diff --git a/.cirrus.yml b/.cirrus.yml
new file mode 100644
index 00000000000..2601856440f
--- /dev/null
+++ b/.cirrus.yml
@@ -0,0 +1,31 @@
+# release CI for FreeBSD
+compute_engine_instance:
+  image_project: freebsd-org-cloud-dev
+  image: family/freebsd-13-2
+  platform: freebsd
+  disk: 100 # Gb
+
+build_task:
+  timeout_in: 120m
+    only_if: $CIRRUS_TAG != ''
+  env:
+    ADD_CABAL_ARGS: "--enable-split-sections"
+    ARCH: 64
+    ARTIFACT: "x86_64-portbld-freebsd"
+    CIRRUS_CLONE_SUBMODULES: true
+    DISTRO: na
+    GHC_VERSION: 9.2.4
+    GITHUB_WORKSPACE: ${CIRRUS_WORKING_DIR}
+    RUNNER_OS: FreeBSD
+    TARBALL_EXT: tar.xz
+    TZ: Asia/Singapore
+  install_script:
+    - sed -i.bak -e 's/quarterly/latest/' /etc/pkg/FreeBSD.conf
+    - pkg install -y ghc hs-cabal-install git bash misc/compat10x misc/compat11x misc/compat12x gmake llvm14 patchelf tree gmp libiconv
+  script:
+    - tzsetup Etc/GMT
+    - adjkerntz -a
+    - bash .github/scripts/build.sh
+  binaries_artifacts:
+    path: "out/*"
+
diff --git a/.github/scripts/brew.sh b/.github/scripts/brew.sh
new file mode 100644
index 00000000000..0f889c6299c
--- /dev/null
+++ b/.github/scripts/brew.sh
@@ -0,0 +1,27 @@
+#!/bin/sh
+
+set -eux
+
+. .github/scripts/env.sh
+
+if [ -e "$HOME/.brew" ] ; then
+	(
+	cd "$HOME/.brew"
+	git fetch --depth 1
+	git reset --hard origin/master
+	)
+else
+	git clone --depth=1 https://github.com/Homebrew/brew "$HOME/.brew"
+fi
+export PATH="$HOME/.brew/bin:$HOME/.brew/sbin:$PATH"
+
+mkdir -p $CI_PROJECT_DIR/.brew_cache
+export HOMEBREW_CACHE=$CI_PROJECT_DIR/.brew_cache
+mkdir -p $CI_PROJECT_DIR/.brew_logs
+export HOMEBREW_LOGS=$CI_PROJECT_DIR/.brew_logs
+mkdir -p /private/tmp/.brew_tmp
+export HOMEBREW_TEMP=/private/tmp/.brew_tmp
+
+#brew update
+brew install ${1+"$@"}
+
diff --git a/.github/scripts/build.sh b/.github/scripts/build.sh
new file mode 100644
index 00000000000..a19669d1622
--- /dev/null
+++ b/.github/scripts/build.sh
@@ -0,0 +1,62 @@
+#!/bin/bash
+
+set -eux
+
+. .github/scripts/env.sh
+. .github/scripts/common.sh
+
+uname -a
+uname -p
+uname
+pwd
+env
+
+# ensure ghcup
+install_ghcup
+
+# build
+ghcup install ghc "${GHC_VERSION}"
+ghcup set ghc "${GHC_VERSION}"
+sed -i.bak -e '/DELETE MARKER FOR CI/,/END DELETE/d' cabal.project # see comment in cabal.project
+ecabal update
+ecabal user-config diff
+ecabal user-config init -f
+"ghc-${GHC_VERSION}" --info
+"ghc" --info
+
+# https://github.com/haskell/cabal/issues/7313#issuecomment-811851884
+if [ "$(getconf LONG_BIT)" == "32" ] || [ "${DISTRO}" == "CentOS" ] ; then
+    echo 'constraints: lukko -ofd-locking' >> cabal.project.release.local
+fi
+
+args=(
+    -w "ghc-$GHC_VERSION"
+    --disable-profiling
+    --enable-executable-stripping
+    --project-file=cabal.project.release
+    ${ADD_CABAL_ARGS}
+)
+
+run cabal v2-build ${args[@]} cabal-install
+
+mkdir -p "$CI_PROJECT_DIR/out"
+cp "$(cabal list-bin ${args[@]} cabal-install:exe:cabal)" "$CI_PROJECT_DIR/out/cabal$ext"
+cp dist-newstyle/cache/plan.json "$CI_PROJECT_DIR/out/plan.json"
+cd "$CI_PROJECT_DIR/out/"
+
+# create tarball/zip
+TARBALL_PREFIX="cabal-install-$("$CI_PROJECT_DIR/out/cabal" --numeric-version)"
+case "${TARBALL_EXT}" in
+    zip)
+        zip "${TARBALL_PREFIX}-${ARTIFACT}.${TARBALL_EXT}" "cabal${ext}" plan.json
+        ;;
+    tar.xz)
+        tar caf "${TARBALL_PREFIX}-${ARTIFACT}.${TARBALL_EXT}" "cabal${ext}" plan.json
+        ;;
+    *)
+        fail "Unknown TARBALL_EXT: ${TARBALL_EXT}"
+        ;;
+esac
+
+rm cabal plan.json
+
diff --git a/.github/scripts/common.sh b/.github/scripts/common.sh
new file mode 100644
index 00000000000..2ba17a1c045
--- /dev/null
+++ b/.github/scripts/common.sh
@@ -0,0 +1,109 @@
+#!/bin/bash
+
+. .github/scripts/env.sh
+
+# Colors
+RED="0;31"
+LT_BROWN="1;33"
+LT_BLUE="1;34"
+
+ecabal() {
+	cabal "$@"
+}
+
+nonfatal() {
+	"$@" || "$* failed"
+}
+
+sha_sum() {
+	if [ "${RUNNER_OS}" = "FreeBSD" ] ; then
+		sha256 "$@"
+	else
+		sha256sum "$@"
+	fi
+}
+
+git_describe() {
+	git config --global --get-all safe.directory | grep '^\*$' || git config --global --add safe.directory "*"
+	git describe --always
+}
+
+install_ghcup() {
+	# find "$GHCUP_INSTALL_BASE_PREFIX"
+	mkdir -p "$GHCUP_BIN"
+	mkdir -p "$GHCUP_BIN"/../cache
+
+	if [ "${RUNNER_OS}" = "FreeBSD" ] ; then
+		curl -o ghcup https://downloads.haskell.org/ghcup/tmp/x86_64-portbld-freebsd-ghcup-0.1.18.1
+		chmod +x ghcup
+		mv ghcup "$HOME/.local/bin/ghcup"
+	else
+		curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | BOOTSTRAP_HASKELL_MINIMAL=1 sh
+		source "$(dirname "${GHCUP_BIN}")/env"
+		ghcup install cabal --set "${BOOTSTRAP_HASKELL_CABAL_VERSION}"
+	fi
+}
+
+strip_binary() {
+	(
+	set -e
+	local binary=$1
+	case "$(uname -s)" in
+		"Darwin"|"darwin")
+			;;
+		MSYS_*|MINGW*)
+			;;
+		*)
+			strip -s "${binary}"
+		   ;;
+   esac
+	)
+}
+
+# GitLab Pipelines log section delimiters
+# https://gitlab.com/gitlab-org/gitlab-foss/issues/14664
+start_section() {
+  name="$1"
+  echo -e "section_start:$(date +%s):$name\015\033[0K"
+}
+
+end_section() {
+  name="$1"
+  echo -e "section_end:$(date +%s):$name\015\033[0K"
+}
+
+echo_color() {
+  local color="$1"
+  local msg="$2"
+  echo -e "\033[${color}m${msg}\033[0m"
+}
+
+error() { echo_color "${RED}" "$1"; }
+warn() { echo_color "${LT_BROWN}" "$1"; }
+info() { echo_color "${LT_BLUE}" "$1"; }
+
+fail() { error "error: $1"; exit 1; }
+
+run() {
+  info "Running $*..."
+  "$@" || ( error "$* failed"; return 1; )
+}
+
+emake() {
+	if command -v gmake >/dev/null 2>&1 ; then
+		gmake "$@"
+	else
+		make "$@"
+	fi
+}
+
+mktempdir() {
+	case "$(uname -s)" in
+		"Darwin"|"darwin")
+			mktemp -d -t cabal_ci.XXXXXXX
+			;;
+		*)
+			mktemp -d
+			;;
+	esac
+}
diff --git a/.github/scripts/env.sh b/.github/scripts/env.sh
new file mode 100644
index 00000000000..3d66e12f18e
--- /dev/null
+++ b/.github/scripts/env.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+
+mkdir -p "$HOME"/.local/bin
+
+if [ "${RUNNER_OS}" = "Windows" ] ; then
+	ext=".exe"
+else
+	ext=''
+fi
+
+export PATH="$HOME/.local/bin:$PATH"
+
+export BOOTSTRAP_HASKELL_NONINTERACTIVE=1
+export BOOTSTRAP_HASKELL_CABAL_VERSION="${CABAL_VER:-3.8.1.0}"
+export BOOTSTRAP_HASKELL_ADJUST_CABAL_CONFIG=no
+export BOOTSTRAP_HASKELL_INSTALL_NO_STACK=yes
+export BOOTSTRAP_HASKELL_ADJUST_BASHRC=1
+
+if [ "${RUNNER_OS}" = "Windows" ] ; then
+    # on windows use pwd to get unix style path
+    CI_PROJECT_DIR="$(pwd)"
+    export CI_PROJECT_DIR
+    export GHCUP_INSTALL_BASE_PREFIX="/c"
+    export GHCUP_BIN="$GHCUP_INSTALL_BASE_PREFIX/ghcup/bin"
+    export PATH="$GHCUP_BIN:$PATH"
+    export CABAL_DIR="C:\\Users\\runneradmin\\AppData\\Roaming\\cabal"
+else
+    export CI_PROJECT_DIR="${GITHUB_WORKSPACE}"
+    export GHCUP_INSTALL_BASE_PREFIX="$CI_PROJECT_DIR"
+    export GHCUP_BIN="$GHCUP_INSTALL_BASE_PREFIX/.ghcup/bin"
+    export PATH="$GHCUP_BIN:$PATH"
+    export CABAL_DIR="$CI_PROJECT_DIR/cabal"
+    export CABAL_CACHE="$CI_PROJECT_DIR/cabal-cache"
+fi
+
+export DEBIAN_FRONTEND=noninteractive
+export TZ=Asia/Singapore
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 00000000000..cfacbce7080
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,372 @@
+name: Build and release
+
+on:
+  push:
+    tags:
+      - 'cabal-install-*'
+
+jobs:
+  build-linux:
+    name: Build linux binaries
+    runs-on: ubuntu-latest
+    env:
+      TARBALL_EXT: tar.xz
+      ARCH: 64
+      DEBIAN_FRONTEND: noninteractive
+      TZ: Asia/Singapore
+      GHC_VERSION: 9.2.3
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [ { image: "debian:9"
+                    , installCmd: "sed -i s/deb.debian.org/archive.debian.org/g /etc/apt/sources.list && sed -i 's|security.debian.org|archive.debian.org/|g' /etc/apt/sources.list && sed -i /-updates/d /etc/apt/sources.list && apt-get update && apt-get install -y"
+                    , toolRequirements: "libnuma-dev zlib1g-dev libgmp-dev libgmp10 libssl-dev liblzma-dev libbz2-dev git wget lsb-release software-properties-common gnupg2 apt-transport-https gcc autoconf automake build-essential curl ghc gzip libffi-dev libncurses-dev libncurses5 libtinfo5 patchelf"
+                    , DISTRO: "Debian"
+                    , ARTIFACT: "x86_64-linux-deb9"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "debian:10"
+                    , installCmd: "apt-get update && apt-get install -y"
+                    , toolRequirements: "libnuma-dev zlib1g-dev libgmp-dev libgmp10 libssl-dev liblzma-dev libbz2-dev git wget lsb-release software-properties-common gnupg2 apt-transport-https gcc autoconf automake build-essential curl ghc gzip libffi-dev libncurses-dev libncurses5 libtinfo5 patchelf"
+                    , DISTRO: "Debian"
+                    , ARTIFACT: "x86_64-linux-deb10"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "debian:11"
+                    , installCmd: "apt-get update && apt-get install -y"
+                    , toolRequirements: "libnuma-dev zlib1g-dev libgmp-dev libgmp10 libssl-dev liblzma-dev libbz2-dev git wget lsb-release software-properties-common gnupg2 apt-transport-https gcc autoconf automake build-essential curl ghc gzip libffi-dev libncurses-dev libncurses5 libtinfo5 patchelf"
+                    , DISTRO: "Debian"
+                    , ARTIFACT: "x86_64-linux-deb11"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "ubuntu:18.04"
+                    , installCmd: "apt-get update && apt-get install -y"
+                    , toolRequirements: "libnuma-dev zlib1g-dev libgmp-dev libgmp10 libssl-dev liblzma-dev libbz2-dev git wget lsb-release software-properties-common gnupg2 apt-transport-https gcc autoconf automake build-essential curl ghc gzip libffi-dev libncurses-dev libncurses5 libtinfo5 patchelf"
+                    , DISTRO: "Ubuntu"
+                    , ARTIFACT: "x86_64-linux-ubuntu18.04"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "ubuntu:20.04"
+                    , installCmd: "apt-get update && apt-get install -y"
+                    , toolRequirements: "libnuma-dev zlib1g-dev libgmp-dev libgmp10 libssl-dev liblzma-dev libbz2-dev git wget lsb-release software-properties-common gnupg2 apt-transport-https gcc autoconf automake build-essential curl ghc gzip libffi-dev libncurses-dev libncurses5 libtinfo5 patchelf"
+                    , DISTRO: "Ubuntu"
+                    , ARTIFACT: "x86_64-linux-ubuntu20.04"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "ubuntu:22.04"
+                    , installCmd: "apt-get update && apt-get install -y"
+                    , toolRequirements: "libnuma-dev zlib1g-dev libgmp-dev libgmp10 libssl-dev liblzma-dev libbz2-dev git wget lsb-release software-properties-common gnupg2 apt-transport-https gcc autoconf automake build-essential curl ghc gzip libffi-dev libncurses-dev libncurses5 libtinfo5 patchelf"
+                    , DISTRO: "Ubuntu"
+                    , ARTIFACT: "x86_64-linux-ubuntu22.04"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "linuxmintd/mint19.3-amd64"
+                    , installCmd: "apt-get update && apt-get install -y"
+                    , toolRequirements: "libnuma-dev zlib1g-dev libgmp-dev libgmp10 libssl-dev liblzma-dev libbz2-dev git wget lsb-release software-properties-common gnupg2 apt-transport-https gcc autoconf automake build-essential curl ghc gzip libffi-dev libncurses-dev libncurses5 libtinfo5 patchelf"
+                    , DISTRO: "Mint"
+                    , ARTIFACT: "x86_64-linux-mint19.3"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "linuxmintd/mint20.2-amd64"
+                    , installCmd: "apt-get update && apt-get install -y"
+                    , toolRequirements: "libnuma-dev zlib1g-dev libgmp-dev libgmp10 libssl-dev liblzma-dev libbz2-dev git wget lsb-release software-properties-common gnupg2 apt-transport-https gcc autoconf automake build-essential curl ghc gzip libffi-dev libncurses-dev libncurses5 libtinfo5 patchelf"
+                    , DISTRO: "Mint"
+                    , ARTIFACT: "x86_64-linux-mint20.2"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "fedora:27"
+                    , installCmd: "dnf install -y"
+                    , toolRequirements: "autoconf automake binutils bzip2 coreutils curl elfutils-devel elfutils-libs findutils gcc gcc-c++ git gmp gmp-devel jq lbzip2 make ncurses ncurses-compat-libs ncurses-devel openssh-clients patch perl pxz python3 sqlite sudo wget which xz zlib-devel patchelf"
+                    , DISTRO: "Fedora"
+                    , ARTIFACT: "x86_64-linux-fedora27"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "fedora:33"
+                    , installCmd: "dnf install -y"
+                    , toolRequirements: "autoconf automake binutils bzip2 coreutils curl elfutils-devel elfutils-libs findutils gcc gcc-c++ git gmp gmp-devel jq lbzip2 make ncurses ncurses-compat-libs ncurses-devel openssh-clients patch perl pxz python3 sqlite sudo wget which xz zlib-devel patchelf"
+                    , DISTRO: "Fedora"
+                    , ARTIFACT: "x86_64-linux-fedora33"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "centos:7"
+                    , installCmd: "yum -y install epel-release && yum install -y"
+                    , toolRequirements: "autoconf automake binutils bzip2 coreutils curl elfutils-devel elfutils-libs findutils gcc gcc-c++ git gmp gmp-devel jq lbzip2 make ncurses ncurses-compat-libs ncurses-devel openssh-clients patch perl pxz python3 sqlite sudo wget which xz zlib-devel patchelf"
+                    , DISTRO: "CentOS"
+                    , ARTIFACT: "x86_64-linux-centos7"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "rockylinux:8"
+                    , installCmd: "yum -y install epel-release && yum install -y --allowerasing"
+                    , toolRequirements: "autoconf automake binutils bzip2 coreutils curl elfutils-devel elfutils-libs findutils gcc gcc-c++ git gmp gmp-devel jq lbzip2 make ncurses ncurses-compat-libs ncurses-devel openssh-clients patch perl pxz python3 sqlite sudo wget which xz zlib-devel patchelf"
+                    , DISTRO: "Unknown"
+                    , ARTIFACT: "x86_64-linux-rocky8"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "alpine:latest"
+                    , installCmd: "apk update && apk add"
+                    , toolRequirements: "binutils-gold curl gcc g++ gmp-dev libc-dev libffi-dev make musl-dev ncurses-dev perl tar xz autoconf automake bzip2 coreutils elfutils-dev findutils git jq bzip2-dev  patch  python3 sqlite sudo wget which zlib-dev patchelf zlib zlib-dev zlib-static"
+                    , DISTRO: "Unknown"
+                    , ARTIFACT: "x86_64-linux-unknown"
+                    , ADD_CABAL_ARGS: "--enable-split-sections --enable-executable-static"
+                    }
+
+                  ]
+    container:
+      image: ${{ matrix.platform.image }}
+    steps:
+      - name: Install requirements
+        shell: sh
+        run: |
+          ${{ matrix.platform.installCmd }} curl bash git ${{ matrix.platform.toolRequirements }}
+
+      - uses: actions/checkout@v3
+
+      - name: Run build
+        run: |
+          bash .github/scripts/build.sh
+
+        env:
+          ARTIFACT: ${{ matrix.platform.ARTIFACT }}
+          DISTRO: ${{ matrix.platform.DISTRO }}
+          ADD_CABAL_ARGS: ${{ matrix.platform.ADD_CABAL_ARGS }}
+
+      - if: always()
+        name: Upload artifact
+        uses: actions/upload-artifact@v3
+        with:
+          if-no-files-found: error
+          retention-days: 2
+          name: artifacts
+          path: |
+            ./out/*
+
+  build-linux-32bit:
+    name: Build linux binaries (32bit)
+    runs-on: ubuntu-latest
+    env:
+      TARBALL_EXT: tar.xz
+      ARCH: 32
+      TZ: Asia/Singapore
+      GHC_VERSION: 9.2.1
+      DISTRO: "Unknown"
+      ARTIFACT: "i386-linux-unknown"
+      ADD_CABAL_ARGS: "--enable-split-sections --enable-executable-static"
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          submodules: 'true'
+
+      - name: Run build (32 bit linux)
+        uses: docker://hasufell/i386-alpine-haskell:3.12
+        with:
+          args: sh -c "apk update && apk add bash binutils-gold curl gcc g++ gmp-dev libc-dev libffi-dev make musl-dev ncurses-dev perl tar xz autoconf automake bzip2 coreutils elfutils-dev findutils git jq bzip2-dev  patch  python3 sqlite sudo wget which zlib-dev patchelf zlib zlib-dev zlib-static && bash .github/scripts/build.sh"
+
+      - if: always()
+        name: Upload artifact
+        uses: actions/upload-artifact@v3
+        with:
+          if-no-files-found: error
+          retention-days: 2
+          name: artifacts
+          path: |
+            ./out/*
+
+  build-arm:
+    name: Build ARM binary
+    runs-on: ${{ matrix.os }}
+    env:
+      TARBALL_EXT: tar.xz
+      ADD_CABAL_ARGS: ""
+      DEBIAN_FRONTEND: noninteractive
+      TZ: Asia/Singapore
+      ARCH: ARM64
+      DISTRO: Ubuntu
+      GHC_VERSION: 9.2.2
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: [self-hosted, Linux, ARM64]
+            ARCH: ARM
+            ARTIFACT: "armv7-linux-ubuntu20"
+          - os: [self-hosted, Linux, ARM64]
+            ARCH: ARM64
+            ARTIFACT: "aarch64-linux-ubuntu20"
+    steps:
+      - uses: docker://arm64v8/ubuntu:focal
+        name: Cleanup (aarch64 linux)
+        with:
+          args: "find . -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +"
+
+      - name: git config
+        run: |
+          git config --global --get-all safe.directory | grep '^\*$' || git config --global --add safe.directory "*"
+        shell: bash
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - if: matrix.ARCH == 'ARM'
+        uses: docker://hasufell/arm32v7-ubuntu-haskell:focal
+        name: Run build (armv7 linux)
+        with:
+          args: bash .github/scripts/build.sh
+        env:
+          ARTIFACT: ${{ matrix.ARTIFACT }}
+
+      - if: matrix.ARCH == 'ARM64'
+        uses: docker://hasufell/arm64v8-ubuntu-haskell:focal
+        name: Run build (aarch64 linux)
+        with:
+          args: bash .github/scripts/build.sh
+        env:
+          ARTIFACT: ${{ matrix.ARTIFACT }}
+
+      - if: always()
+        name: Upload artifact
+        uses: actions/upload-artifact@v3
+        with:
+          if-no-files-found: error
+          retention-days: 2
+          name: artifacts
+          path: |
+            ./out/*
+
+  build-mac-x86_64:
+    name: Build binary (Mac x86_64)
+    runs-on: macOS-11
+    env:
+      MACOSX_DEPLOYMENT_TARGET: 10.13
+      ADD_CABAL_ARGS: ""
+      ARTIFACT: "x86_64-apple-darwin"
+      ARCH: 64
+      TARBALL_EXT: tar.xz
+      DISTRO: na
+      GHC_VERSION: 9.2.3
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Run build
+        run: |
+          brew install coreutils tree
+          bash .github/scripts/build.sh
+
+      - if: always()
+        name: Upload artifact
+        uses: actions/upload-artifact@v3
+        with:
+          if-no-files-found: error
+          retention-days: 2
+          name: artifacts
+          path: |
+            ./out/*
+
+  build-mac-aarch64:
+    name: Build binary (Mac aarch64)
+    runs-on: [self-hosted, macOS, ARM64]
+    env:
+      MACOSX_DEPLOYMENT_TARGET: 10.13
+      ADD_CABAL_ARGS: ""
+      ARTIFACT: "aarch64-apple-darwin"
+      ARCH: ARM64
+      TARBALL_EXT: tar.xz
+      DISTRO: na
+      HOMEBREW_CHANGE_ARCH_TO_ARM: 1
+      GHC_VERSION: 9.2.3
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Run build
+        run: |
+          bash .github/scripts/brew.sh git coreutils autoconf automake tree
+          export PATH="$HOME/.brew/bin:$HOME/.brew/sbin:$PATH"
+          export LD=ld
+          bash .github/scripts/build.sh
+
+      - if: always()
+        name: Upload artifact
+        uses: actions/upload-artifact@v3
+        with:
+          if-no-files-found: error
+          retention-days: 2
+          name: artifacts
+          path: |
+            ./out/*
+
+  build-win:
+    name: Build binary (Win)
+    runs-on: windows-latest
+    env:
+      ADD_CABAL_ARGS: ""
+      ARTIFACT: "x86_64-mingw64"
+      ARCH: 64
+      TARBALL_EXT: "zip"
+      DISTRO: na
+      GHC_VERSION: 9.2.3
+    steps:
+      - name: install windows deps
+        shell: pwsh
+        run: |
+          C:\msys64\usr\bin\bash -lc "pacman --disable-download-timeout --noconfirm -Syuu"
+          C:\msys64\usr\bin\bash -lc "pacman --disable-download-timeout --noconfirm -Syuu"
+          C:\msys64\usr\bin\bash -lc "pacman --disable-download-timeout --noconfirm -S make mingw-w64-x86_64-clang curl autoconf mingw-w64-x86_64-pkgconf ca-certificates base-devel gettext autoconf make libtool automake python p7zip patch unzip zip git"
+          taskkill /F /FI "MODULES eq msys-2.0.dll"
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Run build (windows)
+        run: |
+          $env:CHERE_INVOKING = 1
+          $env:MSYS2_PATH_TYPE = "inherit"
+          $ErrorActionPreference = "Stop"
+          C:\msys64\usr\bin\bash -lc "bash .github/scripts/build.sh"
+        shell: pwsh
+
+      - if: always()
+        name: Upload artifact
+        uses: actions/upload-artifact@v3
+        with:
+          if-no-files-found: error
+          retention-days: 2
+          name: artifacts
+          path: |
+            ./out/*
+
+  release:
+    name: release
+    needs: ["build-linux", "build-linux-32bit", "build-arm", "build-mac-x86_64", "build-mac-aarch64", "build-win"]
+    runs-on: ubuntu-latest
+      # TODO: rm
+      # if: startsWith(github.ref, 'refs/tags/')
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Download artifacts
+        uses: actions/download-artifact@v3
+        with:
+          name: artifacts
+          path: ./out
+
+      - name: Install requirements
+        run: |
+          sudo apt-get update && sudo apt-get install -y tar xz-utils
+        shell: bash
+
+      - name: build sdists
+        run: |
+          cabal sdist -o out all
+        shell: bash
+
+      - name: Release
+        uses: softprops/action-gh-release@v1
+        with:
+          draft: true
+          files: |
+            ./out/*
+
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
deleted file mode 100644
index 4fdf3ed5204..00000000000
--- a/.gitlab-ci.yml
+++ /dev/null
@@ -1,137 +0,0 @@
-stages:
-  - build
-
-variables:
-  # Commit of ghc/ci-images repository from which to pull Docker images
-  DOCKER_REV: "572353e0644044fe3a5465bba4342a9a0b0eb60e"
-
-  GHC_VERSION: 9.2.3
-  CABAL_INSTALL_VERSION: 3.6.2.0
-
-workflow:
-  rules:
-    - if: $CI_COMMIT_TAG
-      when: always
-    # Triggered if you start it from the gitlab web ui
-    - if: '$CI_PIPELINE_SOURCE == "web"'
-      when: always
-    - when: never
-
-.build:
-  stage: build
-  script:
-    - bash .gitlab/ci.sh
-  artifacts:
-    expire_in: 2 week
-    paths:
-      - out/*
-
-build-linux:
-  extends: .build
-  parallel:
-    matrix:
-      - ARCH: i386
-        TAG: x86_64-linux
-        OS:
-          - deb9
-      - ARCH: x86_64
-        TAG: x86_64-linux
-        OS:
-          - centos7
-          - deb9
-          - fedora33
-          - rocky8
-          - ubuntu18_04
-          - ubuntu20_04
-          - deb10
-          - deb11
-      - ARCH: aarch64
-        TAG: aarch64-linux
-        OS:
-          - deb10
-          - deb11
-  tags:
-    - $TAG
-  image: "registry.gitlab.haskell.org/ghc/ci-images/$PLATFORM:$DOCKER_REV"
-  variables:
-    PLATFORM: "${ARCH}-linux-${OS}"
-    TARBALL_ARCHIVE_SUFFIX: $PLATFORM
-    TARBALL_EXT: tar.xz
-    ADD_CABAL_ARGS: "--enable-split-sections"
-
-build-linux-alpine:
-  extends: .build
-  parallel:
-    matrix:
-      - ARCH: i386
-        OS: [alpine3_12]
-        GHC_VERSION: 9.0.2
-      - ARCH: x86_64
-        OS: [alpine3_12]
-  tags:
-    - x86_64-linux
-  before_script:
-    # for cabal build
-    - sudo apk add --no-cache zlib zlib-dev zlib-static
-  image: "registry.gitlab.haskell.org/ghc/ci-images/$PLATFORM:$DOCKER_REV"
-  variables:
-    PLATFORM: "${ARCH}-linux-${OS}"
-    TARBALL_ARCHIVE_SUFFIX: $PLATFORM
-    TARBALL_EXT: tar.xz
-    ADD_CABAL_ARGS: "--enable-split-sections --enable-executable-static"
-
-build-x86_64-darwin:
-  extends: .build
-  tags:
-    - x86_64-darwin
-  variables:
-    TARBALL_ARCHIVE_SUFFIX: x86_64-darwin
-    TARBALL_EXT: tar.xz
-    ADD_CABAL_ARGS: ""
-
-build-aarch64-darwin:
-  stage: build
-  tags:
-    - aarch64-darwin-m1
-  before_script:
-    - export HOMEBREW_CHANGE_ARCH_TO_ARM=1
-    - arch -arm64 /bin/bash ./.gitlab/brew.sh llvm autoconf automake coreutils make tree
-  # C_INCLUDE_PATH: https://gitlab.haskell.org/ghc/ghc/-/issues/20592
-  script: |
-    export PATH="$CI_PROJECT_DIR/.brew/opt/llvm/bin:$CI_PROJECT_DIR/.brew/bin:$CI_PROJECT_DIR/.brew/sbin:$PATH"
-    export CC=$CI_PROJECT_DIR/.brew/opt/llvm/bin/clang
-    export CXX=$CI_PROJECT_DIR/.brew/opt/llvm/bin/clang++
-    export LD=ld
-    export AR=$CI_PROJECT_DIR/.brew/opt/llvm/bin/llvm-ar
-    export RANLIB=$CI_PROJECT_DIR/.brew/opt/llvm/bin/llvm-ranlib
-    export C_INCLUDE_PATH="`xcrun --show-sdk-path`/usr/include/ffi"
-    arch -arm64 /bin/bash ./.gitlab/ci.sh
-  after_script:
-    - rm -Rf /private/tmp/.brew_tmp
-  variables:
-    MACOSX_DEPLOYMENT_TARGET: "10.7"
-    TARBALL_ARCHIVE_SUFFIX: aarch64-darwin
-    TARBALL_EXT: tar.xz
-    ADD_CABAL_ARGS: ""
-    # Update periodically.
-    BREW_VERSION: 4.0.5
-  artifacts:
-    expire_in: 2 week
-    paths:
-      - out/*
-  cache:
-    paths:
-      - .brew
-
-build-x86_64-windows:
-  extends: .build
-  script:
-    - $env:CHERE_INVOKING = "yes"
-    - bash '-lc' "ADD_CABAL_ARGS=$env:ADD_CABAL_ARGS GHC_VERSION=$env:GHC_VERSION CABAL_INSTALL_VERSION=$CABAL_INSTALL_VERSION .gitlab/ci.sh"
-  tags:
-    - new-x86_64-windows
-  variables:
-    TARBALL_ARCHIVE_SUFFIX: x86_64-windows
-    TARBALL_EXT: zip
-    ADD_CABAL_ARGS: ""
-  retry: 2
diff --git a/.gitlab/brew.sh b/.gitlab/brew.sh
deleted file mode 100644
index b2771811d47..00000000000
--- a/.gitlab/brew.sh
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/usr/bin/env bash
-
-set -Eeuo pipefail
-
-# Install brew locally in the project dir. Packages will also be installed here.
-# FIXME: Use brew in supported way. See
-# https://docs.brew.sh/Installation#untar-anywhere-unsupported
-brew_dir="${CI_PROJECT_DIR}/.brew"
-
-if [ ! -e "${brew_dir}" ]; then
-    mkdir -p "${brew_dir}"
-    curl --fail -L "https://github.com/Homebrew/brew/archive/refs/tags/${BREW_VERSION}.tar.gz" | tar xz --strip 1 -C "${brew_dir}"
-fi
-
-export PATH="${brew_dir}/bin:${brew_dir}/sbin:$PATH"
-
-# make sure to not pollute the machine with temp files etc
-mkdir -p $CI_PROJECT_DIR/.brew_cache
-export HOMEBREW_CACHE=$CI_PROJECT_DIR/.brew_cache
-mkdir -p $CI_PROJECT_DIR/.brew_logs
-export HOMEBREW_LOGS=$CI_PROJECT_DIR/.brew_logs
-mkdir -p /private/tmp/.brew_tmp
-export HOMEBREW_TEMP=/private/tmp/.brew_tmp
-
-# update and install packages
-brew update
-brew install ${1+"$@"}
diff --git a/.gitlab/ci.sh b/.gitlab/ci.sh
deleted file mode 100755
index c856f9f2cb9..00000000000
--- a/.gitlab/ci.sh
+++ /dev/null
@@ -1,90 +0,0 @@
-#!/usr/bin/env bash
-
-set -Eeuo pipefail
-
-source "$CI_PROJECT_DIR/.gitlab/common.sh"
-
-export GHCUP_INSTALL_BASE_PREFIX="$CI_PROJECT_DIR/toolchain"
-export CABAL_DIR="$CI_PROJECT_DIR/cabal"
-
-case "$(uname)" in
-    MSYS_*|MINGW*)
-        export CABAL_DIR="$(cygpath -w "$CABAL_DIR")"
-        GHCUP_BINDIR="${GHCUP_INSTALL_BASE_PREFIX}/ghcup/bin"
-        EXE_EXT=".exe"
-        ;;
-    *)
-        GHCUP_BINDIR="${GHCUP_INSTALL_BASE_PREFIX}/.ghcup/bin"
-        EXE_EXT=""
-        ;;
-esac
-
-mkdir -p "$CABAL_DIR"
-mkdir -p "$GHCUP_BINDIR"
-export PATH="$GHCUP_BINDIR:$PATH"
-
-export BOOTSTRAP_HASKELL_NONINTERACTIVE=1
-export BOOTSTRAP_HASKELL_GHC_VERSION=$GHC_VERSION
-export BOOTSTRAP_HASKELL_CABAL_VERSION=$CABAL_INSTALL_VERSION
-export BOOTSTRAP_HASKELL_ADJUST_CABAL_CONFIG=yes
-# We don't use stack, and it isn't available on i386-deb9
-export BOOTSTRAP_HASKELL_INSTALL_NO_STACK=yes
-
-# for some reason the subshell doesn't pick up the arm64 environment on darwin
-# and starts installing x86_64 GHC
-case "$(uname -s)" in
-    "Darwin"|"darwin")
-        case "$(/usr/bin/arch)" in
-            aarch64|arm64|armv8l)
-                curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | arch -arm64 /bin/bash
-                ;;
-            *)
-                curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | sh
-                ;;
-        esac
-        ;;
-    *)
-        curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | sh
-        ;;
-esac
-
-# https://github.com/haskell/cabal/issues/7313#issuecomment-811851884
-# and
-# https://github.com/haskellari/lukko/issues/17
-#
-# $PLATFORM comes from CI.
-if [ "$(getconf LONG_BIT)" = "32" -o "${PLATFORM:=xxx}" = "x86_64-linux-centos7" ] ; then
-    echo 'constraints: lukko -ofd-locking' >> cabal.project.release.local
-fi
-
-args=(
-    -w "ghc-$GHC_VERSION"
-    --disable-profiling
-    --enable-executable-stripping
-    --project-file=cabal.project.release
-    ${ADD_CABAL_ARGS}
-)
-
-run cabal update hackage.haskell.org,HEAD
-run cabal v2-build ${args[@]} cabal-install
-
-mkdir "$CI_PROJECT_DIR/out"
-cp "$(cabal list-bin ${args[@]} cabal-install:exe:cabal)" "$CI_PROJECT_DIR/out/cabal$EXE_EXT"
-cp dist-newstyle/cache/plan.json "$CI_PROJECT_DIR/out/plan.json"
-cd "$CI_PROJECT_DIR/out/"
-
-# create tarball/zip
-TARBALL_PREFIX="cabal-install-$("$CI_PROJECT_DIR/out/cabal" --numeric-version)"
-case "${TARBALL_EXT}" in
-    zip)
-        zip "${TARBALL_PREFIX}-${TARBALL_ARCHIVE_SUFFIX}.${TARBALL_EXT}" "cabal${EXE_EXT}" plan.json
-        ;;
-    tar.xz)
-        tar caf "${TARBALL_PREFIX}-${TARBALL_ARCHIVE_SUFFIX}.${TARBALL_EXT}" "cabal${EXE_EXT}" plan.json
-        ;;
-    *)
-        fail "Unknown TARBALL_EXT: ${TARBALL_EXT}"
-        ;;
-esac
-
-rm cabal plan.json
diff --git a/.gitlab/common.sh b/.gitlab/common.sh
deleted file mode 100644
index b6bce698c91..00000000000
--- a/.gitlab/common.sh
+++ /dev/null
@@ -1,49 +0,0 @@
-# Common bash utilities
-# ----------------------
-
-# Colors
-BLACK="0;30"
-GRAY="1;30"
-RED="0;31"
-LT_RED="1;31"
-BROWN="0;33"
-LT_BROWN="1;33"
-GREEN="0;32"
-LT_GREEN="1;32"
-BLUE="0;34"
-LT_BLUE="1;34"
-PURPLE="0;35"
-LT_PURPLE="1;35"
-CYAN="0;36"
-LT_CYAN="1;36"
-WHITE="1;37"
-LT_GRAY="0;37"
-
-# GitLab Pipelines log section delimiters
-# https://gitlab.com/gitlab-org/gitlab-foss/issues/14664
-start_section() {
-  name="$1"
-  echo -e "section_start:$(date +%s):$name\015\033[0K"
-}
-
-end_section() {
-  name="$1"
-  echo -e "section_end:$(date +%s):$name\015\033[0K"
-}
-
-echo_color() {
-  local color="$1"
-  local msg="$2"
-  echo -e "\033[${color}m${msg}\033[0m"
-}
-
-error() { echo_color "${RED}" "$1"; }
-warn() { echo_color "${LT_BROWN}" "$1"; }
-info() { echo_color "${LT_BLUE}" "$1"; }
-
-fail() { error "error: $1"; exit 1; }
-
-function run() {
-  info "Running $*..."
-  "$@" || ( error "$* failed"; return 1; )
-}
diff --git a/scripts/release/create-yaml-snippet.sh b/scripts/release/create-yaml-snippet.sh
new file mode 100755
index 00000000000..4efa21c384a
--- /dev/null
+++ b/scripts/release/create-yaml-snippet.sh
@@ -0,0 +1,101 @@
+#!/bin/bash
+
+set -eu
+set -o pipefail
+
+RELEASE=$1
+VERSION=${RELEASE#cabal-install-v}
+
+cd "gh-release-artifacts/cabal-${VERSION}"
+
+cat <<EOF > /dev/stdout
+    $VERSION:
+      viTags:
+        - Latest
+      viChangeLog: https://github.com/haskell/cabal/blob/master/release-notes/cabal-install-$VERSION.md
+      viArch:
+        A_64:
+          Linux_Debian:
+            '< 10': &cabal-${VERSION//./}-64-deb9
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-x86_64-linux-deb9.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-x86_64-linux-deb9.tar.xz" | awk '{ print $1 }')
+            '(>= 10 && < 11)': &cabal-${VERSION//./}-64-deb10
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-x86_64-linux-deb10.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-x86_64-linux-deb10.tar.xz" | awk '{ print $1 }')
+            unknown_versioning: &cabal-${VERSION//./}-64-deb11
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-x86_64-linux-deb11.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-x86_64-linux-deb11.tar.xz" | awk '{ print $1 }')
+          Linux_Ubuntu:
+            '( >= 16 && < 19 )': &cabal-${VERSION//./}-64-ubuntu18
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-x86_64-linux-ubuntu18.04.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-x86_64-linux-ubuntu18.04.tar.xz" | awk '{ print $1 }')
+            '( >= 20 && < 22 )': &cabal-${VERSION//./}-64-ubuntu20
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-x86_64-linux-ubuntu20.04.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-x86_64-linux-ubuntu20.04.tar.xz" | awk '{ print $1 }')
+            unknown_versioning: &cabal-${VERSION//./}-64-ubuntu22
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-x86_64-linux-ubuntu22.04.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-x86_64-linux-ubuntu22.04.tar.xz" | awk '{ print $1 }')
+          Linux_Mint:
+            '< 20':
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-x86_64-linux-mint19.3.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-x86_64-linux-mint19.3.tar.xz" | awk '{ print $1 }')
+            '(>= 20 && < 21)':
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-x86_64-linux-mint20.2.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-x86_64-linux-mint20.2.tar.xz" | awk '{ print $1 }')
+            '>= 21': *cabal-${VERSION//./}-64-ubuntu22
+          Linux_Fedora:
+            '< 33': &cabal-${VERSION//./}-64-fedora27
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-x86_64-linux-fedora27.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-x86_64-linux-fedora27.tar.xz" | awk '{ print $1 }')
+            '>= 33': &cabal-${VERSION//./}-64-fedora33
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-x86_64-linux-fedora33.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-x86_64-linux-fedora33.tar.xz" | awk '{ print $1 }')
+            unknown_versioning: *cabal-${VERSION//./}-64-fedora27
+          Linux_CentOS:
+            '( >= 7 && < 8 )': &cabal-${VERSION//./}-64-centos
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-x86_64-linux-centos7.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-x86_64-linux-centos7.tar.xz" | awk '{ print $1 }')
+            unknown_versioning: *cabal-${VERSION//./}-64-centos
+          Linux_RedHat:
+            unknown_versioning: *cabal-${VERSION//./}-64-centos
+          Linux_UnknownLinux:
+            unknown_versioning: &cabal-${VERSION//./}-64-unknown
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-x86_64-linux-unknown.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-x86_64-linux-unknown.tar.xz" | awk '{ print $1 }')
+          Linux_Alpine:
+            unknown_versioning: *cabal-${VERSION//./}-64-unknown
+          Darwin:
+            unknown_versioning:
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-x86_64-apple-darwin.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-x86_64-apple-darwin.tar.xz" | awk '{ print $1 }')
+          Windows:
+            unknown_versioning:
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-x86_64-mingw64.zip
+              dlHash: $(sha256sum "cabal-install-$VERSION-x86_64-mingw64.zip" | awk '{ print $1 }')
+          FreeBSD:
+            unknown_versioning:
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-x86_64-freebsd.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-x86_64-freebsd.tar.xz" | awk '{ print $1 }')
+        A_32:
+          Linux_UnknownLinux:
+            unknown_versioning: &cabal-${VERSION//./}-32-unknown
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-i386-linux-unknown.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-i386-linux-unknown.tar.xz" | awk '{ print $1 }')
+          Linux_Alpine:
+            unknown_versioning: *cabal-${VERSION//./}-32-unknown
+        A_ARM64:
+          Linux_UnknownLinux:
+            unknown_versioning:
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-aarch64-linux-ubuntu20.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-aarch64-linux-ubuntu20.tar.xz" | awk '{ print $1 }')
+          Darwin:
+            unknown_versioning:
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-aarch64-apple-darwin.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-aarch64-apple-darwin.tar.xz" | awk '{ print $1 }')
+        A_ARM:
+          Linux_UnknownLinux:
+            unknown_versioning:
+              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$VERSION/cabal-install-$VERSION-armv7-linux-ubuntu20.tar.xz
+              dlHash: $(sha256sum "cabal-install-$VERSION-armv7-linux-ubuntu20.tar.xz" | awk '{ print $1 }')
+EOF
+
diff --git a/scripts/release/download-gh-artifacts.sh b/scripts/release/download-gh-artifacts.sh
new file mode 100755
index 00000000000..efe77d1a720
--- /dev/null
+++ b/scripts/release/download-gh-artifacts.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+
+set -eu
+set -o pipefail
+
+RELEASE=$1
+VERSION=${RELEASE#cabal-install-v}
+SIGNER=$2
+
+echo "RELEASE: $RELEASE"
+echo "SIGNER: $SIGNER"
+
+for com in gh gpg curl sha256sum ; do
+	command -V ${com} >/dev/null 2>&1
+done
+
+[ ! -e "gh-release-artifacts/cabal-${VERSION}" ]
+
+mkdir -p "gh-release-artifacts/cabal-${VERSION}"
+
+cd "gh-release-artifacts/cabal-${VERSION}"
+
+# github
+gh release download "$RELEASE"
+
+# cirrus
+curl --fail -L -o "cabal-install-${VERSION}-x86_64-portbld-freebsd.tar.xz" \
+	"https://api.cirrus-ci.com/v1/artifact/github/haskell/cabal/build/binaries/out/cabal-install-${VERSION}-x86_64-portbld-freebsd.tar.xz?branch=${RELEASE}"
+
+
+sha256sum ./* > SHA256SUMS
+gpg --detach-sign -u "${SIGNER}" SHA256SUMS
+
+gh release upload "$RELEASE" "cabal-install-${VERSION}-x86_64-portbld-freebsd.tar.xz" SHA256SUMS SHA256SUMS.sig
+