cabal-install-3.10.1.0: The command-line interface for Cabal and Hackage.
Safe HaskellSafe-Inferred
LanguageHaskell2010

Distribution.Client.PackageHash

Description

Functions to calculate nix-style hashes for package ids.

The basic idea is simple, hash the combination of:

  • the package tarball
  • the ids of all the direct dependencies
  • other local configuration (flags, profiling, etc)
Synopsis

Calculating package hashes

data PackageHashConfigInputs Source #

Those parts of the package configuration that contribute to the package hash.

Constructors

PackageHashConfigInputs 

Fields

hashedInstalledPackageId :: PackageHashInputs -> InstalledPackageId Source #

Calculate a InstalledPackageId for a package using our nix-style inputs hashing method.

Note that due to path length limitations on Windows, this function uses a different method on Windows that produces shorted package ids. See hashedInstalledPackageIdLong vs hashedInstalledPackageIdShort.

hashPackageHashInputs :: PackageHashInputs -> HashValue Source #

Calculate the overall hash to be used for an InstalledPackageId.

renderPackageHashInputs :: PackageHashInputs -> ByteString Source #

Render a textual representation of the PackageHashInputs.

The hashValue of this text is the overall package hash.

Platform-specific variations

hashedInstalledPackageIdLong :: PackageHashInputs -> InstalledPackageId Source #

Calculate a InstalledPackageId for a package using our nix-style inputs hashing method.

This produces large ids with big hashes. It is only suitable for systems without significant path length limitations (ie not Windows).

hashedInstalledPackageIdShort :: PackageHashInputs -> InstalledPackageId Source #

On Windows we have serious problems with path lengths. Windows imposes a maximum path length of 260 chars, and even if we can use the windows long path APIs ourselves, we cannot guarantee that ghc, gcc, ld, ar, etc etc all do so too.

So our only choice is to limit the lengths of the paths, and the only real way to do that is to limit the size of the InstalledPackageIds that we generate. We do this by truncating the package names and versions and also by truncating the hash sizes.

Truncating the package names and versions is technically ok because they are just included for human convenience, the full source package id is included in the hash.

Truncating the hash size is disappointing but also technically ok. We rely on the hash primarily for collision avoidance not for any security properties (at least for now).