July 2015 - cabal-devel

ANN: cabal-install-1.22.6.0 has been released
by Ryan Thomas 26 Jan '16

26 Jan '16

Hi all, A new minor release of cabal-install has been released, this is to pick up a fix for @ezyang's fix for #2502. This is now available on hackage and the downloads page and the sha1sum is listed below. Cheers, ryan d474b0eef6944af1abef92419cea13cee50993f3 cabal-install-1.22.6.0.tar.gz

3 5

Cabal and simultaneous installations of the same package
by Simon Peyton Jones 28 Aug '15

28 Aug '15

Dear Cabal developers You'll probably have seen the thread about the Haskell Platform. Among other things, this point arose: | Another thing we should fix is the (now false) impression that HP gets in | the way of installing other packages and versions due to cabal hell. People mean different things by "cabal hell", but the inability to simultaneously install multiple versions of the same package, compiled against different dependencies is certainly one of them, and I think it is the one that Yitzchak is referring to here. But some time now GHC has allowed multiple versions of the same package (compiled against different dependencies) to be installed simultaneously. So all we need to do is to fix Cabal to allow it too, and thereby kill of a huge class of cabal-hell problems at one blow. But time has passed and it hasn't happened. Is this because I'm misunderstanding? Or because it is harder than I think? Or because there are much bigger problems? Or because there is insufficient effort available? Or what? Unless I'm way off beam, this "multiple installations of the same package" thing has been a huge pain forever, and the solution is within our grasp. What's stopping us grasping it? Simon

8 17

Re: New release of GHC 7.8 to support OS X El Capitan
by Brandon Allbery 18 Jul '15

18 Jul '15

On Sat, Jul 18, 2015 at 7:39 AM, Ben Gamari <ben(a)well-typed.com> wrote: > I would like to understand the root-cause of the issue. It seems that > OS X will now raise EPERM instead of EACCES when certain files are > accessed. That being said, it's not at all clear to me which system call > is failing or why. Could someone familiar with El Capitan describe what > exactly is going on here? > The trace showed access("/usr/bin/ar", 2) => -1/EPERM (instead of -1/EACCES). http://apple.stackexchange.com/questions/193368/what-is-the-rootless-featur… appears relevant. Sounds to me like they automatically set a bunch of stuff immutable (chflags(1) schg flag; also see chflags(2), the underlying syscall) and bump the (equivalent of) securelevel so it can't be altered even by root after system boot. (Sadly, Apple did not bother to update the manpages to reflect launchd.) -- brandon s allbery kf8nh sine nomine associates allbery.b(a)gmail.com ballbery(a)sinenomine.net unix, openafs, kerberos, infrastructure, xmonad http://sinenomine.net

1 0

Re: New release of GHC 7.8 to support OS X El Capitan
by Ben Gamari 18 Jul '15

18 Jul '15

Oleg Grenrus <oleg.grenrus(a)iki.fi> writes: > Hi, > first some background: there is an issue with having Haskell on the > next OS X “El Capitan”: [1] caused by security updates in the > operating system. The cause is too old `unix` package, the same issue > as in [2] I would like to understand the root-cause of the issue. It seems that OS X will now raise EPERM instead of EACCES when certain files are accessed. That being said, it's not at all clear to me which system call is failing or why. Could someone familiar with El Capitan describe what exactly is going on here? > Could someone verify that my understanding of the issue is correct, > i.e. how Cabal-the-tool and Cabal-the-library interoperate. > > For me it seems, that one of the easiest ways to fix the issue (for > the users), is to have a new release in 7.8 branch, with updated > `unix` dependency. Or is it there too might hassle to be possible? I will bring this up in next week's GHC meeting. Cheers, - Ben

1 0

Request for feedback on spec/proposal for distributing package collections via hackage
by Duncan Coutts 14 Jul '15

14 Jul '15

Hi folks, I'd like to get feedback on a spec/proposal for distributing package collections via hackage. This is currently somewhere beyond vapourware but certainly not a fait accompli and hopefully it is at an appropriate point to get feedback. The basic idea is that package collections are: * useful (IMHO, one of the top two solutions to dependency hell, alongside nix-style package management); and * just as we distribute packages via hackage, we should also be able to easily distribute package collections. One would then use them with tools like cabal and stack. Distributing via hackage (both in the sense of the format/protocol and in the sense of the central community hackage instance) seems natural, and allows taking advantage of much of the infrastructure we have for packages already like: * existing user accounts and management infrastructure on the hackage website * allowing anyone to host collections on their own servers, just as they can host their own package archives currently (either as static file sets or with smart servers) * low barrier for distribution, potentially encouraging more collections to be created potentially covering more use cases * security infrastructure (currently in alpha) * automatic mirroring (currently in alpha) Two obvious examples are stackage-lts and stackage-nightly but if we lower the barrier for distribution then there may well be many more. For example, the existing Linux distros put a lot of effort into selecting and maintain package collections, and some of these collections could be distributed via hackage. In fast several Linux distributions already use Hackage's "distro" feature to advertise which versions of packages are provided by that distro. One can also imagine special-purpose collections, and there's probably cases we've not thought of yet. Package collections are different things from packages, not like "meta packages" that one gets in some package systems. A package collection at it's simplest is just a set of source package identifiers (ie names-version pairs). Like packages, package collections have names and versions and are immutable once distributed. The intention is that users can configure their tool to use collection(s), either by nailing down a specific collection version, or by not specifying a version it would default to the latest version of the named collection. (But the specific behaviour is up to the tool) Use cases: * versioned collections. For some collections the policy by which it's defined naturally uses meaningful versions. * daily collections. These can have a date-form version number imposed on them. * "live" "rolling" collections. These could have a simple monotonic increasing version with no particular meaning attached. For such collections, clients might be configured to use the latest (by not specifying a version), but it's always possible to pick a specific revision. * special-purpose collections. Not necessarily collections aiming to cover a large number of common packages, but aiming to cover some application area, or related stack of packages (e.g. some of the web frameworks). * negative collections. Collections of packages you may specifically want to avoid (e.g. deprecated by their authors, or known-broken). Using such collections would rely on clients that can be configured to treat it negatively. Specifics: A package collection specifies a set of source package ids (id being name-version pair). It also optionally specifies a (partial) flag assignment for any package name. The collection does not specify how tools should treat them. That is, a collection does not specify if it should be treated as a strong or a soft constraint, inclusive or exclusive, positive or negative. Such things are completely up to the client's policy and configuration. Similarly for flag assignments, collections do not specify whether tools should interpret these as strong or soft constraints. Syntax: Package collection names and versions exactly follow those of package names (but they live in a different namespace). For example, "stackage-lts-2.9", or "deprecated-343" (the latter being a "rolling" collection with a meaningless monotonically increasing version). A collection distributed in the archive format is just a text file with one entry per line, such as: foo-1.0 foo-1.1 bar >= 3 && < 4 bar +this -that So each line can be one of: * a simple package id * a package version range, using Cabal version range syntax * a package name with a flag assignment, + for on, - for off The interpretation of the above is that: * both foo-1.0 and foo-1.1 are in the collection (ie union not intersection) * all versions of bar between 3 and 4 are in the collection * the package bar has flag 'this' as True, and flag 'that' as False Of course for some collections the policy is that only one version of any package is included, but this is a policy question and the format itself does not impose this constraint. Hackage archive format: collection files live under a different prefix from package tarballs (but are still considered part of the archive) and are named after the collection id. The collection files are not compressed (but of course http clients and servers can negotiate transport compression). The collection files are not included in nor listed in the existing 00-index.tar.gz, but there's other json format metadata for a client to enumerate the available collections and versions. And like with package tarballs, a client that wants a specific collection version can construct the url and fetch it directly. Security: The hackage security system that's currently in alpha testing can easily be extended to cover collections, similarly to how it covers package tarballs. Misc notes: There is no requirement that a hackage-format repo containing collections be closed. That is, the collections may refer to packages not in that archive. This could be useful for private hackage repos that host a small number of private packages, but also host collections that refer both to the private packages and public ones from the community central hackage. The resolution of package names is done by the clients, and some clients may be configured to union/overlay multiple repos. On the other hand, for the central community hackage it may be sensible to enforce a policy that the collections it distributes be closed (ie refer only to packages distributed via hackage). Questions: Is this sufficiently flexible to fully cover the obvious use cases? Are there any interesting use cases that are excluded? Anything else? Duncan

3 4

Re: Improving the "Get Haskell Experience"
by Michael Snoyman 12 Jul '15

12 Jul '15

I think it depends somewhat on operating system, since there are permissions issues to be dealt with regarding user vs global installation. In principle though: I think the HP installers would install to a non-stack-specific location, and then stack would simply use that GHC based on its inclusion in the PATH. (I'm also guessing this will tie in nicely with Linux distro packages, which would likely want ghc to live in /usr/bin). On Sun, Jul 12, 2015 at 10:11 AM Dan Burton <danburton.email(a)gmail.com> wrote: > Stack has the capability of downloading and installing GHC on demand, as > well as auto-updating itself. Both of these features, by default, occur in > subdirectories of the user's home directory. (Slightly different on Windows > but same idea.) Would the Platform install GHC to the stack location > directly, or install it system-wide as previously? (Stack can still make > use of GHC anywhere on your path.) > > On Sunday, July 12, 2015, Michael Snoyman <michael(a)snoyman.com> wrote: > >> I'm +1 on nailing down an LTS release cycle, I've been pushing for it, >> and planning that it would happen after the first few releases. I'm fine >> with doing it starting with the next release if that's desired. >> >> The cygwin/msys conflict is a problematic one. stack has more flexibility >> addressing this than MinGHC did, since stack can control the PATH more >> directly. What we do now is, by default, add msys to the beginning of the >> PATH, and provide a command line option to not use msys at all. I believe >> this combination has addressed the bug reports we've received in the past. >> >> That's not to say I'm opposed to generating binary databases; I'm >> actually in favor of having that option for all platforms at some point >> (there's an open stack issue about it[1]). But it's a significant amount of >> work, and I think if possible we should defer it until we've figured out >> initial integration points. >> >> [1] https://github.com/commercialhaskell/stack/issues/117 >> >> On Sun, Jul 12, 2015 at 9:20 AM Gershom B <gershomb(a)gmail.com> wrote: >> >>> I’m ccing cabal-devel, as that list seems pertinent to this discussion >>> too. In general I’m in favor of unifying efforts such as this. >>> >>> For windows, I’d still like the _option_ to get prebuilt library >>> binaries for the full platform db. The modularity means that they can be >>> just downloaded in a separate folder now, rather than installed into e.g. >>> the global db? If so, that’s a nice win. Here is my motivation — I tried >>> the minghc installer and it mainly worked, but it played terribly with >>> cygwin, which I use pervasively. So I found myself in a situation where one >>> set of paths worked with cygwin, and the other set of paths let me build >>> the network library. I still have some anxieties about those sorts of >>> issues, and being able to “just download the binaries” would make me feel a >>> bit safer about at least one workaround should things get too muddled up. >>> >>> If we synchronize LTS and “platform libs,” then I would like A) some way >>> of distinguishing “blessed platform libs” from “other libs in LTS” (to >>> solve the “curation problem” which has always been a goal of the platform) >>> and B) a standardized release schedule for LTS. >>> >>> (And, of course, I assume this will _not_ be for the platform release >>> upcoming, which is due very shortly, but we’ll have a longer lead time to >>> integrate and shake out all the various issues and test, etc.) >>> >>> —Gershom >>> >>> >>> On July 12, 2015 at 12:04:22 PM, Mark Lentczner ( >>> mark.lentczner(a)gmail.com) wrote: >>> > *tl;dr: We'd like to incorporate stack into Haskell Platform, and stop >>> > shipping pre-built packages, so we banish cabal hell, and have a single >>> > common way to 'get Haskell' that just works.* >>> > >>> > At ICFP '14, there were several long group discussions of the state of >>> > "getting Haskell", including Haskell Platform, Stackage, and other >>> > approaches. Over the last year, there have been a few more public >>> > discussions and evolution on the ideas, and other installer >>> developments. >>> > In particular, Stackage's LTS package sets are a direct development >>> from >>> > this work, and the release of stack has offered new options. >>> > >>> > Today, drawing from all this good work and ideas from so many, we'd >>> would >>> > like to propose a concrete plan: >>> > >>> > - Haskell Platform becomes the standard way to get *GHC* and related >>> > tools: *alex*, *cabal*, *happy*, *hscolour*, and *stack*. It's a >>> > user-friendly, cross-platform installer that gives a standard way to >>> "get >>> > Haskell" for most users. >>> > - Use the *stack* model for package installation: >>> > - The global db has only the GHC packages >>> > - There is a package db for each curated set, Haskell Platform >>> > becomes one such set >>> > - Projects each have their own package db, much like sandboxes. >>> > - Haskell Platform's installer will no longer include pre-built, >>> > pre-installed packages other than GHC's set. Instead, it is configured >>> so >>> > that *stack* can be used to build and install, on as needed, the >>> > corresponding Haskell Platform release packages. >>> > >>> > We think this plan solves many different community needs: >>> > >>> > - We have a clear way to "get Haskell" that works for a wide variety of >>> > use cases. >>> > - HP installer gets much smaller, and about as minimal as a working >>> > installation can get. >>> > - By leaving most packages out of the global database, users of >>> > cabal-install, will now have far fewer problems. Sandbox builds should >>> now >>> > never give users "cabal hell" like warnings. >>> > - By building and installing the Platform packages into it's own >>> package >>> > db, users get the benefit of building and installing these common >>> packages >>> > only once per system, yet can easily bypass them for any given project >>> if >>> > desired. >>> > - Since the Platform packages are now built and installed as needed, >>> > installing on smaller systems or servers without OpenGL will work. >>> > >>> > To do this, we have a bit of work ahead of us: We need to settle on >>> > installation layout for each OS (including getting msys into the >>> Windows >>> > installer); decide on the naming and versioning of the Platform >>> package set >>> > (is it just LTS? does it have a different life cycle? etc...); getting >>> > *stack* ready such a distribution; and configuring (or updating) >>> > *cabal-install* to support the three-layer package db scheme. We think >>> we >>> > can do this in short order. >>> > >>> > We recognize this represents a significant change for the Platform, and >>> > will require buy-in from the various parts, especially *ghc*, *cabal*, >>> and >>> > *stack*. We'd like to get your input. >>> > >>> > - Michael & Mark >>> > _______________________________________________ >>> > Libraries mailing list >>> > Libraries(a)haskell.org >>> > http://mail.haskell.org/cgi-bin/mailman/listinfo/libraries >>> > >>> >>> _______________________________________________ >>> ghc-devs mailing list >>> ghc-devs(a)haskell.org >>> http://mail.haskell.org/cgi-bin/mailman/listinfo/ghc-devs >>> >> -- >> > You received this message because you are subscribed to the Google Groups >> "haskell-stack" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to haskell-stack%2Bunsubscribe(a)googlegroups.com. >> To post to this group, send email to haskell-stack(a)googlegroups.com. >> > To view this discussion on the web visit >> https://groups.google.com/d/msgid/haskell-stack/CAKA2JgKYuBMU5wtbjGV72dDKvS… >> <https://groups.google.com/d/msgid/haskell-stack/CAKA2JgKYuBMU5wtbjGV72dDKvS…> >> . > > >> For more options, visit https://groups.google.com/d/optout. >> > > > -- > -- Dan Burton > > -- > You received this message because you are subscribed to the Google Groups > "haskell-stack" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to haskell-stack%2Bunsubscribe(a)googlegroups.com. > To post to this group, send email to haskell-stack(a)googlegroups.com. > To view this discussion on the web visit > https://groups.google.com/d/msgid/haskell-stack/CALSygwfNjyxWFL0y4-_5aSyZZV… > <https://groups.google.com/d/msgid/haskell-stack/CALSygwfNjyxWFL0y4-_5aSyZZV…> > . > For more options, visit https://groups.google.com/d/optout. >

1 0

Re: Improving the "Get Haskell Experience"
by Gershom B 12 Jul '15

12 Jul '15

I’m ccing cabal-devel, as that list seems pertinent to this discussion too. In general I’m in favor of unifying efforts such as this. For windows, I’d still like the _option_ to get prebuilt library binaries for the full platform db. The modularity means that they can be just downloaded in a separate folder now, rather than installed into e.g. the global db? If so, that’s a nice win. Here is my motivation — I tried the minghc installer and it mainly worked, but it played terribly with cygwin, which I use pervasively. So I found myself in a situation where one set of paths worked with cygwin, and the other set of paths let me build the network library. I still have some anxieties about those sorts of issues, and being able to “just download the binaries” would make me feel a bit safer about at least one workaround should things get too muddled up. If we synchronize LTS and “platform libs,” then I would like A) some way of distinguishing “blessed platform libs” from “other libs in LTS” (to solve the “curation problem” which has always been a goal of the platform) and B) a standardized release schedule for LTS. (And, of course, I assume this will _not_ be for the platform release upcoming, which is due very shortly, but we’ll have a longer lead time to integrate and shake out all the various issues and test, etc.) —Gershom On July 12, 2015 at 12:04:22 PM, Mark Lentczner (mark.lentczner(a)gmail.com) wrote: > *tl;dr: We'd like to incorporate stack into Haskell Platform, and stop > shipping pre-built packages, so we banish cabal hell, and have a single > common way to 'get Haskell' that just works.* > > At ICFP '14, there were several long group discussions of the state of > "getting Haskell", including Haskell Platform, Stackage, and other > approaches. Over the last year, there have been a few more public > discussions and evolution on the ideas, and other installer developments. > In particular, Stackage's LTS package sets are a direct development from > this work, and the release of stack has offered new options. > > Today, drawing from all this good work and ideas from so many, we'd would > like to propose a concrete plan: > > - Haskell Platform becomes the standard way to get *GHC* and related > tools: *alex*, *cabal*, *happy*, *hscolour*, and *stack*. It's a > user-friendly, cross-platform installer that gives a standard way to "get > Haskell" for most users. > - Use the *stack* model for package installation: > - The global db has only the GHC packages > - There is a package db for each curated set, Haskell Platform > becomes one such set > - Projects each have their own package db, much like sandboxes. > - Haskell Platform's installer will no longer include pre-built, > pre-installed packages other than GHC's set. Instead, it is configured so > that *stack* can be used to build and install, on as needed, the > corresponding Haskell Platform release packages. > > We think this plan solves many different community needs: > > - We have a clear way to "get Haskell" that works for a wide variety of > use cases. > - HP installer gets much smaller, and about as minimal as a working > installation can get. > - By leaving most packages out of the global database, users of > cabal-install, will now have far fewer problems. Sandbox builds should now > never give users "cabal hell" like warnings. > - By building and installing the Platform packages into it's own package > db, users get the benefit of building and installing these common packages > only once per system, yet can easily bypass them for any given project if > desired. > - Since the Platform packages are now built and installed as needed, > installing on smaller systems or servers without OpenGL will work. > > To do this, we have a bit of work ahead of us: We need to settle on > installation layout for each OS (including getting msys into the Windows > installer); decide on the naming and versioning of the Platform package set > (is it just LTS? does it have a different life cycle? etc...); getting > *stack* ready such a distribution; and configuring (or updating) > *cabal-install* to support the three-layer package db scheme. We think we > can do this in short order. > > We recognize this represents a significant change for the Platform, and > will require buy-in from the various parts, especially *ghc*, *cabal*, and > *stack*. We'd like to get your input. > > - Michael & Mark > _______________________________________________ > Libraries mailing list > Libraries(a)haskell.org > http://mail.haskell.org/cgi-bin/mailman/listinfo/libraries >

2 1

Hackage security alpha
by Duncan Coutts 08 Jul '15

08 Jul '15

Hi folks, We're doing an alpha release of the hackage security work today and we'd like to invite you all to help test it. In addition to the security improvements it includes automatic use of mirrors (including the server distributing a list of available public mirrors) and includes incremental downloads of the hackage index, so cabal update should be a lot faster. At this alpha stage we would like some but not too many users to try it out, so when things do break we don't have it break for too many people all at once. But subscribers to this list are just the kind of expert users who we'd like to try it out and report issues. In particular we're interested in any problems caused by crazy proxies and annoying things of that ilk. During the beta we'll make the whole thing a bit more user friendly to get more people to try it out. So for the moment you have to grab things from git branches etc. All the details are in this blog post: http://www.well-typed.com/blog/2015/07/hackage-security-alpha/ As it says there, report issues in the github bug tracker. Oh and I don't think we say it in the blog post but the idea is that for any of the new library dependences for the security stuff, if any of them are problematic we can just bundle them with cabal-install (we'll probably just bundle them all). The design deliberately keeps these dependencies to a minimum: SHA256 hashing, ed25519 signing/checking provided by minimal bundled C code. For the alpha the cabal-install integration just uses these as external dependencies. -- Duncan Coutts, Haskell Consultant Well-Typed LLP, http://www.well-typed.com/

3 3

UseSandbox
by Bardur Arantsson 03 Jul '15

03 Jul '15

Hi all, It seems to me that UseSandbox is slightly strangely defined at the moment. It's currently defined as data UseSandbox = UseSandbox FilePath | NoSandbox but it seems to me that it would be better to define it such that it actually contains relevant information about the sandbox if the UseSandbox constructor case instead of just the filepath. On the one hand this would require a separate "read-the-sandbox-information-we-need" function somewhere before individual commands run, but that would give us the opportunity to actually give relevant warnings in various significant cases; see for example https://github.com/haskell/cabal/issues/2381 Am I missing something which necessitates using only the FilePath? (Perhaps some dependence on sub-command switches, or similar?) Any thoughts, comments...? Regards,

2 6