz
+    cd "ghc-$GHC-$ARCH-unknown-linux"
+    ./configure --prefix "/opt/ghc/$GHC"
+    make install
+
+    rm -rf /tmp/*
+
     "/opt/ghc/$GHC/bin/ghc" --version
+EOT
 
 ENV PATH=/root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
 
diff --git a/haskell_9.10/Dockerfile b/haskell_9.10/Dockerfile
index 91e6bfc..9387860 100644
--- a/haskell_9.10/Dockerfile
+++ b/haskell_9.10/Dockerfile
@@ -3,7 +3,8 @@ FROM debian:bullseye
 ENV LANG=C.UTF-8
 
 # common haskell + stack dependencies
-RUN apt-get update && \
+RUN <<EOT
+    apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
@@ -22,112 +23,120 @@ RUN apt-get update && \
         xz-utils \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
+EOT
 
-ARG STACK=3.3.1
-ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
+ARG STACK='3.3.1'
+ARG STACK_RELEASE_KEY='C5705533DA4F78D8664B5DC0575159689BEFB442'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"
     # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$STACK_URL" -o stack.tar.gz; \
-    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-    gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-    gpgconf --kill all; \
-    \
-    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-    stack config set system-ghc --global true; \
-    stack config set install-ghc --global false; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in 
+        'aarch64') 
+            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'
+            ;;
+        'x86_64') 
+            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" exit 1 ;
+    esac
+    curl -sSL "$STACK_URL" -o stack.tar.gz
+    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check
+    
+    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc
+    GNUPGHOME="$(mktemp -d)"
+    export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"
+    gpg --batch --verify stack.tar.gz.asc stack.tar.gz
+    gpgconf --kill all
+    
+    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"
+    stack config set system-ghc --global true
+    stack config set install-ghc --global false
+    
+    rm -rf /tmp/*
+    
     stack --version;
+EOT
 
-ARG CABAL_INSTALL=3.12.1.0
-ARG CABAL_INSTALL_RELEASE_KEY=1E07C9A1A3088BAD47F74A3E227EE1942B0BDB95
+ARG CABAL_INSTALL='3.14.1.1'
+ARG CABAL_INSTALL_RELEASE_KEY='EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb11.tar.xz"; \
-    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"; \
-    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb11.tar.xz"
+    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"
+    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"
     # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            CABAL_INSTALL_SHA256='c14e8198407f37f7276c77b5cefef60ee6a929b4c22d7316577ce8e2301a758e'; \
-            ;; \
-        'x86_64') \
-            CABAL_INSTALL_SHA256='4f60cf1c72f4ad4d82d668839ac61ae15ae4faf6c4b809395799e8a3ee622051'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
-    esac; \
-    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz; \
-    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"; \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"; \
-    gpg --batch --verify SHA256SUMS.sig SHA256SUMS; \
+    case "$ARCH" in
+        'aarch64')
+            CABAL_INSTALL_SHA256='5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523'
+            ;;
+        'x86_64')
+            CABAL_INSTALL_SHA256='41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;;
+    esac
+    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz
+    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check
+
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"
+    gpg --batch --verify SHA256SUMS.sig SHA256SUMS
     # confirm we are verifying SHA256SUMS that matches the release + sha256
-    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS; \
-    gpgconf --kill all; \
-    \
-    tar -xf cabal-install.tar.gz -C /usr/local/bin; \
-    \
-    rm -rf /tmp/*; \
-    \
+    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS
+    gpgconf --kill all;
+
+    tar -xf cabal-install.tar.gz -C /usr/local/bin
+
+    rm -rf /tmp/*
+
     cabal --version
+EOT
 
-ARG GHC=9.10.2
-ARG GHC_RELEASE_KEY=88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4
+ARG GHC='9.10.3'
+ARG GHC_RELEASE_KEY='88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb11-linux.tar.xz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb11-linux.tar.xz"
     # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            GHC_SHA256='0188ca098abdaf71eb0804d0f35311f405da489137d8d438bfaa43b8d1e3f1b0'; \
-            ;; \
-        'x86_64') \
-            GHC_SHA256='2fe2c3e0a07e4782530e8bf83eeda8ff6935e40d5450c1809abcdc6182c9c848'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$GHC_URL" -o ghc.tar.xz; \
-    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check; \
-    \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"; \
-    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz; \
-    gpgconf --kill all; \
-    \
-    tar xf ghc.tar.xz; \
-    cd "ghc-$GHC-$ARCH-unknown-linux"; \
-    ./configure --prefix "/opt/ghc/$GHC"; \
-    make install; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in
+        'aarch64')
+            GHC_SHA256='052789dfe7f6fba6dc3822de0da272e8a5bd358c37adae17d8e82cff39bc1008'
+            ;;
+        'x86_64')
+            GHC_SHA256='b6bbd3514e0cdb9db350812a003bb7c670c58d99779086fbe41092b019548924'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;;
+    esac
+    curl -sSL "$GHC_URL" -o ghc.tar.xz
+    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check
+
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"
+    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz
+    gpgconf --kill all
+
+    tar xf ghc.tar.xz
+    cd "ghc-$GHC-$ARCH-unknown-linux"
+    ./configure --prefix "/opt/ghc/$GHC"
+    make install
+
+    rm -rf /tmp/*
+
     "/opt/ghc/$GHC/bin/ghc" --version
+EOT
 
 ENV PATH=/root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
 
diff --git a/haskell_9.6-slim/Dockerfile b/haskell_9.6-slim/Dockerfile
index 3a7f96e..4eeb808 100644
--- a/haskell_9.6-slim/Dockerfile
+++ b/haskell_9.6-slim/Dockerfile
@@ -3,7 +3,8 @@ FROM debian:bullseye-slim
 ENV LANG=C.UTF-8
 
 # common haskell + stack dependencies
-RUN apt-get update && \
+RUN <<EOT
+    apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
@@ -22,117 +23,121 @@ RUN apt-get update && \
         xz-utils \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
+EOT
 
-ARG STACK=3.3.1
-ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
+ARG STACK='3.3.1'
+ARG STACK_RELEASE_KEY='C5705533DA4F78D8664B5DC0575159689BEFB442'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"
     # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$STACK_URL" -o stack.tar.gz; \
-    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-    gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-    gpgconf --kill all; \
-    \
-    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-    stack config set system-ghc --global true; \
-    stack config set install-ghc --global false; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in 
+        'aarch64') 
+            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'
+            ;;
+        'x86_64') 
+            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" exit 1 ;
+    esac
+    curl -sSL "$STACK_URL" -o stack.tar.gz
+    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check
+    
+    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc
+    GNUPGHOME="$(mktemp -d)"
+    export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"
+    gpg --batch --verify stack.tar.gz.asc stack.tar.gz
+    gpgconf --kill all
+    
+    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"
+    stack config set system-ghc --global true
+    stack config set install-ghc --global false
+    
+    rm -rf /tmp/*
+    
     stack --version;
+EOT
 
-ARG CABAL_INSTALL=3.12.1.0
-ARG CABAL_INSTALL_RELEASE_KEY=1E07C9A1A3088BAD47F74A3E227EE1942B0BDB95
+ARG CABAL_INSTALL='3.14.1.1'
+ARG CABAL_INSTALL_RELEASE_KEY='EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb11.tar.xz"; \
-    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"; \
-    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb11.tar.xz"
+    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"
+    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"
     # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            CABAL_INSTALL_SHA256='c14e8198407f37f7276c77b5cefef60ee6a929b4c22d7316577ce8e2301a758e'; \
-            ;; \
-        'x86_64') \
-            CABAL_INSTALL_SHA256='4f60cf1c72f4ad4d82d668839ac61ae15ae4faf6c4b809395799e8a3ee622051'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
-    esac; \
-    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz; \
-    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"; \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"; \
-    gpg --batch --verify SHA256SUMS.sig SHA256SUMS; \
+    case "$ARCH" in
+        'aarch64')
+            CABAL_INSTALL_SHA256='5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523'
+            ;;
+        'x86_64')
+            CABAL_INSTALL_SHA256='41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;;
+    esac
+    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz
+    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check
+
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"
+    gpg --batch --verify SHA256SUMS.sig SHA256SUMS
     # confirm we are verifying SHA256SUMS that matches the release + sha256
-    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS; \
-    gpgconf --kill all; \
-    \
-    tar -xf cabal-install.tar.gz -C /usr/local/bin; \
-    \
-    rm -rf /tmp/*; \
-    \
+    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS
+    gpgconf --kill all;
+
+    tar -xf cabal-install.tar.gz -C /usr/local/bin
+
+    rm -rf /tmp/*
+
     cabal --version
+EOT
 
-ARG GHC=9.6.7
-ARG GHC_RELEASE_KEY=8C961469C8FDC968718D6245AC7DE836C5DF907D
+ARG GHC='9.6.7'
+ARG GHC_RELEASE_KEY='8C961469C8FDC968718D6245AC7DE836C5DF907D'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb11-linux.tar.xz"
     # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            # Note: the 'aarch64-deb11' (bullseye) variant of images doesn't exist in https://downloads.haskell.org/~ghc/9.6.7/
-            # But deb10 (buster) images should be binary compatible with deb11, so using deb10 instead
-            GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb10-linux.tar.xz"; \
-            GHC_SHA256='3cfa843687856de304a946dbe849a497c4fdad021f0275628b8ca7b55ccf8082'; \
-            ;; \
-        'x86_64') \
-            GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb11-linux.tar.xz"; \
-            GHC_SHA256='fc6a6247d1831745c67b27d6212f6911c35a933043f3b6851724e2e01484d077'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$GHC_URL" -o ghc.tar.xz; \
-    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check; \
-    \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"; \
-    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz; \
-    gpgconf --kill all; \
-    \
-    tar xf ghc.tar.xz; \
-    cd "ghc-$GHC-$ARCH-unknown-linux"; \
-    ./configure --prefix "/opt/ghc/$GHC"; \
-    make install; \
-    # remove profiling support to save space
-    find "/opt/ghc/$GHC/" \( -name "*_p.a" -o -name "*.p_hi" \) -type f -delete; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in
+        'aarch64')
+            GHC_SHA256='3cfa843687856de304a946dbe849a497c4fdad021f0275628b8ca7b55ccf8082'
+            GHC_URL='https://downloads.haskell.org/~ghc/9.6.7/ghc-9.6.7-aarch64-deb10-linux.tar.xz'
+            ;;
+        'x86_64')
+            GHC_SHA256='fc6a6247d1831745c67b27d6212f6911c35a933043f3b6851724e2e01484d077'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;;
+    esac
+    curl -sSL "$GHC_URL" -o ghc.tar.xz
+    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check
+
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"
+    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz
+    gpgconf --kill all
+
+    tar xf ghc.tar.xz
+    cd "ghc-$GHC-$ARCH-unknown-linux"
+    ./configure --prefix "/opt/ghc/$GHC"
+    make install
+
+    rm -rf /tmp/*
+
     "/opt/ghc/$GHC/bin/ghc" --version
+EOT
 
 ENV PATH=/root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
 
diff --git a/haskell_9.6/Dockerfile b/haskell_9.6/Dockerfile
index 7b0cf8f..83aea5a 100644
--- a/haskell_9.6/Dockerfile
+++ b/haskell_9.6/Dockerfile
@@ -3,7 +3,8 @@ FROM debian:bullseye
 ENV LANG=C.UTF-8
 
 # common haskell + stack dependencies
-RUN apt-get update && \
+RUN <<EOT
+    apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
@@ -22,115 +23,121 @@ RUN apt-get update && \
         xz-utils \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
+EOT
 
-ARG STACK=3.3.1
-ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
+ARG STACK='3.3.1'
+ARG STACK_RELEASE_KEY='C5705533DA4F78D8664B5DC0575159689BEFB442'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"
     # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$STACK_URL" -o stack.tar.gz; \
-    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-    gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-    gpgconf --kill all; \
-    \
-    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-    stack config set system-ghc --global true; \
-    stack config set install-ghc --global false; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in 
+        'aarch64') 
+            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'
+            ;;
+        'x86_64') 
+            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" exit 1 ;
+    esac
+    curl -sSL "$STACK_URL" -o stack.tar.gz
+    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check
+    
+    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc
+    GNUPGHOME="$(mktemp -d)"
+    export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"
+    gpg --batch --verify stack.tar.gz.asc stack.tar.gz
+    gpgconf --kill all
+    
+    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"
+    stack config set system-ghc --global true
+    stack config set install-ghc --global false
+    
+    rm -rf /tmp/*
+    
     stack --version;
+EOT
 
-ARG CABAL_INSTALL=3.12.1.0
-ARG CABAL_INSTALL_RELEASE_KEY=1E07C9A1A3088BAD47F74A3E227EE1942B0BDB95
+ARG CABAL_INSTALL='3.14.1.1'
+ARG CABAL_INSTALL_RELEASE_KEY='EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb11.tar.xz"; \
-    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"; \
-    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb11.tar.xz"
+    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"
+    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"
     # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            CABAL_INSTALL_SHA256='c14e8198407f37f7276c77b5cefef60ee6a929b4c22d7316577ce8e2301a758e'; \
-            ;; \
-        'x86_64') \
-            CABAL_INSTALL_SHA256='4f60cf1c72f4ad4d82d668839ac61ae15ae4faf6c4b809395799e8a3ee622051'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
-    esac; \
-    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz; \
-    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"; \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"; \
-    gpg --batch --verify SHA256SUMS.sig SHA256SUMS; \
+    case "$ARCH" in
+        'aarch64')
+            CABAL_INSTALL_SHA256='5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523'
+            ;;
+        'x86_64')
+            CABAL_INSTALL_SHA256='41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;;
+    esac
+    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz
+    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check
+
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"
+    gpg --batch --verify SHA256SUMS.sig SHA256SUMS
     # confirm we are verifying SHA256SUMS that matches the release + sha256
-    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS; \
-    gpgconf --kill all; \
-    \
-    tar -xf cabal-install.tar.gz -C /usr/local/bin; \
-    \
-    rm -rf /tmp/*; \
-    \
+    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS
+    gpgconf --kill all;
+
+    tar -xf cabal-install.tar.gz -C /usr/local/bin
+
+    rm -rf /tmp/*
+
     cabal --version
+EOT
 
-ARG GHC=9.6.7
-ARG GHC_RELEASE_KEY=8C961469C8FDC968718D6245AC7DE836C5DF907D
+ARG GHC='9.6.7'
+ARG GHC_RELEASE_KEY='8C961469C8FDC968718D6245AC7DE836C5DF907D'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb11-linux.tar.xz"
     # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            # Note: the 'aarch64-deb11' (bullseye) variant of images doesn't exist in https://downloads.haskell.org/~ghc/9.6.7/
-            # But deb10 (buster) images should be binary compatible with deb11, so using deb10 instead
-            GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb10-linux.tar.xz"; \
-            GHC_SHA256='3cfa843687856de304a946dbe849a497c4fdad021f0275628b8ca7b55ccf8082'; \
-            ;; \
-        'x86_64') \
-            GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb11-linux.tar.xz"; \
-            GHC_SHA256='fc6a6247d1831745c67b27d6212f6911c35a933043f3b6851724e2e01484d077'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$GHC_URL" -o ghc.tar.xz; \
-    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check; \
-    \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"; \
-    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz; \
-    gpgconf --kill all; \
-    \
-    tar xf ghc.tar.xz; \
-    cd "ghc-$GHC-$ARCH-unknown-linux"; \
-    ./configure --prefix "/opt/ghc/$GHC"; \
-    make install; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in
+        'aarch64')
+            GHC_SHA256='3cfa843687856de304a946dbe849a497c4fdad021f0275628b8ca7b55ccf8082'
+            GHC_URL='https://downloads.haskell.org/~ghc/9.6.7/ghc-9.6.7-aarch64-deb10-linux.tar.xz'
+            ;;
+        'x86_64')
+            GHC_SHA256='fc6a6247d1831745c67b27d6212f6911c35a933043f3b6851724e2e01484d077'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;;
+    esac
+    curl -sSL "$GHC_URL" -o ghc.tar.xz
+    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check
+
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"
+    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz
+    gpgconf --kill all
+
+    tar xf ghc.tar.xz
+    cd "ghc-$GHC-$ARCH-unknown-linux"
+    ./configure --prefix "/opt/ghc/$GHC"
+    make install
+
+    rm -rf /tmp/*
+
     "/opt/ghc/$GHC/bin/ghc" --version
+EOT
 
 ENV PATH=/root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
 
diff --git a/haskell_9.8-slim/Dockerfile b/haskell_9.8-slim/Dockerfile
index 2ffc0a5..9e47cd5 100644
--- a/haskell_9.8-slim/Dockerfile
+++ b/haskell_9.8-slim/Dockerfile
@@ -3,7 +3,8 @@ FROM debian:bullseye-slim
 ENV LANG=C.UTF-8
 
 # common haskell + stack dependencies
-RUN apt-get update && \
+RUN <<EOT
+    apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
@@ -22,112 +23,120 @@ RUN apt-get update && \
         xz-utils \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
+EOT
 
-ARG STACK=3.3.1
-ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
+ARG STACK='3.3.1'
+ARG STACK_RELEASE_KEY='C5705533DA4F78D8664B5DC0575159689BEFB442'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"
     # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$STACK_URL" -o stack.tar.gz; \
-    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-    gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-    gpgconf --kill all; \
-    \
-    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-    stack config set system-ghc --global true; \
-    stack config set install-ghc --global false; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in 
+        'aarch64') 
+            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'
+            ;;
+        'x86_64') 
+            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" exit 1 ;
+    esac
+    curl -sSL "$STACK_URL" -o stack.tar.gz
+    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check
+    
+    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc
+    GNUPGHOME="$(mktemp -d)"
+    export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"
+    gpg --batch --verify stack.tar.gz.asc stack.tar.gz
+    gpgconf --kill all
+    
+    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"
+    stack config set system-ghc --global true
+    stack config set install-ghc --global false
+    
+    rm -rf /tmp/*
+    
     stack --version;
+EOT
 
-ARG CABAL_INSTALL=3.12.1.0
-ARG CABAL_INSTALL_RELEASE_KEY=1E07C9A1A3088BAD47F74A3E227EE1942B0BDB95
+ARG CABAL_INSTALL='3.14.1.1'
+ARG CABAL_INSTALL_RELEASE_KEY='EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb11.tar.xz"; \
-    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"; \
-    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb11.tar.xz"
+    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"
+    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"
     # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            CABAL_INSTALL_SHA256='c14e8198407f37f7276c77b5cefef60ee6a929b4c22d7316577ce8e2301a758e'; \
-            ;; \
-        'x86_64') \
-            CABAL_INSTALL_SHA256='4f60cf1c72f4ad4d82d668839ac61ae15ae4faf6c4b809395799e8a3ee622051'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
-    esac; \
-    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz; \
-    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"; \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"; \
-    gpg --batch --verify SHA256SUMS.sig SHA256SUMS; \
+    case "$ARCH" in
+        'aarch64')
+            CABAL_INSTALL_SHA256='5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523'
+            ;;
+        'x86_64')
+            CABAL_INSTALL_SHA256='41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;;
+    esac
+    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz
+    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check
+
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"
+    gpg --batch --verify SHA256SUMS.sig SHA256SUMS
     # confirm we are verifying SHA256SUMS that matches the release + sha256
-    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS; \
-    gpgconf --kill all; \
-    \
-    tar -xf cabal-install.tar.gz -C /usr/local/bin; \
-    \
-    rm -rf /tmp/*; \
-    \
+    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS
+    gpgconf --kill all;
+
+    tar -xf cabal-install.tar.gz -C /usr/local/bin
+
+    rm -rf /tmp/*
+
     cabal --version
+EOT
 
-ARG GHC=9.8.4
-ARG GHC_RELEASE_KEY=FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD
+ARG GHC='9.8.4'
+ARG GHC_RELEASE_KEY='FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb11-linux.tar.xz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb11-linux.tar.xz"
     # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            GHC_SHA256='310204daf2df6ad16087be94b3498ca414a0953b29e94e8ec8eb4a5c9bf603d3'; \
-            ;; \
-        'x86_64') \
-            GHC_SHA256='af151db8682b8c763f5a44f960f65453d794c95b60f151abc82dbdefcbe6f8ad'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$GHC_URL" -o ghc.tar.xz; \
-    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check; \
-    \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"; \
-    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz; \
-    gpgconf --kill all; \
-    \
-    tar xf ghc.tar.xz; \
-    cd "ghc-$GHC-$ARCH-unknown-linux"; \
-    ./configure --prefix "/opt/ghc/$GHC"; \
-    make install; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in
+        'aarch64')
+            GHC_SHA256='310204daf2df6ad16087be94b3498ca414a0953b29e94e8ec8eb4a5c9bf603d3'
+            ;;
+        'x86_64')
+            GHC_SHA256='af151db8682b8c763f5a44f960f65453d794c95b60f151abc82dbdefcbe6f8ad'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;;
+    esac
+    curl -sSL "$GHC_URL" -o ghc.tar.xz
+    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check
+
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"
+    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz
+    gpgconf --kill all
+
+    tar xf ghc.tar.xz
+    cd "ghc-$GHC-$ARCH-unknown-linux"
+    ./configure --prefix "/opt/ghc/$GHC"
+    make install
+
+    rm -rf /tmp/*
+
     "/opt/ghc/$GHC/bin/ghc" --version
+EOT
 
 ENV PATH=/root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
 
diff --git a/haskell_9.8/Dockerfile b/haskell_9.8/Dockerfile
index afbf65f..7726fdf 100644
--- a/haskell_9.8/Dockerfile
+++ b/haskell_9.8/Dockerfile
@@ -3,7 +3,8 @@ FROM debian:bullseye
 ENV LANG=C.UTF-8
 
 # common haskell + stack dependencies
-RUN apt-get update && \
+RUN <<EOT
+    apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
@@ -22,112 +23,120 @@ RUN apt-get update && \
         xz-utils \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
+EOT
 
-ARG STACK=3.3.1
-ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
+ARG STACK='3.3.1'
+ARG STACK_RELEASE_KEY='C5705533DA4F78D8664B5DC0575159689BEFB442'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"
     # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$STACK_URL" -o stack.tar.gz; \
-    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-    gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-    gpgconf --kill all; \
-    \
-    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-    stack config set system-ghc --global true; \
-    stack config set install-ghc --global false; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in 
+        'aarch64') 
+            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'
+            ;;
+        'x86_64') 
+            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" exit 1 ;
+    esac
+    curl -sSL "$STACK_URL" -o stack.tar.gz
+    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check
+    
+    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc
+    GNUPGHOME="$(mktemp -d)"
+    export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"
+    gpg --batch --verify stack.tar.gz.asc stack.tar.gz
+    gpgconf --kill all
+    
+    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"
+    stack config set system-ghc --global true
+    stack config set install-ghc --global false
+    
+    rm -rf /tmp/*
+    
     stack --version;
+EOT
 
-ARG CABAL_INSTALL=3.12.1.0
-ARG CABAL_INSTALL_RELEASE_KEY=1E07C9A1A3088BAD47F74A3E227EE1942B0BDB95
+ARG CABAL_INSTALL='3.14.1.1'
+ARG CABAL_INSTALL_RELEASE_KEY='EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb11.tar.xz"; \
-    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"; \
-    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb11.tar.xz"
+    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"
+    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"
     # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            CABAL_INSTALL_SHA256='c14e8198407f37f7276c77b5cefef60ee6a929b4c22d7316577ce8e2301a758e'; \
-            ;; \
-        'x86_64') \
-            CABAL_INSTALL_SHA256='4f60cf1c72f4ad4d82d668839ac61ae15ae4faf6c4b809395799e8a3ee622051'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
-    esac; \
-    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz; \
-    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"; \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"; \
-    gpg --batch --verify SHA256SUMS.sig SHA256SUMS; \
+    case "$ARCH" in
+        'aarch64')
+            CABAL_INSTALL_SHA256='5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523'
+            ;;
+        'x86_64')
+            CABAL_INSTALL_SHA256='41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;;
+    esac
+    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz
+    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check
+
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"
+    gpg --batch --verify SHA256SUMS.sig SHA256SUMS
     # confirm we are verifying SHA256SUMS that matches the release + sha256
-    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS; \
-    gpgconf --kill all; \
-    \
-    tar -xf cabal-install.tar.gz -C /usr/local/bin; \
-    \
-    rm -rf /tmp/*; \
-    \
+    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS
+    gpgconf --kill all;
+
+    tar -xf cabal-install.tar.gz -C /usr/local/bin
+
+    rm -rf /tmp/*
+
     cabal --version
+EOT
 
-ARG GHC=9.8.4
-ARG GHC_RELEASE_KEY=FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD
+ARG GHC='9.8.4'
+ARG GHC_RELEASE_KEY='FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb11-linux.tar.xz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb11-linux.tar.xz"
     # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            GHC_SHA256='310204daf2df6ad16087be94b3498ca414a0953b29e94e8ec8eb4a5c9bf603d3'; \
-            ;; \
-        'x86_64') \
-            GHC_SHA256='af151db8682b8c763f5a44f960f65453d794c95b60f151abc82dbdefcbe6f8ad'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$GHC_URL" -o ghc.tar.xz; \
-    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check; \
-    \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"; \
-    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz; \
-    gpgconf --kill all; \
-    \
-    tar xf ghc.tar.xz; \
-    cd "ghc-$GHC-$ARCH-unknown-linux"; \
-    ./configure --prefix "/opt/ghc/$GHC"; \
-    make install; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in
+        'aarch64')
+            GHC_SHA256='310204daf2df6ad16087be94b3498ca414a0953b29e94e8ec8eb4a5c9bf603d3'
+            ;;
+        'x86_64')
+            GHC_SHA256='af151db8682b8c763f5a44f960f65453d794c95b60f151abc82dbdefcbe6f8ad'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;;
+    esac
+    curl -sSL "$GHC_URL" -o ghc.tar.xz
+    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check
+
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"
+    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz
+    gpgconf --kill all
+
+    tar xf ghc.tar.xz
+    cd "ghc-$GHC-$ARCH-unknown-linux"
+    ./configure --prefix "/opt/ghc/$GHC"
+    make install
+
+    rm -rf /tmp/*
+
     "/opt/ghc/$GHC/bin/ghc" --version
+EOT
 
 ENV PATH=/root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
 
diff --git a/haskell_latest/Dockerfile b/haskell_latest/Dockerfile
index 7978459..9d39f29 100644
--- a/haskell_latest/Dockerfile
+++ b/haskell_latest/Dockerfile
@@ -3,7 +3,8 @@ FROM debian:bookworm
 ENV LANG=C.UTF-8
 
 # common haskell + stack dependencies
-RUN apt-get update && \
+RUN <<EOT
+    apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
@@ -22,112 +23,120 @@ RUN apt-get update && \
         xz-utils \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
+EOT
 
-ARG STACK=3.3.1
-ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
+ARG STACK='3.3.1'
+ARG STACK_RELEASE_KEY='C5705533DA4F78D8664B5DC0575159689BEFB442'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"
     # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$STACK_URL" -o stack.tar.gz; \
-    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-    gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-    gpgconf --kill all; \
-    \
-    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-    stack config set system-ghc --global true; \
-    stack config set install-ghc --global false; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in 
+        'aarch64') 
+            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'
+            ;;
+        'x86_64') 
+            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" exit 1 ;
+    esac
+    curl -sSL "$STACK_URL" -o stack.tar.gz
+    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check
+    
+    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc
+    GNUPGHOME="$(mktemp -d)"
+    export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"
+    gpg --batch --verify stack.tar.gz.asc stack.tar.gz
+    gpgconf --kill all
+    
+    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"
+    stack config set system-ghc --global true
+    stack config set install-ghc --global false
+    
+    rm -rf /tmp/*
+    
     stack --version;
+EOT
 
-ARG CABAL_INSTALL=3.14.1.1
-ARG CABAL_INSTALL_RELEASE_KEY=EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF
+ARG CABAL_INSTALL='3.14.1.1'
+ARG CABAL_INSTALL_RELEASE_KEY='EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb12.tar.xz"; \
-    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"; \
-    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb12.tar.xz"
+    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"
+    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"
     # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            CABAL_INSTALL_SHA256='f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9'; \
-            ;; \
-        'x86_64') \
-            CABAL_INSTALL_SHA256='73a463306c771e18ca22c0a9469176ffab0138ec5925adb5364ef47174e1adc5'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
-    esac; \
-    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz; \
-    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"; \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"; \
-    gpg --batch --verify SHA256SUMS.sig SHA256SUMS; \
+    case "$ARCH" in
+        'aarch64')
+            CABAL_INSTALL_SHA256='f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9'
+            ;;
+        'x86_64')
+            CABAL_INSTALL_SHA256='73a463306c771e18ca22c0a9469176ffab0138ec5925adb5364ef47174e1adc5'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;;
+    esac
+    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz
+    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check
+
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"
+    gpg --batch --verify SHA256SUMS.sig SHA256SUMS
     # confirm we are verifying SHA256SUMS that matches the release + sha256
-    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS; \
-    gpgconf --kill all; \
-    \
-    tar -xf cabal-install.tar.gz -C /usr/local/bin; \
-    \
-    rm -rf /tmp/*; \
-    \
+    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS
+    gpgconf --kill all;
+
+    tar -xf cabal-install.tar.gz -C /usr/local/bin
+
+    rm -rf /tmp/*
+
     cabal --version
+EOT
 
-ARG GHC=9.12.2
-ARG GHC_RELEASE_KEY=FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD
+ARG GHC='9.12.2'
+ARG GHC_RELEASE_KEY='FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb12-linux.tar.xz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb12-linux.tar.xz"
     # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            GHC_SHA256='bee95bc91a621d8a2e9a9d86dac28ff839605e87316518dae12c779709bd58f1'; \
-            ;; \
-        'x86_64') \
-            GHC_SHA256='447ec2fcc773ae9ebc3f39766c719641631274f9b765d7426a8cbe9241677c9f'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$GHC_URL" -o ghc.tar.xz; \
-    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check; \
-    \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"; \
-    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz; \
-    gpgconf --kill all; \
-    \
-    tar xf ghc.tar.xz; \
-    cd "ghc-$GHC-$ARCH-unknown-linux"; \
-    ./configure --prefix "/opt/ghc/$GHC"; \
-    make install; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in
+        'aarch64')
+            GHC_SHA256='bee95bc91a621d8a2e9a9d86dac28ff839605e87316518dae12c779709bd58f1'
+            ;;
+        'x86_64')
+            GHC_SHA256='447ec2fcc773ae9ebc3f39766c719641631274f9b765d7426a8cbe9241677c9f'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;;
+    esac
+    curl -sSL "$GHC_URL" -o ghc.tar.xz
+    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check
+
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"
+    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz
+    gpgconf --kill all
+
+    tar xf ghc.tar.xz
+    cd "ghc-$GHC-$ARCH-unknown-linux"
+    ./configure --prefix "/opt/ghc/$GHC"
+    make install
+
+    rm -rf /tmp/*
+
     "/opt/ghc/$GHC/bin/ghc" --version
+EOT
 
 ENV PATH=/root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
 
diff --git a/haskell_slim-bullseye/Dockerfile b/haskell_slim-bullseye/Dockerfile
index e4ad370..1d6d98c 100644
--- a/haskell_slim-bullseye/Dockerfile
+++ b/haskell_slim-bullseye/Dockerfile
@@ -3,7 +3,8 @@ FROM debian:bullseye-slim
 ENV LANG=C.UTF-8
 
 # common haskell + stack dependencies
-RUN apt-get update && \
+RUN <<EOT
+    apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
@@ -22,112 +23,120 @@ RUN apt-get update && \
         xz-utils \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
+EOT
 
-ARG STACK=3.3.1
-ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
+ARG STACK='3.3.1'
+ARG STACK_RELEASE_KEY='C5705533DA4F78D8664B5DC0575159689BEFB442'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"
     # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$STACK_URL" -o stack.tar.gz; \
-    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-    gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-    gpgconf --kill all; \
-    \
-    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-    stack config set system-ghc --global true; \
-    stack config set install-ghc --global false; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in 
+        'aarch64') 
+            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'
+            ;;
+        'x86_64') 
+            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" exit 1 ;
+    esac
+    curl -sSL "$STACK_URL" -o stack.tar.gz
+    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check
+    
+    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc
+    GNUPGHOME="$(mktemp -d)"
+    export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"
+    gpg --batch --verify stack.tar.gz.asc stack.tar.gz
+    gpgconf --kill all
+    
+    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"
+    stack config set system-ghc --global true
+    stack config set install-ghc --global false
+    
+    rm -rf /tmp/*
+    
     stack --version;
+EOT
 
-ARG CABAL_INSTALL=3.12.1.0
-ARG CABAL_INSTALL_RELEASE_KEY=1E07C9A1A3088BAD47F74A3E227EE1942B0BDB95
+ARG CABAL_INSTALL='3.14.1.1'
+ARG CABAL_INSTALL_RELEASE_KEY='EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb11.tar.xz"; \
-    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"; \
-    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb11.tar.xz"
+    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"
+    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"
     # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            CABAL_INSTALL_SHA256='c14e8198407f37f7276c77b5cefef60ee6a929b4c22d7316577ce8e2301a758e'; \
-            ;; \
-        'x86_64') \
-            CABAL_INSTALL_SHA256='4f60cf1c72f4ad4d82d668839ac61ae15ae4faf6c4b809395799e8a3ee622051'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
-    esac; \
-    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz; \
-    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"; \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"; \
-    gpg --batch --verify SHA256SUMS.sig SHA256SUMS; \
+    case "$ARCH" in
+        'aarch64')
+            CABAL_INSTALL_SHA256='5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523'
+            ;;
+        'x86_64')
+            CABAL_INSTALL_SHA256='41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;;
+    esac
+    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz
+    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check
+
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"
+    gpg --batch --verify SHA256SUMS.sig SHA256SUMS
     # confirm we are verifying SHA256SUMS that matches the release + sha256
-    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS; \
-    gpgconf --kill all; \
-    \
-    tar -xf cabal-install.tar.gz -C /usr/local/bin; \
-    \
-    rm -rf /tmp/*; \
-    \
+    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS
+    gpgconf --kill all;
+
+    tar -xf cabal-install.tar.gz -C /usr/local/bin
+
+    rm -rf /tmp/*
+
     cabal --version
+EOT
 
-ARG GHC=9.10.2
-ARG GHC_RELEASE_KEY=88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4
+ARG GHC='9.10.3'
+ARG GHC_RELEASE_KEY='88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb11-linux.tar.xz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb11-linux.tar.xz"
     # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            GHC_SHA256='0188ca098abdaf71eb0804d0f35311f405da489137d8d438bfaa43b8d1e3f1b0'; \
-            ;; \
-        'x86_64') \
-            GHC_SHA256='2fe2c3e0a07e4782530e8bf83eeda8ff6935e40d5450c1809abcdc6182c9c848'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$GHC_URL" -o ghc.tar.xz; \
-    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check; \
-    \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"; \
-    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz; \
-    gpgconf --kill all; \
-    \
-    tar xf ghc.tar.xz; \
-    cd "ghc-$GHC-$ARCH-unknown-linux"; \
-    ./configure --prefix "/opt/ghc/$GHC"; \
-    make install; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in
+        'aarch64')
+            GHC_SHA256='052789dfe7f6fba6dc3822de0da272e8a5bd358c37adae17d8e82cff39bc1008'
+            ;;
+        'x86_64')
+            GHC_SHA256='b6bbd3514e0cdb9db350812a003bb7c670c58d99779086fbe41092b019548924'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;;
+    esac
+    curl -sSL "$GHC_URL" -o ghc.tar.xz
+    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check
+
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"
+    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz
+    gpgconf --kill all
+
+    tar xf ghc.tar.xz
+    cd "ghc-$GHC-$ARCH-unknown-linux"
+    ./configure --prefix "/opt/ghc/$GHC"
+    make install
+
+    rm -rf /tmp/*
+
     "/opt/ghc/$GHC/bin/ghc" --version
+EOT
 
 ENV PATH=/root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
 
diff --git a/haskell_slim/Dockerfile b/haskell_slim/Dockerfile
index 0a3e2dc..3a660ba 100644
--- a/haskell_slim/Dockerfile
+++ b/haskell_slim/Dockerfile
@@ -3,7 +3,8 @@ FROM debian:bookworm-slim
 ENV LANG=C.UTF-8
 
 # common haskell + stack dependencies
-RUN apt-get update && \
+RUN <<EOT
+    apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
@@ -22,112 +23,120 @@ RUN apt-get update && \
         xz-utils \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
+EOT
 
-ARG STACK=3.3.1
-ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
+ARG STACK='3.3.1'
+ARG STACK_RELEASE_KEY='C5705533DA4F78D8664B5DC0575159689BEFB442'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"
     # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$STACK_URL" -o stack.tar.gz; \
-    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-    gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-    gpgconf --kill all; \
-    \
-    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-    stack config set system-ghc --global true; \
-    stack config set install-ghc --global false; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in 
+        'aarch64') 
+            STACK_SHA256='bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'
+            ;;
+        'x86_64') 
+            STACK_SHA256='88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" exit 1 ;
+    esac
+    curl -sSL "$STACK_URL" -o stack.tar.gz
+    echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check
+    
+    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc
+    GNUPGHOME="$(mktemp -d)"
+    export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"
+    gpg --batch --verify stack.tar.gz.asc stack.tar.gz
+    gpgconf --kill all
+    
+    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"
+    stack config set system-ghc --global true
+    stack config set install-ghc --global false
+    
+    rm -rf /tmp/*
+    
     stack --version;
+EOT
 
-ARG CABAL_INSTALL=3.14.1.1
-ARG CABAL_INSTALL_RELEASE_KEY=EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF
+ARG CABAL_INSTALL='3.14.1.1'
+ARG CABAL_INSTALL_RELEASE_KEY='EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb12.tar.xz"; \
-    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"; \
-    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-deb12.tar.xz"
+    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"
+    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"
     # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            CABAL_INSTALL_SHA256='f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9'; \
-            ;; \
-        'x86_64') \
-            CABAL_INSTALL_SHA256='73a463306c771e18ca22c0a9469176ffab0138ec5925adb5364ef47174e1adc5'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
-    esac; \
-    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz; \
-    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check; \
-    \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"; \
-    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"; \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"; \
-    gpg --batch --verify SHA256SUMS.sig SHA256SUMS; \
+    case "$ARCH" in
+        'aarch64')
+            CABAL_INSTALL_SHA256='f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9'
+            ;;
+        'x86_64')
+            CABAL_INSTALL_SHA256='73a463306c771e18ca22c0a9469176ffab0138ec5925adb5364ef47174e1adc5'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;;
+    esac
+    curl -fSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz
+    echo "$CABAL_INSTALL_SHA256 cabal-install.tar.gz" | sha256sum --strict --check
+
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"
+    gpg --batch --verify SHA256SUMS.sig SHA256SUMS
     # confirm we are verifying SHA256SUMS that matches the release + sha256
-    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS; \
-    gpgconf --kill all; \
-    \
-    tar -xf cabal-install.tar.gz -C /usr/local/bin; \
-    \
-    rm -rf /tmp/*; \
-    \
+    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS
+    gpgconf --kill all;
+
+    tar -xf cabal-install.tar.gz -C /usr/local/bin
+
+    rm -rf /tmp/*
+
     cabal --version
+EOT
 
-ARG GHC=9.12.2
-ARG GHC_RELEASE_KEY=FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD
+ARG GHC='9.12.2'
+ARG GHC_RELEASE_KEY='FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD'
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb12-linux.tar.xz"; \
+RUN <<EOT
+    set -eux
+    cd /tmp
+    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-deb12-linux.tar.xz"
     # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
-    case "$ARCH" in \
-        'aarch64') \
-            GHC_SHA256='bee95bc91a621d8a2e9a9d86dac28ff839605e87316518dae12c779709bd58f1'; \
-            ;; \
-        'x86_64') \
-            GHC_SHA256='447ec2fcc773ae9ebc3f39766c719641631274f9b765d7426a8cbe9241677c9f'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    curl -sSL "$GHC_URL" -o ghc.tar.xz; \
-    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check; \
-    \
-    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig; \
-    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"; \
-    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz; \
-    gpgconf --kill all; \
-    \
-    tar xf ghc.tar.xz; \
-    cd "ghc-$GHC-$ARCH-unknown-linux"; \
-    ./configure --prefix "/opt/ghc/$GHC"; \
-    make install; \
-    \
-    rm -rf /tmp/*; \
-    \
+    case "$ARCH" in
+        'aarch64')
+            GHC_SHA256='bee95bc91a621d8a2e9a9d86dac28ff839605e87316518dae12c779709bd58f1'
+            ;;
+        'x86_64')
+            GHC_SHA256='447ec2fcc773ae9ebc3f39766c719641631274f9b765d7426a8cbe9241677c9f'
+            ;;
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;;
+    esac
+    curl -sSL "$GHC_URL" -o ghc.tar.xz
+    echo "$GHC_SHA256 ghc.tar.xz" | sha256sum --strict --check
+
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME
+    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"
+    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz
+    gpgconf --kill all
+
+    tar xf ghc.tar.xz
+    cd "ghc-$GHC-$ARCH-unknown-linux"
+    ./configure --prefix "/opt/ghc/$GHC"
+    make install
+
+    rm -rf /tmp/*
+
     "/opt/ghc/$GHC/bin/ghc" --version
+EOT
 
 ENV PATH=/root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH

Relevant Maintainers:

develop7
develop7 reviewed Oct 30, 2025
View reviewed changes
Copy link
Contributor

@develop7 develop7 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since you've updated commit hashes for the rest of GHCs, I'd suggest to mention it in the PR description/title, something along the lines of "refreshed Dockerfiles".

Also latest are subject to eventual upgrade anyway, so it's fine by me to move it forward every so often

@Totto16
Copy link
Author

Totto16 commented Oct 30, 2025

Since you've updated commit hashes for the rest of GHCs, I'd suggest to mention it in the PR description/title, something along the lines of "refreshed Dockerfiles".

Also latest are subject to eventual upgrade anyway, so it's fine by me to move it forward every so often

I just did the same as #19733, which also updated all commit ids 😓

@Totto16 Totto16 changed the title Haskell: bump ghc 9.10 to 9.10.3 Haskell: bump ghc 9.10 to 9.10.3 + refreshed Dockerfiles Oct 30, 2025
@tianon
Copy link
Member

tianon commented Oct 30, 2025

Unfortunately the nature of our build system requires that we parse all our Dockerfiles to determine build ordering, and that parsing does not support the BuildKit heredocs syntax.

As a meta-point, updating the commit for everything is totally fine and reasonable for image maintainers; I think the point was just that it should be noted that the PR does more than just the version bump in the PR description. 😄

If it's easier to maintain that way, you can make that even easier by dropping all the individual GitCommit: lines and specifying a single GitCommit: line up at the top in what we call the "global entry" right next to GitRepo: instead. 👀

(For repositories we maintain, we generally automate the generation of this file to help us avoid typos in things like version numbers. 😅)

@Totto16
Copy link
Author

Totto16 commented Nov 3, 2025

@tianon @develop7 So do I need to change something here, or is it fine as is?

Also latest are subject to eventual upgrade anyway, so it's fine by me to move it forward every so often

So would it be better to adjust the labels 9.10.3, 9.10 to the bookworm image or not?

It would be neat to at least get 9.10.3 available, so that the stackage lts-24.12 and upwards can be used 😄

@yosifkit
Copy link
Member

yosifkit commented Nov 3, 2025

Unfortunately the nature of our build system requires that we parse all our Dockerfiles to determine build ordering, and that parsing does not support the BuildKit heredocs syntax.

So do I need to change something here, or is it fine as is?

The Dockerfiles need to be changed because our build system does not support Dockerfiles with heredoc syntax (e.g. RUN <<EOT).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@develop7 develop7 develop7 left review comments

Reviewers whose approvals may not affect merge requirements

At least 0 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

library/haskell

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@Totto16 @tianon @yosifkit @develop7