February 2008 - cabal-devel

[Hackage] #222: Hackage should be able to track which version of package is compatible with which version of GHC
by Hackage 20 Feb '08

20 Feb '08

#222: Hackage should be able to track which version of package is compatible with which version of GHC --------------------------------+------------------------------------------- Reporter: guest | Owner: Type: defect | Status: new Priority: normal | Milestone: Component: HackageDB website | Version: 1.2.3.0 Severity: normal | Keywords: Difficulty: normal | Ghcversion: 6.8.2 Platform: Linux | --------------------------------+------------------------------------------- This is related to ticket #221 and #199. Cabal-install at this time always fetches the highest version of a package. But the highest version may not be compatible with the version of GHC. The example is the HXT package. http://www.fh-wedel.de/~si/HXmlToolbox/ As of this writing, version 7.4 is for GHC 6.8. But for those who have GHC 6.6, version 7.3 should be fetched. If there is a flag in Hackage to indicate this compatibility matrix, then cabal-install can make correct decision which version to fetch based on the GHC version the user has. -- Ticket URL: <http://hackage.haskell.org/trac/hackage/ticket/222> Hackage <http://haskell.org/cabal/> Hackage: Cabal and related projects

1 3

patch applied (cabal-install): Replace RepoIndex type with PackageIndex PkgInfo
by Duncan Coutts 20 Feb '08

20 Feb '08

Wed Feb 20 13:28:48 PST 2008 Duncan Coutts <duncan(a)haskell.org> * Replace RepoIndex type with PackageIndex PkgInfo and adapt to the minor finalisePackageDescription change M ./Hackage/Dependency.hs -25 +30 M ./Hackage/Fetch.hs -2 +1 M ./Hackage/IndexUtils.hs -12 +63 M ./Hackage/Info.hs -2 +1 M ./Hackage/Install.hs -3 +2 M ./Hackage/List.hs -4 +5 R ./Hackage/RepoIndex.hs M ./Hackage/Types.hs +3 M ./Hackage/Upgrade.hs -2 +2 M ./cabal-install.cabal -1 View patch online: http://darcs.haskell.org/cabal-install/_darcs/patches/20080220212848-adfee-…

1 0

patch applied (cabal): Use PackageIndex in finalisePackageDescription
by Duncan Coutts 20 Feb '08

20 Feb '08

Wed Feb 20 13:27:41 PST 2008 Duncan Coutts <duncan(a)haskell.org> * Use PackageIndex in finalisePackageDescription rather than [PackageIdentifier] M ./Distribution/PackageDescription/Configuration.hs -16 +7 M ./Distribution/Simple/Configure.hs -12 +10 View patch online: http://darcs.haskell.org/cabal/_darcs/patches/20080220212741-adfee-47638e88…

1 0

patch applied (cabal): generalise remaining PackageIndex functions over class of pkgs with fixed deps
by Duncan Coutts 20 Feb '08

20 Feb '08

Wed Feb 20 11:51:43 PST 2008 Duncan Coutts <duncan(a)haskell.org> * generalise remaining PackageIndex functions over class of pkgs with fixed deps Add a class for packages with fixed deps, like InstalledPackageInfo and generalise the few functions that used PackageIndex InstalledPackageInfo specifically to use PackageFixedDeps pkg => PackageIndex pkg This will be helpful in cabal-install for configured but not-yet-installed packages. M ./Distribution/Simple/Configure.hs -7 +9 M ./Distribution/Simple/PackageIndex.hs -24 +32 View patch online: http://darcs.haskell.org/cabal/_darcs/patches/20080220195143-adfee-af43b3db…

1 0

patch applied (cabal): Generalise InstalledPackageIndex over all Package instances
by Duncan Coutts 20 Feb '08

20 Feb '08

Wed Feb 20 11:10:31 PST 2008 Duncan Coutts <duncan(a)haskell.org> * Generalise InstalledPackageIndex over all Package instances New Package class of things that can be identified by a PackageIdentifier so that covers at least PackageIdentifier, PackageDescription and InstalledPackageInfo. Most PackageIndex operations work for any package type. ./Distribution/Simple/InstalledPackageIndex.hs -> ./Distribution/Simple/PackageIndex.hs M ./Cabal.cabal -1 +1 M ./Distribution/Simple/Configure.hs -8 +10 M ./Distribution/Simple/GHC.hs -4 +4 M ./Distribution/Simple/Haddock.hs -2 +2 M ./Distribution/Simple/JHC.hs -5 +5 M ./Distribution/Simple/LocalBuildInfo.hs -2 +3 M ./Distribution/Simple/PackageIndex.hs -55 +81 View patch online: http://darcs.haskell.org/cabal/_darcs/patches/20080220191031-adfee-5ba3b111…

1 0

[Hackage] #239: security hole: anyone can replace a package
by Hackage 20 Feb '08

20 Feb '08

#239: security hole: anyone can replace a package --------------------------------+------------------------------------------- Reporter: guest | Owner: Type: defect | Status: new Priority: normal | Milestone: Component: HackageDB website | Version: Severity: normal | Keywords: Difficulty: normal | Ghcversion: 6.8.2 Platform: | --------------------------------+------------------------------------------- It is possible for any registered user to upload a new version of a package without reference to the actual maintainer of the package. The new upload can even have the same name and version number as an existing package. Not only does this allow a malicious or misguided person to arbitrarily change or remove good code: there is also no notification on the webpage of the package about who uploaded it - only the author/maintainer fields of the cabal file. Needless to say, the latter may not be very happy that their name is associated with a corrupt package that they did not upload or authorise. Recently, a significant number of packages have been uploaded without their maintainers' knowledge, so this could be a real problem. A quick fix would be to list the uploader's name against every package, so that the paranoid user can make an informed decision about its status. Ultimately the decision about whether to trust a package is a social and community issue, but the lack of transparency in discovering relevant information is a technical problem that does have a solution. -- Ticket URL: <http://hackage.haskell.org/trac/hackage/ticket/239> Hackage <http://haskell.org/cabal/> Hackage: Cabal and related projects

2 9

[Hackage] #243: Notify maintainers of uploads
by Hackage 20 Feb '08

20 Feb '08

#243: Notify maintainers of uploads ----------------------------------+----------------------------------------- Reporter: ross(a)soi.city.ac.uk | Owner: Type: enhancement | Status: new Priority: normal | Milestone: Component: Cabal library | Version: 1.2.3.0 Severity: normal | Keywords: Difficulty: normal | Ghcversion: 6.8.2 Platform: | ----------------------------------+----------------------------------------- Ian suggests: one thing we could do is to e-mail the maintainer address (in both the old and new cabal files) when an upload is done, including the username of the uploader and whether the maintainer address has changed. -- Ticket URL: <http://hackage.haskell.org/trac/hackage/ticket/243> Hackage <http://haskell.org/cabal/> Hackage: Cabal and related projects

1 0

patch applied (cabal-install): Use a dependency graph rather than a list when installing packages
by Duncan Coutts 20 Feb '08

20 Feb '08

Wed Feb 20 03:06:37 PST 2008 Duncan Coutts <duncan(a)haskell.org> * Use a dependency graph rather than a list when installing packages This allows us to figure out what to do when installing a single package fails. Instead of just carrying on as if nothing had happened and then failing several other packages which depended on the one that failed initially we can cut those dependent packages out as soon as the first one fails and if there is anything left that did not depend on the failed package then we can try and carry on. A ./Hackage/DepGraph.hs M ./Hackage/Dependency.hs -14 +23 M ./Hackage/Fetch.hs -1 +3 M ./Hackage/Info.hs -2 +4 M ./Hackage/Install.hs -13 +21 M ./Hackage/Utils.hs +4 View patch online: http://darcs.haskell.org/cabal-install/_darcs/patches/20080220110637-adfee-…

1 0

[Hackage] #220: detect inconsistent package dependencies
by Hackage 19 Feb '08

19 Feb '08

#220: detect inconsistent package dependencies -----------------------------+---------------------------------------------- Reporter: duncan | Owner: Type: enhancement | Status: new Priority: normal | Milestone: Component: Cabal library | Version: 1.2.3.0 Severity: normal | Keywords: Difficulty: hard (< 1 day) | Ghcversion: 6.8.2 Platform: | -----------------------------+---------------------------------------------- Now that packages are more fine grained and upgradeable we're commonly getting situations where we build a package that uses two other packages that were built against different versions of another common package. The most common example in the wild at the moment is people installing `bytestring-0.9.0.4` in addition to the `bytestring-0.9.0.1` that came with ghc-6.8.2 and then half their packages are built against one version and half against the other and when they try to use packages built against different versions we get a type error about `bytestring-0.9.0.1:Data.ByteString.ByteString` not being the same as `bytestring-0.9.0.4:Data.ByteString.ByteString`. Cabal could and should detect this situation, and `cabal-install` should plan around it in its dependency resolution algorithm. However in both cases we require the dependency information of the existing installed packages. See http://hackage.haskell.org/trac/ghc/ticket/1839 The simplest thing is to get the full `InstalledPackageInfo` for all the packages in the package databases. From that we can find all the dependencies. When we do find this situation it is not guaranteed to cause a compiler error, it's just rather likely. So it's not obvious if Cabal should warn or error. `cabal-install` could try to fix up inconsistencies but in general only by re-installing existing packages against different versions of their dependencies. The longer term solution is to allow installing multiple instances of the same versions of a package built against different versions of its dependencies. This is the functional Nix approach however it would probably also require support from ghc. -- Ticket URL: <http://hackage.haskell.org/trac/hackage/ticket/220> Hackage <http://haskell.org/cabal/> Hackage: Cabal and related projects

3 5

patch applied (cabal): Fix haddock markup
by Duncan Coutts 19 Feb '08

19 Feb '08

Tue Feb 19 05:25:43 PST 2008 Duncan Coutts <duncan(a)haskell.org> * Fix haddock markup M ./Distribution/Simple/InstalledPackageIndex.hs -1 +1 View patch online: http://darcs.haskell.org/cabal/_darcs/patches/20080219132543-adfee-b58460ca…

1 0