April 2014 - cabal-devel

Proposal: cabal-install: verify OpenPGP signatures
by Nikita Karetnikov 26 Sep '14

26 Sep '14

Following up on the “cabal-install: Replacing HTTP with HTTPS” thread. I think we can do better. I want to make sure that people will notice if someone compromises the packages on hackage.haskell.org. Here’s a rough plan: 1. Patch ‘hackage-server’ to allow uploading of OpenPGP signatures. 2. Patch ‘cabal-install’ to use GPG for verification. (GPG trust levels could be useful here.) ‘cabal install’ should also support ‘--skip-verification’ or some such to avoid disaster during the adoption stage. In addition, ‘cabal update’ would fetch the list of fingerprints from Hackage and cache each revision. A warning would be raised if a fignerprint cannot be found in the cache. If a maintainer wants to use a new key, it must be signed with the previously used one. If a maintainer loses their private key, for instance, this should be resolved by the admins. For example, an admin (admins?) could sign the new key. After a while, a web of trust would be formed. The fingerprints of active maintainers would be well-known. I’ve been thinking about this for quite a while and don’t see other ways to achive the same level of trust while allowing arbitrary uploads. The proposal also doesn’t require much manual intervention. What do you think? I’m willing to work on this but want to make sure that my time won’t be wasted. Will you accept such a patch?

3 11

GenericPackageDescription and 'build-depends' field
by Daniel Trstenjak 24 Apr '14

24 Apr '14

Hi all, am I right, that the 'build-depends' field of the cabal file is now always represented by 'condTreeConstraints' in 'CondTree'? So is the 'targetBuildDepends' in 'BuildInfo' now only available for backward compatibility reasons? Greetings, Daniel

2 3

Themes for 1.22
by Johan Tibell 24 Apr '14

24 Apr '14

Hi all, While I'm sure we still have a bugfix release or two to make on the 1.20 branch, I thought it'd be worth looking at what we want to accomplish for 1.22. Here are my thoughts on what we should focus on: ## A dependency solver that always works As Hackage has grown so have the requirements of the dependency solver. There are three distinct problems I'm seeing now that we should tackle: * Treat each sections (i.e. library, test suite, benchmark, and executable) in the .cabal file separately for the purpose of dependency resolution. Today all the sections' dependencies are merged and used as the constraints of the package as a whole. This is troublesome for all packages that are dependencies of QC, HUnit, test-framework, and criterion, as there's a dependency cycle if you treat e.g. the containers package and its test suite as one unit. The solution here is to treat each unit as a mini package for the purpose of dependency resolution. This would also allow you to have e.g. several executables with conflicting dependencies. * Improve performance. Some packages (e.g. yesod) can take over 10 seconds to run over. This problem will get worse as Hackage grows and we build bigger applications on top of it, so we need to tackle this now before it becomes a real problem. * Fix Hackage package blacklisting. Users can blacklist packages on Hackage e.g. if they know them to be broken. However, this doesn't really work as the Hackage blacklist translates to a soft preference in the dependency solver and is thus often ignored. See https://github.com/haskell/cabal/issues/1792 for the gory details. ## Do the right thing automatically This is a carry-over from the 1.20 goals, as we didn't make much progress here. The focus here should be on avoiding manual steps the cabal could do for the user. * Automatically install dependencies when needed. When `cabal build` would fail due to a missing dependency, just install this dependency instead of bugging the user to do it. This will probably have to be limited to sandboxes where we can't break the user's system * GHCi support could be improved by rebinding :reload to rerun e.g. preprocessors automatically. This would enable the users to develop completely from within ghci (i.e. faster edit-save-type-error cycle). We have most of what we need here (i.e. GHC macro support) but someone needs to make the final change to generate a .ghci file to pass in the ghci invocation. ## Faster builds I think we're almost done here. There's really only one remaining thing to do: * Build components and different ways (e.g. profiling) in parallel. We could build both profiling and non-profiling versions in parallel. We could also build e.g. all test suites in parallel. The key challenge here is to coordinate all parallel jobs so we don't spawn too many. ## Support large projects This is also a carry-over from the 1.20 goals. We still don't have a good story for large projects. Sandboxes are too annoying to use if there are 100 add-source deps. We need more automation and more opinionated defaults (e.g. scan the sub-directories from in which cabal was run to find source packages.) What we need most of all here is a design. Perhaps we could try to get together at some Hackathon/ICFP and discuss. ## Issue tracker spring cleaning and test suite improvements The issue tracker is out-of-hand. It's too unwieldy to use for planning our work and get an overview of the most important issues. We should try to close down bugs that haven't had updates in years with extreme prejudice. If the issue is important it will pop up again. We're also severely lacking in the testing department. There are two problems: * There aren't enough tests: the cabal user facing surface is quite larger (lots of features and flags) and many of them are not tested at all, which will lead to regressions as we keep fixing bugs and adding features. * The tests take too long to run: we have too many end-to-end style tests (i.e. build a whole package) and not enough unit style tests. We need to add more of the latter kind. Cheers, Johan

4 5

Needed: distributable executables for the 1.20 release
by Johan Tibell 21 Apr '14

21 Apr '14

Hi, As per usual I want to provide executables for download for download on the cabal homepage, for Windows and OS X. I can build the OS X one myself. Could someone please send me a 64-bit Windows cabal executable? -- Johan

2 1

Announcing cabal 1.20
by Johan Tibell 20 Apr '14

20 Apr '14

Hi all, On behalf of all the cabal contributors, I'm proud to announce cabal 1.20. With 404 commits since the 1.18 release, this is a feature packed release. Here's a short summary of the perhaps most notable changes: * Dependency freezing * Parallel cabal build * Flag to temporary ignore upper bounds * Unnecessary re-linking avoidance * Streaming cabal test output * New cabal exec command * Haddock configuration options I did a longer write-up about the new features on my blog: http://blog.johantibell.com/2014/04/announcing-cabal-120.html ## Contributors Here are the contributors for this release, ordered by number of commits: * Mikhail Glushenkov * Johan Tibell * Duncan Coutts * Thomas Tuegel * Ian D. Bollinger * Ben Armston * Niklas Hambüchen * Daniel Trstenjak * Tuncer Ayaz * Herbert Valerio Riedel * Tillmann Rendel * Liyang HU * Dominic Steinitz * Brent Yorgey * Ricky Elrod * Geoff Nixon * Florian Hartwig * Bob Ippolito * Björn Peemöller * Wojciech Danilo * Sergei Trofimovich * Ryan Trinkle * Ryan Newton * Roman Cheplyaka * Peter Selinger * Niklas Haas * Nikita Karetnikov * Nick Smallbone * Mike Craig * Markus Pfeiffer * Luke Iannini * Luite Stegeman * John Lato * Jens Petersen * Jason Dagit * Gabor Pali * Daniel Velkov * Ben Millwood Apologies if someone was left out. Once in a while we have to make commits on behalf of an author. Those authors are not captured above. Enjoy, Johan

1 0

Please test: Cabal/cabal-install 1.20 RC2
by Johan Tibell 18 Apr '14

18 Apr '14

Hi all, The second, and hopefully last, release candidate for Cabal and cabal-install 1.20 is ready. If no issues are discovered, I plan to release this on Sunday, April 20th. You can help test by installing the release candidate and use it for your day-to-day work: cabal install http://johantibell.com/files/Cabal-1.20.0.0-rc2.tar.gz http://johantibell.com/files/cabal-install-1.20.0.0-rc2.tar.gz Please report any issues at https://github.com/haskell/cabal/issues -- Johan

2 3

1.20 release candidates
by Johan Tibell 15 Apr '14

15 Apr '14

Hi all, I've prepared the 1.20 release candidates. I now need some help testing, especially on Windows as I don't have a Windows machine. To install the release candidates simply run: cabal install http://johantibell.com/files/Cabal-1.20.0-rc.tar.gz http://johantibell.com/files/cabal-install-1.20.0-rc.tar.gz Please report any issues on the bug tracker: https://github.com/haskell/cabal/issues If I haven't heard of anything release blocking bugs (or last minute important patches) in a couple of days, I will make these tarballs the official release. The commits used are tagged in the repo as Cabal-v1.20.0-rc and cabal-install-v1.20.0-rc. -- Johan

1 2

[PATCH] Bootstrap over HTTPS.
by Nikita Karetnikov 10 Apr '14

10 Apr '14

7 13

Needed: cabal-install-1.18.0.3 binaries
by Johan Tibell 10 Apr '14

10 Apr '14

We currently have an OS X Mavericks binary but we also need at least a Windows binary: http://www.haskell.org/cabal/download.html If someone could build me a Windows binary that would be great.

1 0

Planning to make 1.20 release in about one week
by Johan Tibell 10 Apr '14

10 Apr '14

Hi! I looked over and replied to the remaining outstanding pull requests a couple of days ago. I'm happy to call what's in master now 1.20 (although I'm also happy if any of the outstanding pull requests make it in.) If nothing major happens I will make a release on the 15th. P.S. There are 360 commits since the last release according to `git log --pretty=oneline Cabal-v1.18.1.3..`. -- Johan

3 4