Safe lens?

Greg Fitzgerald

29 Oct 2012 29 Oct '12

12:51 p.m.

Why are getters from the 'lens' package unsafe? Is there a subset like Data.Label.Pure from 'fclabels' that can be imported safely? $ cat a.hs {-# LANGUAGE Safe #-} import Control.Lens.Getter main = print 123 $ runghc a.hs a.hs:3:1: Control.Lens.Getter: Can't be safely imported! The module itself isn't safe. Thanks, Greg

Show replies by date

Petr P

29 Oct 29 Oct

1:14 p.m.

Hi I believe the reason is that it uses TemplateHaskell for automatic derivation of labels. And TemplateHaskell is of course unsafe, since it could convert your code into something entirely different. Best regards, Petr Pudlak 2012/10/29 Greg Fitzgerald :

...

Why are getters from the 'lens' package unsafe? Is there a subset like Data.Label.Pure from 'fclabels' that can be imported safely?

$ cat a.hs {-# LANGUAGE Safe #-}

import Control.Lens.Getter

main = print 123

$ runghc a.hs

a.hs:3:1: Control.Lens.Getter: Can't be safely imported! The module itself isn't safe.

Thanks, Greg

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

Michael Sloan

2:23 p.m.

I've never understood this restriction. Template Haskell cannot convert your code to something entirely different, only generate code at splice points. It seems to me like Safe Haskell should already have the necessary mechanisms for Safe Template Haskell to be implemented. The Safe Haskell docs say "TemplateHaskell — Is particularly dangerous, as it can cause side effects even at compilation time and can be used to access constructors of abstract data types." Also: "Module boundary control — Haskell code compiled using the safe language is guaranteed to only access symbols that are publicly available to it through other modules export lists. An important part of this is that safe compiled code is not able to examine or create data values using data constructors that it cannot import. If a module M establishes some invariants through careful use of its export list then code compiled using the safe language that imports M is guaranteed to respect those invariants. Because of this, Template Haskell and GeneralizedNewtypeDeriving are disabled in the safe language as they can be used to violate this property. " This seems like something that could be readily fixed - just make "reify" throw an error when attempting to inspect non-exported things when compiling with "-XSafe". We'd also need to check that the generated code does not reference things from unsafe modules (as it can reference things that aren't imported). I'm not sure why "it can cause side effects even at compile time". If the module with the Template Haskell code is -XSafe or -XTrustworthy, then presumably it does not cause side effects. One side effect that could be troublesome is divergence / bottom. This seems OK to me, as the user already has to deal with this in runtime code and the errors aren't very cryptic. -Michael On Mon, Oct 29, 2012 at 10:14 AM, Petr P wrote:

...

Hi

I believe the reason is that it uses TemplateHaskell for automatic derivation of labels. And TemplateHaskell is of course unsafe, since it could convert your code into something entirely different.

Best regards, Petr Pudlak

2012/10/29 Greg Fitzgerald :

...
Why are getters from the 'lens' package unsafe? Is there a subset like Data.Label.Pure from 'fclabels' that can be imported safely?

$ cat a.hs {-# LANGUAGE Safe #-}

import Control.Lens.Getter

main = print 123

$ runghc a.hs

a.hs:3:1: Control.Lens.Getter: Can't be safely imported! The module itself isn't safe.

Thanks, Greg

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

Greg Fitzgerald

4:38 p.m.

There's no dependency on TH here. I'm hoping to do the same thing as I have done with fclabels, which is to have a Trustworthy module that imports Control.Lens.TH, derive lenses, and then allow all users of that data type to Safely import only the Getter/Setter modules. So, I'm curious: * Could Control.Lens.Getter have a LANGUAGE dependency it doesn't need? * Is there something fundamental in the design of lens (compared to fclabels), that its getters require unsafe language features? * Maybe the Internal module should be marked Trustworthy? Thanks, Greg On Mon, Oct 29, 2012 at 10:14 AM, Petr P wrote:

...

Hi

I believe the reason is that it uses TemplateHaskell for automatic derivation of labels. And TemplateHaskell is of course unsafe, since it could convert your code into something entirely different.

Best regards, Petr Pudlak

2012/10/29 Greg Fitzgerald :

...
Why are getters from the 'lens' package unsafe? Is there a subset like Data.Label.Pure from 'fclabels' that can be imported safely?

$ cat a.hs {-# LANGUAGE Safe #-}

import Control.Lens.Getter

main = print 123

$ runghc a.hs

a.hs:3:1: Control.Lens.Getter: Can't be safely imported! The module itself isn't safe.

Thanks, Greg

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

Edward Kmett

5:33 p.m.

Actually Control.Lens.Getter doesn't use TH. The issue is more that it depends on some modules I didn't flag as Trustworthy and which require some more high-falutin type system extensions that GHC isn't happy about treating as Safe. I'll try adding a few Trustworthy flags. It previously was treated as Trustworthy or SafeInfered throughout. Somewhere along the way I must have toggled on an extension and broken that property. -Edward On Mon, Oct 29, 2012 at 1:14 PM, Petr P wrote:

...

Hi

I believe the reason is that it uses TemplateHaskell for automatic derivation of labels. And TemplateHaskell is of course unsafe, since it could convert your code into something entirely different.

Best regards, Petr Pudlak

2012/10/29 Greg Fitzgerald :

...
Why are getters from the 'lens' package unsafe? Is there a subset like Data.Label.Pure from 'fclabels' that can be imported safely?

$ cat a.hs {-# LANGUAGE Safe #-}

import Control.Lens.Getter

main = print 123

$ runghc a.hs

a.hs:3:1: Control.Lens.Getter: Can't be safely imported! The module itself isn't safe.

Thanks, Greg

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

Michael Sloan

5:42 p.m.

It happened somewhere between 2.6 and 2.7: http://hackage.haskell.org/packages/archive/lens/2.6.1/doc/html/Control-Lens... http://hackage.haskell.org/packages/archive/lens/2.7.0.1/doc/html/Control-Le... The strange thing is that the only internal dependency of 2.7.0.1, Control.Lens.Isomorphic, is still "Safe-Infered" (this spelling error should probably be fixed) http://hackage.haskell.org/packages/archive/lens/2.7.0.1/doc/html/Control-Le... It'd be pretty fancy if Safe Haskell could give reasons for "None" / tell what would have made it unsafe in the event of "Trustworthy". Particularly fancy if integrated into the haddocks. -mgsloan On Mon, Oct 29, 2012 at 2:33 PM, Edward Kmett wrote:

...

Actually Control.Lens.Getter doesn't use TH. The issue is more that it depends on some modules I didn't flag as Trustworthy and which require some more high-falutin type system extensions that GHC isn't happy about treating as Safe. I'll try adding a few Trustworthy flags.

It previously was treated as Trustworthy or SafeInfered throughout.

Somewhere along the way I must have toggled on an extension and broken that property.

-Edward

On Mon, Oct 29, 2012 at 1:14 PM, Petr P wrote:

...
Hi

I believe the reason is that it uses TemplateHaskell for automatic derivation of labels. And TemplateHaskell is of course unsafe, since it could convert your code into something entirely different.

Best regards, Petr Pudlak

2012/10/29 Greg Fitzgerald :

...
Why are getters from the 'lens' package unsafe? Is there a subset like Data.Label.Pure from 'fclabels' that can be imported safely?

$ cat a.hs {-# LANGUAGE Safe #-}

import Control.Lens.Getter

main = print 123

$ runghc a.hs

a.hs:3:1: Control.Lens.Getter: Can't be safely imported! The module itself isn't safe.

Thanks, Greg

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

Edward Kmett

5:46 p.m.

I fixed it. Version 3.0.6 was just uploaded to hackage and is appropriately Trustworthy where needed. Please let me know if I missed flagged anything you need flagged, or mis-flagged anything you think shouldn't be. ;) On Mon, Oct 29, 2012 at 5:42 PM, Michael Sloan wrote:

...

It happened somewhere between 2.6 and 2.7:

http://hackage.haskell.org/packages/archive/lens/2.6.1/doc/html/Control-Lens...

http://hackage.haskell.org/packages/archive/lens/2.7.0.1/doc/html/Control-Le...

The strange thing is that the only internal dependency of 2.7.0.1, Control.Lens.Isomorphic, is still "Safe-Infered" (this spelling error should probably be fixed)

http://hackage.haskell.org/packages/archive/lens/2.7.0.1/doc/html/Control-Le...

It'd be pretty fancy if Safe Haskell could give reasons for "None" / tell what would have made it unsafe in the event of "Trustworthy". Particularly fancy if integrated into the haddocks.

-mgsloan

...
Actually Control.Lens.Getter doesn't use TH. The issue is more that it depends on some modules I didn't flag as Trustworthy and which require some more high-falutin type system extensions that GHC isn't happy about

...
as Safe. I'll try adding a few Trustworthy flags.

It previously was treated as Trustworthy or SafeInfered throughout.

Somewhere along the way I must have toggled on an extension and broken

On Mon, Oct 29, 2012 at 2:33 PM, Edward Kmett wrote: treating that

...
property.

-Edward

On Mon, Oct 29, 2012 at 1:14 PM, Petr P wrote:

...
Hi

I believe the reason is that it uses TemplateHaskell for automatic derivation of labels. And TemplateHaskell is of course unsafe, since it could convert your code into something entirely different.

Best regards, Petr Pudlak

2012/10/29 Greg Fitzgerald :

...
Why are getters from the 'lens' package unsafe? Is there a subset like Data.Label.Pure from 'fclabels' that can be imported safely?

$ cat a.hs {-# LANGUAGE Safe #-}

import Control.Lens.Getter

main = print 123

$ runghc a.hs

a.hs:3:1: Control.Lens.Getter: Can't be safely imported! The module itself isn't safe.

Thanks, Greg

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

Michael Sloan

5:54 p.m.

I guess that's a good way to safeguard against future accidental toggleage. Still, it's puzzling that the status of "Safe-Infered" was lost. On Mon, Oct 29, 2012 at 2:46 PM, Edward Kmett wrote:

...

I fixed it. Version 3.0.6 was just uploaded to hackage and is appropriately Trustworthy where needed.

Please let me know if I missed flagged anything you need flagged, or mis-flagged anything you think shouldn't be. ;)

On Mon, Oct 29, 2012 at 5:42 PM, Michael Sloan wrote:

...
It happened somewhere between 2.6 and 2.7:

http://hackage.haskell.org/packages/archive/lens/2.6.1/doc/html/Control-Lens...

http://hackage.haskell.org/packages/archive/lens/2.7.0.1/doc/html/Control-Le...

The strange thing is that the only internal dependency of 2.7.0.1, Control.Lens.Isomorphic, is still "Safe-Infered" (this spelling error should probably be fixed)

http://hackage.haskell.org/packages/archive/lens/2.7.0.1/doc/html/Control-Le...

It'd be pretty fancy if Safe Haskell could give reasons for "None" / tell what would have made it unsafe in the event of "Trustworthy". Particularly fancy if integrated into the haddocks.

-mgsloan

On Mon, Oct 29, 2012 at 2:33 PM, Edward Kmett wrote:

...
Actually Control.Lens.Getter doesn't use TH. The issue is more that it depends on some modules I didn't flag as Trustworthy and which require some more high-falutin type system extensions that GHC isn't happy about treating as Safe. I'll try adding a few Trustworthy flags.

It previously was treated as Trustworthy or SafeInfered throughout.

Somewhere along the way I must have toggled on an extension and broken that property.

-Edward

On Mon, Oct 29, 2012 at 1:14 PM, Petr P wrote:

...
Hi

I believe the reason is that it uses TemplateHaskell for automatic derivation of labels. And TemplateHaskell is of course unsafe, since it could convert your code into something entirely different.

Best regards, Petr Pudlak

2012/10/29 Greg Fitzgerald :

...
Why are getters from the 'lens' package unsafe? Is there a subset like Data.Label.Pure from 'fclabels' that can be imported safely?

$ cat a.hs {-# LANGUAGE Safe #-}

import Control.Lens.Getter

main = print 123

$ runghc a.hs

a.hs:3:1: Control.Lens.Getter: Can't be safely imported! The module itself isn't safe.

Thanks, Greg

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

Edward Kmett

6:08 p.m.

We picked up some extensions along the way in the dependency, so that went to None, then the things that depended on it devolved from SafeInferred to None as well. -Edward On Mon, Oct 29, 2012 at 5:54 PM, Michael Sloan wrote:

...

I guess that's a good way to safeguard against future accidental toggleage. Still, it's puzzling that the status of "Safe-Infered" was lost.

On Mon, Oct 29, 2012 at 2:46 PM, Edward Kmett wrote:

...
I fixed it. Version 3.0.6 was just uploaded to hackage and is appropriately Trustworthy where needed.

Please let me know if I missed flagged anything you need flagged, or mis-flagged anything you think shouldn't be. ;)

On Mon, Oct 29, 2012 at 5:42 PM, Michael Sloan wrote:

...
It happened somewhere between 2.6 and 2.7:

http://hackage.haskell.org/packages/archive/lens/2.6.1/doc/html/Control-Lens...

...
http://hackage.haskell.org/packages/archive/lens/2.7.0.1/doc/html/Control-Le...

...
The strange thing is that the only internal dependency of 2.7.0.1, Control.Lens.Isomorphic, is still "Safe-Infered" (this spelling error should probably be fixed)

http://hackage.haskell.org/packages/archive/lens/2.7.0.1/doc/html/Control-Le...

...
It'd be pretty fancy if Safe Haskell could give reasons for "None" / tell what would have made it unsafe in the event of "Trustworthy". Particularly fancy if integrated into the haddocks.

-mgsloan

On Mon, Oct 29, 2012 at 2:33 PM, Edward Kmett wrote:

...
Actually Control.Lens.Getter doesn't use TH. The issue is more that it depends on some modules I didn't flag as Trustworthy and which require some more high-falutin type system extensions that GHC isn't happy about treating as Safe. I'll try adding a few Trustworthy flags.

It previously was treated as Trustworthy or SafeInfered throughout.

Somewhere along the way I must have toggled on an extension and broken that property.

-Edward

On Mon, Oct 29, 2012 at 1:14 PM, Petr P wrote:

...
Hi

I believe the reason is that it uses TemplateHaskell for automatic derivation of labels. And TemplateHaskell is of course unsafe, since it could convert your code into something entirely different.

Best regards, Petr Pudlak

2012/10/29 Greg Fitzgerald :

...
Why are getters from the 'lens' package unsafe? Is there a subset like Data.Label.Pure from 'fclabels' that can be imported safely?

$ cat a.hs {-# LANGUAGE Safe #-}

import Control.Lens.Getter

main = print 123

$ runghc a.hs

a.hs:3:1: Control.Lens.Getter: Can't be safely imported! The module itself isn't safe.

Thanks, Greg

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

Greg Fitzgerald

7:26 p.m.

Works great. Thanks for the quick work! -Greg On Mon, Oct 29, 2012 at 2:46 PM, Edward Kmett wrote:

...

I fixed it. Version 3.0.6 was just uploaded to hackage and is appropriately Trustworthy where needed.

Please let me know if I missed flagged anything you need flagged, or mis-flagged anything you think shouldn't be. ;)

On Mon, Oct 29, 2012 at 5:42 PM, Michael Sloan wrote:

...
It happened somewhere between 2.6 and 2.7:

http://hackage.haskell.org/packages/archive/lens/2.6.1/doc/html/Control-Lens...

http://hackage.haskell.org/packages/archive/lens/2.7.0.1/doc/html/Control-Le...

The strange thing is that the only internal dependency of 2.7.0.1, Control.Lens.Isomorphic, is still "Safe-Infered" (this spelling error should probably be fixed)

http://hackage.haskell.org/packages/archive/lens/2.7.0.1/doc/html/Control-Le...

It'd be pretty fancy if Safe Haskell could give reasons for "None" / tell what would have made it unsafe in the event of "Trustworthy". Particularly fancy if integrated into the haddocks.

-mgsloan

On Mon, Oct 29, 2012 at 2:33 PM, Edward Kmett wrote:

...
Actually Control.Lens.Getter doesn't use TH. The issue is more that it depends on some modules I didn't flag as Trustworthy and which require some more high-falutin type system extensions that GHC isn't happy about treating as Safe. I'll try adding a few Trustworthy flags.

It previously was treated as Trustworthy or SafeInfered throughout.

Somewhere along the way I must have toggled on an extension and broken that property.

-Edward

On Mon, Oct 29, 2012 at 1:14 PM, Petr P wrote:

...
Hi

I believe the reason is that it uses TemplateHaskell for automatic derivation of labels. And TemplateHaskell is of course unsafe, since it could convert your code into something entirely different.

Best regards, Petr Pudlak

2012/10/29 Greg Fitzgerald :

...
Why are getters from the 'lens' package unsafe? Is there a subset like Data.Label.Pure from 'fclabels' that can be imported safely?

$ cat a.hs {-# LANGUAGE Safe #-}

import Control.Lens.Getter

main = print 123

$ runghc a.hs

a.hs:3:1: Control.Lens.Getter: Can't be safely imported! The module itself isn't safe.

Thanks, Greg

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe

dag.odenhall＠gmail.com

31 Oct 31 Oct

12:33 a.m.

On Mon, Oct 29, 2012 at 10:42 PM, Michael Sloan wrote:

...

It'd be pretty fancy if Safe Haskell could give reasons for "None" / tell what would have made it unsafe in the event of "Trustworthy". Particularly fancy if integrated into the haddocks.

ghc -fwarn-unsafe

4585

Age (days ago)

4587

Last active (days ago)

List overview

Download

10 comments

5 participants

participants (5)

dag.odenhall＠gmail.com
Edward Kmett
Greg Fitzgerald
Michael Sloan
Petr P

Safe lens?

tags

participants (5)