Support tar-0.6

[Bodigrim]

cabal-install demands tar < 0.6, prohibiting a recently released https://hackage.haskell.org/package/tar-0.6.0.0.
Cf. commercialhaskell/stackage#7202

[ulysses4ever]

@Bodigrim thanks for the ping! I'm sure we'd welcome a PR...

[ffaf1]

We should modify stack @ to ping someone who is active in cabal dev, or even better — if possible — ping cabal as an organisation.

[Bodigrim]

We should modify stack @ to ping someone who is active in cabal dev, or even better — if possible — ping cabal as an organisation.

AFAIR pinging organisations does not work. I encourage Cabal team

• To move https://github.com/commercialhaskell/stackage/blob/f3c225fc62994076de3795211b990762c3113b3d/build-constraints.yaml#L3376-L3378 under a more active maintainer.
• Mention as many additional maintainers as desired here: https://github.com/commercialhaskell/stackage/blob/f3c225fc62994076de3795211b990762c3113b3d/build-constraints.yaml#L9298-L9301

[ffaf1]

@Bodigrim Is this bit of tar documentation still valid?

Tar.unpack dir . Tar.checkTarbomb expectedDir
               . Tar.read =<< BS.readFile tar

cabal/cabal-install/src/Distribution/Client/Tar.hs

Lines 71 to 76 in 8070ab1

	extractTarGzFile dir expected tar =
	Tar.unpack dir
	. Tar.checkTarbomb expected
	. Tar.read
	. GZipUtils.maybeDecompress
	=<< BS.readFile tar

[Bodigrim]

Good catch! No, you probably need to use something like https://hackage.haskell.org/package/tar-0.6.0.0/docs/Codec-Archive-Tar.html#v:unpackAndCheck

[ulysses4ever]

Not sure why Stackage would ping us if there's a newer version of our dependency: do they do it, normally? (Sorry, I'm very dark when it comes to Stackage workings.) I thought it's a new Hackage feature, which we probably haven't put to good use. But it will only notify Hackage maintainers (or the mailing list?)? Also, nomeata created a bot for such things I think: would be great to explore that.

@Mikolaj @Kleidukos how about enabling those magic hassle notifications for events like "a newer version of our dependency war published"? If the notification goes to your personal emails, could one of you set up an email filter to forward the notifications to the mailing list?

[Bodigrim]

Not sure why Stackage would ping us if there's a newer version of our dependency: do they do it, normally?

Yes. At the moment (see commercialhaskell/stackage#7202) they ping @23Skidoo, because he was the most active maintainer when cabal-install was added to Stackage. It would be nice to update Stackage config as suggested in #9556 (comment).

Hackage notifications are also useful of course, the more the merrier.

[ulysses4ever]

@Mikolaj are you fine with being added as the cabal-install owner on Stackage? They will ping you occasionally if something about cabal-install dependencies bounds needs attention.

Does anyone else want to be on the list of people Stackage pings when something is up with cabal-install dependencies? @Kleidukos @ffaf1 @andreabedini @geekosaur and anyone I forget? You can simply thumb-up and I can ship one PR adding everybody.

[geekosaur]

I feel like I'm still a bit new to this.

[ulysses4ever]

@geekosaur totally understood, thank you for being honest!

[Mikolaj]

Yes, absolutely, let's add a lot of people everywhere and set up the Hackage notifications, ideally pointing to https://mail.haskell.org/mailman/listinfo/cabal-devel. I think I'm not getting any Hackage notifications relevant to cabal ATM, though I get some. I will pay attention.

[Bodigrim]

Back to the topic, cabal-install is the last blocker for tar-0.6 in Stackage Nightly snapshot. What's the expected timeline for cabal-install-3.10.3.0? It would be great if support for tar-0.6 was backported.

(The grand design is to update hackage-server as well and test tar-0.6 before releasing more exciting improvements)

[Mikolaj]

@Bodigrim: I'm sure @Kleidukos has the details.