diff --git a/nixos/doc/manual/release-notes/rl-1809.xml b/nixos/doc/manual/release-notes/rl-1809.xml index f57fd75c782d8..d3062b3ea3230 100644 --- a/nixos/doc/manual/release-notes/rl-1809.xml +++ b/nixos/doc/manual/release-notes/rl-1809.xml @@ -306,6 +306,22 @@ inherit (pkgs.nixos { was not used and thus has been removed. + + + The option services.kubernetes.addons.dashboard.enableRBAC + was renamed to services.kubernetes.addons.dashboard.rbac.enable. + + + + + The Kubernetes Dashboard now has only minimal RBAC permissions by default. + If dashboard cluster-admin rights are desired, + set services.kubernetes.addons.dashboard.rbac.clusterAdmin to true. + On existing clusters, in order for the revocation of privileges to take effect, + the current ClusterRoleBinding for kubernetes-dashboard must be manually removed: + kubectl delete clusterrolebinding kubernetes-dashboard + + diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix index 2df737452fbc3..e3691843e170d 100644 --- a/nixos/modules/rename.nix +++ b/nixos/modules/rename.nix @@ -34,6 +34,7 @@ with lib; (mkRenamedOptionModule [ "services" "kubernetes" "apiserver" "admissionControl" ] [ "services" "kubernetes" "apiserver" "enableAdmissionPlugins" ]) (mkRenamedOptionModule [ "services" "kubernetes" "apiserver" "address" ] ["services" "kubernetes" "apiserver" "bindAddress"]) (mkRemovedOptionModule [ "services" "kubernetes" "apiserver" "publicAddress" ] "") + (mkRenamedOptionModule [ "services" "kubernetes" "addons" "dashboard" "enableRBAC" ] [ "services" "kubernetes" "addons" "dashboard" "rbac" "enable" ]) (mkRenamedOptionModule [ "services" "logstash" "address" ] [ "services" "logstash" "listenAddress" ]) (mkRenamedOptionModule [ "services" "mpd" "network" "host" ] [ "services" "mpd" "network" "listenAddress" ]) (mkRenamedOptionModule [ "services" "neo4j" "host" ] [ "services" "neo4j" "listenAddress" ]) diff --git a/nixos/modules/services/cluster/kubernetes/dashboard.nix b/nixos/modules/services/cluster/kubernetes/dashboard.nix index 9c1f814b683cf..6d9faada44018 100644 --- a/nixos/modules/services/cluster/kubernetes/dashboard.nix +++ b/nixos/modules/services/cluster/kubernetes/dashboard.nix @@ -8,10 +8,25 @@ in { options.services.kubernetes.addons.dashboard = { enable = mkEnableOption "kubernetes dashboard addon"; - enableRBAC = mkOption { - description = "Whether to enable role based access control is enabled for kubernetes dashboard"; - type = types.bool; - default = elem "RBAC" config.services.kubernetes.apiserver.authorizationMode; + rbac = mkOption { + description = "Role-based access control (RBAC) options"; + type = types.submodule { + + options = { + enable = mkOption { + description = "Whether to enable role based access control is enabled for kubernetes dashboard"; + type = types.bool; + default = elem "RBAC" config.services.kubernetes.apiserver.authorizationMode; + }; + + clusterAdmin = mkOption { + description = "Whether to assign cluster admin rights to the kubernetes dashboard"; + type = types.bool; + default = false; + }; + + }; + }; }; version = mkOption { @@ -202,29 +217,106 @@ in { namespace = "kube-system"; }; }; - } // (optionalAttrs cfg.enableRBAC { - kubernetes-dashboard-crb = { - apiVersion = "rbac.authorization.k8s.io/v1"; - kind = "ClusterRoleBinding"; - metadata = { - name = "kubernetes-dashboard"; - labels = { - k8s-app = "kubernetes-dashboard"; - k8s-addon = "kubernetes-dashboard.addons.k8s.io"; - "addonmanager.kubernetes.io/mode" = "Reconcile"; - }; - }; - roleRef = { - apiGroup = "rbac.authorization.k8s.io"; - kind = "ClusterRole"; - name = "cluster-admin"; - }; + } // (optionalAttrs cfg.rbac.enable + (let subjects = [{ kind = "ServiceAccount"; name = "kubernetes-dashboard"; namespace = "kube-system"; }]; - }; - }); + labels = { + k8s-app = "kubernetes-dashboard"; + k8s-addon = "kubernetes-dashboard.addons.k8s.io"; + "addonmanager.kubernetes.io/mode" = "Reconcile"; + }; + in + (if cfg.rbac.clusterAdmin then { + kubernetes-dashboard-crb = { + apiVersion = "rbac.authorization.k8s.io/v1"; + kind = "ClusterRoleBinding"; + metadata = { + name = "kubernetes-dashboard"; + inherit labels; + }; + roleRef = { + apiGroup = "rbac.authorization.k8s.io"; + kind = "ClusterRole"; + name = "cluster-admin"; + }; + inherit subjects; + }; + } + else + { + # Upstream role- and rolebinding as per: + # https://raw.githubusercontent.com/kubernetes/dashboard/master/src/deploy/alternative/kubernetes-dashboard.yaml + kubernetes-dashboard-role = { + apiVersion = "rbac.authorization.k8s.io/v1"; + kind = "Role"; + metadata = { + name = "kubernetes-dashboard-minimal"; + namespace = "kube-system"; + inherit labels; + }; + rules = [ + # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret. + { + apiGroups = [""]; + resources = ["secrets"]; + verbs = ["create"]; + } + # Allow Dashboard to create 'kubernetes-dashboard-settings' config map. + { + apiGroups = [""]; + resources = ["configmaps"]; + verbs = ["create"]; + } + # Allow Dashboard to get, update and delete Dashboard exclusive secrets. + { + apiGroups = [""]; + resources = ["secrets"]; + resourceNames = ["kubernetes-dashboard-key-holder"]; + verbs = ["get" "update" "delete"]; + } + # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map. + { + apiGroups = [""]; + resources = ["configmaps"]; + resourceNames = ["kubernetes-dashboard-settings"]; + verbs = ["get" "update"]; + } + # Allow Dashboard to get metrics from heapster. + { + apiGroups = [""]; + resources = ["services"]; + resourceNames = ["heapster"]; + verbs = ["proxy"]; + } + { + apiGroups = [""]; + resources = ["services/proxy"]; + resourceNames = ["heapster" "http:heapster:" "https:heapster:"]; + verbs = ["get"]; + } + ]; + }; + + kubernetes-dashboard-rb = { + apiVersion = "rbac.authorization.k8s.io/v1"; + kind = "RoleBinding"; + metadata = { + name = "kubernetes-dashboard-minimal"; + namespace = "kube-system"; + inherit labels; + }; + roleRef = { + apiGroup = "rbac.authorization.k8s.io"; + kind = "Role"; + name = "kubernetes-dashboard-minimal"; + }; + inherit subjects; + }; + }) + )); }; } diff --git a/nixos/modules/services/cluster/kubernetes/default.nix b/nixos/modules/services/cluster/kubernetes/default.nix index 20f2308508c62..5e87ae88f5a88 100644 --- a/nixos/modules/services/cluster/kubernetes/default.nix +++ b/nixos/modules/services/cluster/kubernetes/default.nix @@ -332,11 +332,11 @@ in { authorizationMode = mkOption { description = '' - Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/RBAC). See + Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/Webhook/RBAC/Node). See ''; default = ["RBAC" "Node"]; - type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "RBAC" "Node"]); + type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "Webhook" "RBAC" "Node"]); }; authorizationPolicy = mkOption { @@ -348,6 +348,15 @@ in { type = types.listOf types.attrs; }; + webhookConfig = mkOption { + description = '' + Kubernetes apiserver Webhook config file. It uses the kubeconfig file format. + See + ''; + default = null; + type = types.nullOr types.path; + }; + allowPrivileged = mkOption { description = "Whether to allow privileged containers on Kubernetes."; default = true; @@ -943,6 +952,9 @@ in { (concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.apiserver.authorizationPolicy) }" } \ + ${optionalString (elem "Webhook" cfg.apiserver.authorizationMode) + "--authorization-webhook-config-file=${cfg.apiserver.webhookConfig}" + } \ --secure-port=${toString cfg.apiserver.securePort} \ --service-cluster-ip-range=${cfg.apiserver.serviceClusterIpRange} \ ${optionalString (cfg.apiserver.runtimeConfig != "") diff --git a/pkgs/applications/graphics/inkscape/default.nix b/pkgs/applications/graphics/inkscape/default.nix index 0d01a6313585c..639f1928f8a4b 100644 --- a/pkgs/applications/graphics/inkscape/default.nix +++ b/pkgs/applications/graphics/inkscape/default.nix @@ -39,9 +39,9 @@ stdenv.mkDerivation rec { --replace '"python-interpreter", "python"' '"python-interpreter", "${python2Env}/bin/python"' ''; - nativeBuildInputs = [ pkgconfig cmake makeWrapper python2Env ]; + nativeBuildInputs = [ pkgconfig cmake makeWrapper python2Env perl perlXMLParser ]; buildInputs = [ - perl perlXMLParser libXft libpng zlib popt boehmgc + libXft libpng zlib popt boehmgc libxml2 libxslt glib gtkmm2 glibmm libsigcxx lcms boost gettext gsl poppler imagemagick libwpg librevenge libvisio libcdr libexif potrace diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix index f3afeced8f65e..42038426515e2 100644 --- a/pkgs/applications/networking/sniffers/wireshark/default.nix +++ b/pkgs/applications/networking/sniffers/wireshark/default.nix @@ -12,7 +12,7 @@ assert withQt -> !withGtk && qt5 != null; with stdenv.lib; let - version = "2.4.7"; + version = "2.6.1"; variant = if withGtk then "gtk" else if withQt then "qt" else "cli"; in stdenv.mkDerivation { @@ -20,7 +20,7 @@ in stdenv.mkDerivation { src = fetchurl { url = "http://www.wireshark.org/download/src/all-versions/wireshark-${version}.tar.xz"; - sha256 = "0i2ggkkx7fphsk7kv9kygsf5pcaf4vgnqgi8mj1rrf2gfdl3rjsy"; + sha256 = "126dvd6myjbxjr69dy9vzzdda2lmjy1wwwc6gcs5djb46jy5nvmb"; }; cmakeFlags = [ @@ -52,6 +52,10 @@ in stdenv.mkDerivation { }) ++ stdenv.lib.optional stdenv.isDarwin ./cmake.patch; + preBuild = '' + export LD_LIBRARY_PATH="$PWD/run" + ''; + postInstall = if stdenv.isDarwin then '' ${optionalString withQt '' mkdir -p $out/Applications @@ -72,6 +76,8 @@ in stdenv.mkDerivation { ''} ${optionalString withQt '' install -Dm644 -t $out/share/applications ../wireshark.desktop + wrapProgram $out/bin/wireshark \ + --set QT_PLUGIN_PATH ${qt5.qtbase.bin}/${qt5.qtbase.qtPluginPrefix} ''} substituteInPlace $out/share/applications/*.desktop \ diff --git a/pkgs/development/compilers/ghc/8.4.2.nix b/pkgs/development/compilers/ghc/8.4.2.nix deleted file mode 100644 index ac8d76c63ed6d..0000000000000 --- a/pkgs/development/compilers/ghc/8.4.2.nix +++ /dev/null @@ -1,208 +0,0 @@ -{ stdenv, targetPackages -, buildPlatform, hostPlatform, targetPlatform - -# build-tools -, bootPkgs, alex, happy, hscolour -, autoconf, automake, coreutils, fetchurl, fetchpatch, perl, python3, m4 - -, libffi, libiconv ? null, ncurses - -, useLLVM ? !targetPlatform.isx86 -, # LLVM is conceptually a run-time-only depedendency, but for - # non-x86, we need LLVM to bootstrap later stages, so it becomes a - # build-time dependency too. - buildLlvmPackages, llvmPackages - -, # If enabled, GHC will be built with the GPL-free but slower integer-simple - # library instead of the faster but GPLed integer-gmp library. - enableIntegerSimple ? !(gmp.meta.available or false), gmp - -, # If enabled, use -fPIC when compiling static libs. - enableRelocatedStaticLibs ? targetPlatform != hostPlatform - -, # Whether to build dynamic libs for the standard library (on the target - # platform). Static libs are always built. - enableShared ? !targetPlatform.isWindows && !targetPlatform.useAndroidPrebuilt && !targetPlatform.useiOSPrebuilt - -, # Whetherto build terminfo. - enableTerminfo ? !targetPlatform.isWindows - -, # What flavour to build. An empty string indicates no - # specific flavour and falls back to ghc default values. - ghcFlavour ? stdenv.lib.optionalString (targetPlatform != hostPlatform) "perf-cross" -}: - -let - inherit (bootPkgs) ghc; - - # TODO(@Ericson2314) Make unconditional - targetPrefix = stdenv.lib.optionalString - (targetPlatform != hostPlatform) - "${targetPlatform.config}-"; - - buildMK = '' - BuildFlavour = ${ghcFlavour} - ifneq \"\$(BuildFlavour)\" \"\" - include mk/flavours/\$(BuildFlavour).mk - endif - DYNAMIC_GHC_PROGRAMS = ${if enableShared then "YES" else "NO"} - '' + stdenv.lib.optionalString enableIntegerSimple '' - INTEGER_LIBRARY = integer-simple - '' + stdenv.lib.optionalString (targetPlatform != hostPlatform) '' - Stage1Only = YES - HADDOCK_DOCS = NO - BUILD_SPHINX_HTML = NO - BUILD_SPHINX_PDF = NO - '' + stdenv.lib.optionalString enableRelocatedStaticLibs '' - GhcLibHcOpts += -fPIC - GhcRtsHcOpts += -fPIC - '' + stdenv.lib.optionalString targetPlatform.useAndroidPrebuilt '' - EXTRA_CC_OPTS += -std=gnu99 - ''; - - # Splicer will pull out correct variations - libDeps = platform: stdenv.lib.optional enableTerminfo [ ncurses ] - ++ stdenv.lib.optional (!enableIntegerSimple) gmp - ++ stdenv.lib.optional (platform.libc != "glibc" && !targetPlatform.isWindows) libiconv; - - toolsForTarget = - if hostPlatform == buildPlatform then - [ targetPackages.stdenv.cc ] ++ stdenv.lib.optional useLLVM llvmPackages.llvm - else assert targetPlatform == hostPlatform; # build != host == target - [ stdenv.cc ] ++ stdenv.lib.optional useLLVM buildLlvmPackages.llvm; - - targetCC = builtins.head toolsForTarget; - -in -stdenv.mkDerivation rec { - version = "8.4.2"; - name = "${targetPrefix}ghc-${version}"; - - src = fetchurl { - url = "https://downloads.haskell.org/~ghc/${version}/ghc-${version}-src.tar.xz"; - sha256 = "0yq4y0smn92sksnjjva28b8847krxizns6rm50j3pgq69br35k01"; - }; - - enableParallelBuilding = true; - - outputs = [ "out" "doc" ]; - - patches = [(fetchpatch { - url = "https://git.haskell.org/hsc2hs.git/patch/738f3666c878ee9e79c3d5e819ef8b3460288edf"; - sha256 = "0plzsbfaq6vb1023lsarrjglwgr9chld4q3m99rcfzx0yx5mibp3"; - extraPrefix = "utils/hsc2hs/"; - stripLen = 1; - })] - ++ stdenv.lib.optional stdenv.isDarwin ./backport-dylib-command-size-limit.patch; - - postPatch = "patchShebangs ."; - - # GHC is a bit confused on its cross terminology. - preConfigure = '' - for env in $(env | grep '^TARGET_' | sed -E 's|\+?=.*||'); do - export "''${env#TARGET_}=''${!env}" - done - # GHC is a bit confused on its cross terminology, as these would normally be - # the *host* tools. - export CC="${targetCC}/bin/${targetCC.targetPrefix}cc" - export CXX="${targetCC}/bin/${targetCC.targetPrefix}cxx" - # Use gold to work around https://sourceware.org/bugzilla/show_bug.cgi?id=16177 - export LD="${targetCC.bintools}/bin/${targetCC.bintools.targetPrefix}ld${stdenv.lib.optionalString targetPlatform.isAarch32 ".gold"}" - export AS="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}as" - export AR="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ar" - export NM="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}nm" - export RANLIB="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ranlib" - export READELF="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}readelf" - export STRIP="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}strip" - - echo -n "${buildMK}" > mk/build.mk - sed -i -e 's|-isysroot /Developer/SDKs/MacOSX10.5.sdk||' configure - '' + stdenv.lib.optionalString (!stdenv.isDarwin) '' - export NIX_LDFLAGS+=" -rpath $out/lib/ghc-${version}" - '' + stdenv.lib.optionalString stdenv.isDarwin '' - export NIX_LDFLAGS+=" -no_dtrace_dof" - ''; - - # TODO(@Ericson2314): Always pass "--target" and always prefix. - configurePlatforms = [ "build" "host" ] - ++ stdenv.lib.optional (targetPlatform != hostPlatform) "target"; - # `--with` flags for libraries needed for RTS linker - configureFlags = [ - "--datadir=$doc/share/doc/ghc" - "--with-curses-includes=${ncurses.dev}/include" "--with-curses-libraries=${ncurses.out}/lib" - ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && ! enableIntegerSimple) [ - "--with-gmp-includes=${gmp.dev}/include" "--with-gmp-libraries=${gmp.out}/lib" - ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && hostPlatform.libc != "glibc" && !targetPlatform.isWindows) [ - "--with-iconv-includes=${libiconv}/include" "--with-iconv-libraries=${libiconv}/lib" - ] ++ stdenv.lib.optionals (targetPlatform != hostPlatform) [ - "--enable-bootstrap-with-devel-snapshot" - ] ++ stdenv.lib.optionals (targetPlatform.isAarch32) [ - "CFLAGS=-fuse-ld=gold" - "CONF_GCC_LINKER_OPTS_STAGE1=-fuse-ld=gold" - "CONF_GCC_LINKER_OPTS_STAGE2=-fuse-ld=gold" - ] ++ stdenv.lib.optionals (targetPlatform.isDarwin && targetPlatform.isAarch64) [ - # fix for iOS: https://www.reddit.com/r/haskell/comments/4ttdz1/building_an_osxi386_to_iosarm64_cross_compiler/d5qvd67/ - "--disable-large-address-space" - ]; - - # Make sure we never relax`$PATH` and hooks support for compatability. - strictDeps = true; - - nativeBuildInputs = [ - perl autoconf automake m4 python3 - ghc alex happy hscolour - ]; - - # For building runtime libs - depsBuildTarget = toolsForTarget; - - buildInputs = libDeps hostPlatform; - - propagatedBuildInputs = [ targetPackages.stdenv.cc ] - ++ stdenv.lib.optional useLLVM llvmPackages.llvm; - - depsTargetTarget = map stdenv.lib.getDev (libDeps targetPlatform); - depsTargetTargetPropagated = map (stdenv.lib.getOutput "out") (libDeps targetPlatform); - - # required, because otherwise all symbols from HSffi.o are stripped, and - # that in turn causes GHCi to abort - stripDebugFlags = [ "-S" ] ++ stdenv.lib.optional (!targetPlatform.isDarwin) "--keep-file-symbols"; - - checkTarget = "test"; - - hardeningDisable = [ "format" ]; - - postInstall = '' - for bin in "$out"/lib/${name}/bin/*; do - isELF "$bin" || continue - paxmark m "$bin" - done - - # Install the bash completion file. - install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc - - # Patch scripts to include "readelf" and "cat" in $PATH. - for i in "$out/bin/"*; do - test ! -h $i || continue - egrep --quiet '^#!' <(head -n 1 $i) || continue - sed -i -e '2i export PATH="$PATH:${stdenv.lib.makeBinPath [ targetPackages.stdenv.cc.bintools coreutils ]}"' $i - done - ''; - - passthru = { - inherit bootPkgs targetPrefix; - - inherit llvmPackages; - - # Our Cabal compiler name - haskellCompilerName = "ghc-8.4.2"; - }; - - meta = { - homepage = http://haskell.org/ghc; - description = "The Glasgow Haskell Compiler"; - maintainers = with stdenv.lib.maintainers; [ marcweber andres peti ]; - inherit (ghc.meta) license platforms; - }; - -} diff --git a/pkgs/tools/misc/entr/default.nix b/pkgs/tools/misc/entr/default.nix index b8791f5f32a2c..9301ce12a055d 100644 --- a/pkgs/tools/misc/entr/default.nix +++ b/pkgs/tools/misc/entr/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { name = "entr-${version}"; - version = "4.0"; + version = "4.1"; src = fetchurl { url = "http://entrproject.org/code/${name}.tar.gz"; - sha256 = "12vc3xp0z0abmsy5kbix0wmn0sca39c8miyga6cijydi128zxm2a"; + sha256 = "0y7gvyf0iykpf3gfw09m21hy51m6qn4cpkbrm4nnn7pwrwycj0y5"; }; postPatch = '' diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 9d644182a0f75..063e3a5767212 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -15973,6 +15973,7 @@ with pkgs; wireshark = callPackage ../applications/networking/sniffers/wireshark { withQt = true; + qt5 = qt59; withGtk = false; inherit (darwin.apple_sdk.frameworks) ApplicationServices SystemConfiguration; }; diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix index c5f0378049e1d..ec47153809544 100644 --- a/pkgs/top-level/haskell-packages.nix +++ b/pkgs/top-level/haskell-packages.nix @@ -66,12 +66,6 @@ in rec { buildLlvmPackages = buildPackages.llvmPackages_39; llvmPackages = pkgs.llvmPackages_39; }; - ghc842 = callPackage ../development/compilers/ghc/8.4.2.nix rec { - bootPkgs = packages.ghc821Binary; - inherit (bootPkgs) alex happy hscolour; - buildLlvmPackages = buildPackages.llvmPackages_5; - llvmPackages = pkgs.llvmPackages_5; - }; ghc843 = callPackage ../development/compilers/ghc/8.4.3.nix rec { bootPkgs = packages.ghc821Binary; inherit (bootPkgs) alex happy hscolour; @@ -100,7 +94,7 @@ in rec { stage0 = ../development/compilers/ghcjs-ng/8.2/stage0.nix; }; ghcjs84 = callPackage ../development/compilers/ghcjs-ng rec { - bootPkgs = packages.ghc842; + bootPkgs = packages.ghc843; inherit (bootPkgs) alex happy; ghcjsSrcJson = ../development/compilers/ghcjs-ng/8.4/git.json; stage0 = ../development/compilers/ghcjs-ng/8.4/stage0.nix; @@ -151,11 +145,6 @@ in rec { ghc = bh.compiler.ghc822; compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-8.2.x.nix { }; }; - ghc842 = callPackage ../development/haskell-modules { - buildHaskellPackages = bh.packages.ghc842; - ghc = bh.compiler.ghc842; - compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-8.4.x.nix { }; - }; ghc843 = callPackage ../development/haskell-modules { buildHaskellPackages = bh.packages.ghc843; ghc = bh.compiler.ghc843;