(no subject)

[Claus Reinke]

Hi Neil,

>I was reading your instructions on the GHC wiki page,
>http://hackage.haskell.org/trac/ghc/wiki/Building/Windows, and they are
>wonderful - exactly what I wanted. However, they don't work. When
>downloading Cygwin you are told to add haskell.org/ghc/cygwin as a path
>so it can pick up the setup.ini file. However, in the latest version of
>Cygwin it obvious wants signatures for all the .ini files:
>
>---------------------------
>Cygwin Setup
>---------------------------
>Unable to get http://www.haskell.org/ghc/cygwin/setup.ini.sig from
><http://www.haskell.org/ghc/cygwin>
>---------------------------
>OK   
>---------------------------
>
>Could someone please add the appropriate signature file?

Grr, not just the Haskell Cabal keeps marching on. Apparently, 
that is a change in last month's setup.exe:

    Updated: Setup.exe updated to version 2.573.2.3
    http://cygwin.com/ml/cygwin-announce/2008-08/msg00001.html

If I understand the implications correctly, one would need a
three point change to adapt properly:

- sign the setup.ini file with a key, in place
- put up a public key to check against, somewhere else
- point setup.exe to the location of the public key

Given that all we want are the dependencies (the package
is empty), this is starting to look ridiculous (one has to put in
more administrative information than one saves from not having
to specify the dependencies by hand..).

Meanwhile, there is apparently a command-line option to bypass 
the check, when using setup.exe on this repository:

    -X --no-verify                         Don't verify setup.ini signatures

You can easily check the package contents yourself before/after
downloading (because it is empty, only the setup.ini text matters;-).

Of course, I wouldn't recommend using that switch while you're 
also sourcing from another repository (the verification has been
added for a reason), so one would have to recommend running 
setup.exe twice, once with verification for the main stuff, once 
without for ghc-depends? 

But setup.exe will presumably want to run the check on both
downloading and installing, and since the dependencies ought to
be installed with verification, it isn't quite clear to me whether there
is a successful sequence of calling setup.exe, unless ghc-depends
is signed and an additional key is provided..

GHC HQ: unless you want to sign that package, and provide
a key to check against, I don't know what to do about this.

Please remember to update the log on the wiki page when you 
succeed - the value of this log comes from being applied from
scratch (when just updating, it is easy to miss something).

Thanks,
Claus