May 2005 - Libraries - Haskell.org

RE: Difference Argument Order
by Simon Marlow 23 May '05

23 May '05

On 23 May 2005 01:43, Ashley Yakeley wrote: > Which of these argument orders is more intuitive to you? > > 1. This one makes more sense when considering the function formed by > applying one argument: > > add :: Diff -> Absolute -> Absolute > add d a = a + d > subtract :: Diff -> Absolute -> Absolute > subtract d a = a - d > diff :: Absolute -> Absolute -> Diff > diff a b = b - a > > So "add x", "subtract y" and perhaps "diff z" are intuitively useful > functions. And we also have "subtract = add . negate". > > 2. This one is more familiar for the English language and for the > standard operators: > > add :: Absolute -> Diff -> Absolute > add a d = a + d > subtract :: Absolute -> Diff -> Absolute > subtract a d = a - d > diff :: Absolute -> Absolute -> Diff > diff a b = a - b If you have the second form, then it would make sense to call them "plus", and "minus", because they correspond to the infix operators. BTW, the Prelude already has "subtract" with the opposite argument order to infix "-", but this was provided mainly because (-1) means (negate 1) rather than ((-) 1). For the "diff" functions, the first form seems more natural to me, because the arguments increase left-to-right, ie. in (diff T1 T2) T2 is later than T1. Cheers, Simon

1 0

Licence for time library code?
by Ashley Yakeley 23 May '05

23 May '05

What licence should I grant for code that might become part of the standard libraries? -- Ashley Yakeley, Seattle WA

2 1

Haddock Options in Cabal
by Dominic Steinitz 22 May '05

22 May '05

I want to generate my documentation with the following options: haddock -h -v -i <url>,<base> --source=<source> Is there a way of doing this in Cabal? I didn't think there was as looking at the code, neither prehaddock or posthaddock hooks would help: code <- rawSystemVerbose verbose (fromJust mHaddock) (["-h", "-o", targetDir, "-t", showPkg, "-p", prologName] ++ (if verbose > 4 then ["-v"] else []) ++ outFiles ) I'm happy to have a go at modifying Cabal but would appreciate some guidance on what the best approach is. Dominic.

2 1

RE: WASHHTML problem
by Simon Marlow 21 May '05

21 May '05

On 18 May 2005 23:55, Frederik Eaton wrote: > My cabal build is dying with the following error message when I try to > depend on WASHHTML. Any ideas how to fix it? It looks like you need a dependency on haskell98. Cheers, Simon

2 1

Re[2]: hackage, cabal-get, and security
by Bulat Ziganshin 20 May '05

20 May '05

Hello Isaac, Wednesday, May 18, 2005, 8:07:04 PM, you wrote: IJ> If someone doesn't want to take part in the keysigning, they don't IJ> have to. The user will be warned that the authenticity of the package IJ> can't be verified. i think that author of the software make the decision whether it trust or don't trust package signed with home-made key. warning user about this is too-protective. another story is when package downloaded not as part of compile-some-big-app process, but by the programmer for his own use i think that to make my viewpoint more obvious, i must tell just about yourself. i have written several libs, and i don't know personally Simon PJ or Haskell Church, so noone can say that me is really me :) is that mean that my libs will be second-sort? :) next. i, the Joe Lucky, install the software, written by someone. it's really matter for me, that this software relies on packages written by trusted or untrusted authorities? next. i don't know how to use gpg and don't want to know :) you say that security will get more important because number of Haskell users will grow. actually, creating complex security scheme is excellent way to solve this problem - number of Haskell users will just not grow because this scheme will be too complex. remember - when number of peoples grow, their average qualification are falls down i don't love to debate, but creating CPAN-like packages library is one of key steps to rising language popularity. and i definitely want that entrance ticket to this library will cost less than $50 ;) -- Best regards, Bulat mailto:bulatz@HotPOP.com

7 12

hackage, cabal-get, and security
by Isaac Jones 20 May '05

20 May '05

Followups to libraries(a)haskell.org, please. I'm working with Lemmih on the designs for Hackage and Cabal-Get. He's a real trooper, since I'm a total "customer" and have hardly written a line of code for these tools, but keep coming up with new requirements. The basic interaction we would like is this: 1) upload a tarball of a cabal-ized tool to the web site 2) the tarball gets unpacked, the .cabal file is read and added to the database 3) Now, an end user can say "cabal-get pkgname" and it'll download pkgname and all of its build-depends, compile and install them. Use the --user flag if you want to install it all locally. Yay! This actually already works :) The big problem actually is that this is in no way secure, and just begging to be exploited. Boo. I was assuming that we'd add some kind of package signing similar to what Debian does in its apt-secure tool (since I was one of the authors on that tool, I have a good idea about what we need), but I figured we could do that later. But now I'm thinking that this is a stupid idea, and it needs to be secure from the get-go. So here's the new sequence of steps: 1) Generate a gnupg key. preferably get it signed by someone in my web of trust (I'll try to organize a keysigning party at ICFP). We have a core group already by virtue of Debian's web of trust. 2) use cabal-put to sign and upload a package (or get someone with a key to upload your package) 2.a) if you try to upload a new version of a package that's signed by someone else's key, you're out of luck. You'll have to get me to over-ride it or get the original uploader to upload the new version. 3) cabal-get can then be used to download and install as before, but first it checks the signatures of all the packages. If any of them are untrusted signatures (as defined by the cabal-get keyring), then warn the end user. It'll be harder to upload packages, but at least now exploits won't be trivial, and for signed packages, we have something approaching Real Security! What do folks think of that? peace, isaac

7 18

Re: [Haskell] HaskellForge
by Isaac Jones 20 May '05

20 May '05

I did have a fantasy about how hackage might host projects some day, but it's definitely a Hackage-2.0 thing. Here's the idea: - every uploaded package is unpacked and made into a darcs repository (or maybe you just provide Hackage a darcs URL w/ a cabal file at the top, and hackage goes and fetches the already existing repository) - after that, the project owner could upload or push patches, or instruct hackage to pull a tag or patch or something. - also, "outsiders" could submit darcs patches to hackage on a per-project basis, and hackage would collect those patches, and even offer them to anyone who wants to see them. The project owner could approve or ignore or reject a patch as she sees fit. - People could vote on patches, though, so if everyone wants a bugfix that the project owner thinks is too ugly, then they can vote on a patch or set of patches and hackage would automatically start offering a branch with the patches in it. The owner would probably have the option to kill branches / forks, but this way, if a maintainer disappeared (as sometimes happens around here), then people could still work with the project, there would be a de-facto latest version until someone took over maintainership from the project owner. On another topic, there has been some discussion about using gforge or something for haskell projects, but the general consensus was something like: - people probably wouldn't use it, there's already sourceforge if they wanted to use something like that - all people have to do is email the maintainer of the web page to get their tools listed on haskell.org/libraries I had a dissenting opinion, I think it would be a good thing, but I don't know if people would use it or not. The discussion was in part captured here (thanks Shae!): http://www.scannedinavian.org/AvianWiki/HaskellProjects There was even a prototype at gforge.ScannedInAvian.org but it seems to be gone. peace, isaac

2 1

hackage, cabal-get, and security
by Dominic Steinitz 19 May '05

19 May '05

> > >Peter Simons <simons at cryp.to <http://www.haskell.org/mailman/listinfo/libraries>> writes: > >(snip) >Dominic Steinitz asks: >>/ > 2. How do I get a trusted key given I am not likely to >/>/ > meet anybody "trusted" in the near future? >/>/ >/>/ Unfortunately, that is impossible. Your best bet is to have >/>/ everybody sign everybody else's key at every possible >/>/ opportunity, and that still won't mean that the key Joe Doe >/>/ downloaded from the Internet will be for real. >/ >For now, I'm thinking that a "trusted key", from Hackage's >perspective, will be a that has a path, which I trust, from me to the >keyholder. In particular, in the short term at least, I'm hoping that >folks in Debian will be willing to sign Haskell users' keys. This is >convenient since Debian Developers are scattered all over the world. >There may even be one near you ;) To me, this is a high-enough bar. >If anyone disagrees strongly with that, let me know, but please also >suggest a solution. > >Why me? Because I have physical access to the box that Hackage will >live on, and I have a good handful of trusted keys. > > I'm not sure I appreciated this. Are you saying that the package builder signs with their key and then uploads it and you sign it? >(snip) >>/ > 3. What constitutes a "trusted" key? >/>/ >/>/ There are no trusted keys. The decision of whether to trust >/>/ a key or not _must_ be made by the person who downloads the >/>/ package -- the user. Nobody else can make that decision for >/>/ him. >/ >Right. Hackage will sign packages which are signed by keys that it >trusts, and cabal-get will come with a hackage public key. I suppose >cabal-get should ask whether or not to trust the hackage key by >default upon installation. > > So the package installer trusts the hackage key but not the package builder's key? This implies you trust the package builder's key (somehow) and sign the package with the hackage key. What happens if you are not available? How do you do delegation? I'm still not clear how keys get revoked in pgp. If the hackage key gets compromised what happens? If the package builder's key gets compromised what happens? I assume you have to revoke the hackage key and the builder has to revoke their key. Is my understanding correct? Another question which I don't think has been answered: suppose I become untrustworthy (I start putting trojans in my code) what happens? I assume the answer is you, as gatekeeper, find out and then no longer sign my code with the hackage key? >BTW, if anyone wants to help hack on this, let me know :) > > > I'd be happy to help if you let me know what needs doing. Dominic.

1 0

RE: SearchPath (was RE: hackage, cabal-get, and security)
by Simon Marlow 19 May '05

19 May '05

On 17 May 2005 17:14, S. Alexander Jacobson wrote: >> - versioning > > With SearchPath, you supply the URLs of the module maps you want to > use. SearchPath then uses these map to locate, download and "install" > needed libraries without further user intervention. > > A module map is just a file mapping module names to the base URLs of > directories in which they reside. If you want to supply the URL of a > particular version of a module map rather than "latest" you are free > to do that. But how do you know what module maps were being used by the author of the module you download? Don't you have to download their module map file too? Cheers, Simon

4 4

Problem with Editor Combinators
by bft 19 May '05

19 May '05

I am trying to use the EdComb library on a Windows Operating System with Hugs98. http://www2-data.informatik.unibw-muenchen.de/EdComb/ I have a problem when loading the file ...\EdComb\Editor.lhs The message below appears after that FranTk is well loaded : Reading file "E:\EdComb\FranTkUtils.lhs": ERROR "E:\EdComb\FranTkUtils.lhs":21 - Undefined type constructor "Structured" I have searched in all the EdComb, FranTk and Hugs libraries the file in which this data structure (Structured) is defined in vain. I had the same problem when trying to play with the Oege de Moor's extensible structure editor, http://web.comlab.ox.ac.uk/oucl/work/oege.de.moor/ when loading the file ...\struct\Label.hs. The message below appears (FranTk is well loaded ) : Reading file "....\struct\ViewTypes.hs" ERROR "....\struct\ViewTypes.hs":9 - Undefined type constructor "Structured Can someone tell me what to do in the case? Thank you in advance

1 0