[Haskell-cafe] Improvements to package hosting and security

[Tillmann Rendel]

Hi,

Mathieu Boespflug wrote:
> This is a valid concern. One that I should have addressed explicitly
> in the proposal. Git is fairly well supported on Windows these days
> and installs easily. It could conceivably be included as part of
> MinGHC. There are many alternatives, but I doubt we'll need them:
> statically linking a C implementation (libgit2 or another), or a
> simple native implementation of the git protocol (the protocol is
> quite straightforward and is documented) and basic disk format.

I did not read your proposal, but if it entails that new Haskell users 
on Windows need to manually install git before they can use `cabal 
install something` for the first time, I think that would be bad.

For programming beginners (think B.Sc. students in a field other than 
computer science that take an "intro to programming" class), every 
installation that requires manual configuration is a hassle. Making the 
cabal executable find the git executable on the path would potentially 
require manual configuration to set up the search path. I believe that 
both ghc and git binary packages for Windows package MSYS (or maybe 
something similar, not sure), so there is also some potential for a 
cabal+ghc+git installation to confuse which bundled copy of MSYS to use.

Some of these "intro to programming" classes consist mostly of 
object-oriented programming, with a bit of FP thrown in. If helping the 
students to set up a Haskell environment on their laptops takes one lab 
session or one week of office hours, that's a significant cut from the 
FP learning time. If students fail their homework because they fail to 
install the Haskell environment, that takes a significant cut of their 
FP learning motivation. If instructors only teach plain Haskell without 
ever using cabal, this gives the impression that Haskell only works for 
classroom problems, because there seem to be no libraries.

I'm aware that programming beginners are not the main target for a 
programming language infrastructure, but we shouldn't forget about their 
first-use experience completely, either.


I'm not even sure whether "statically linking a C implementation" is any 
better. How would it support `cabal install cabal-install` on Windows, 
in practice?

   Tillmann