Cabal package curation by Hackage maintainers is not disabled

[ivanperez-keera]

Description

Cabal packages in Ogma are not using the flag x-curation to indicate to package maintainers that our packages should not be modified by them.

Because this is a NASA project, we want to make sure that users obtain exactly what we publish, unmodified by anyone external to our project, so we should use x-curation: uncurated to signal our preference.

Type

• Bug: Cabal files are not "protected" against modification by people outside the project.

Additional context

None.

Requester

• Ivan Perez

Method to check presence of bug

The following command lists cabal files that do not contain the uncurated setting:

$ grep -Lre '^x-curation.*uncurated' --include='*.cabal'

Expected result

The command above lists all cabal files in the project, but it should list no results.

Desired result

The command above lists all cabal files in the project, but it should list no results.

Proposed solution

Add x-curation: uncurated to all cabal files.

Further notes

None.

[ivanperez-keera]

Change Manager: Confirmed that the issue exists.

[ivanperez-keera]

Technical Lead: Confirmed that the issue should be addressed.

[ivanperez-keera]

Technical Lead: Issue scheduled for Ogma 1.(0+X).(7+Y).

Fix assigned to: @ivanperez-keera.

[ivanperez-keera]

Implementor: Solution implemented, review requested.

[ivanperez-keera]

Change Manager: Verified that:

• Solution is implemented:

  • The code proposed compiles passes the tests. Details:
    Docker image:

    FROM ubuntu:trusty
    
    ENV DEBIAN_FRONTEND=noninteractive
    
    RUN apt-get update
    
    RUN apt-get install --yes software-properties-common
    RUN add-apt-repository ppa:hvr/ghc
    RUN apt-get update
    
    RUN apt-get install --yes ghc-8.6.5 cabal-install-2.4
    RUN apt-get install --yes libz-dev
    
    ENV PATH=/opt/ghc/8.6.5/bin:/opt/cabal/2.4/bin:$PWD/.cabal-sandbox/bin:$PATH
    
    RUN cabal update
    RUN cabal v1-sandbox init
    RUN cabal v1-install alex happy
    RUN apt-get install --yes git
    
    # We install the application first and then test it, in case any tests need to
    # run the tool.
    CMD git clone $REPO && \
        cd $NAME && \
        git checkout $COMMIT && \
        cd .. && \
        cabal v1-install $NAME/$PAT**/ --enable-tests && \
        cabal v1-install $NAME/$PAT**/ --enable-tests --run-tests -j1

    Command:

    $ docker run -e "REPO=https://github.com/NASA/ogma" -e "NAME=ogma" -e PAT="ogma-" -e "COMMIT=97901f13abc59e71b10e89beed2365af84251991" -it ogma-test

  • The solution proposed fixes the issues described. Details:
    The following docker script prints Found if all cabal files have a curation flag set to uncurated, and Nothing otherwise.

    FROM ubuntu:focal
    
    RUN apt-get update
    
    RUN apt-get install --yes git
    
    SHELL ["/bin/bash", "-c"]
    CMD git clone $REPO \
        && cd $NAME \
        && git checkout $COMMIT \
        && if [[ $(grep -Lre '^x-curation *: *uncurated' --include='*.cabal' ) ]]; then echo "Nothing"; false; else echo "Found"; fi

    Command:

    $ docker run -e "REPO=https://github.com/NASA/ogma" -e "NAME=ogma" -e PAT="ogma-" -e "COMMIT=97901f13abc59e71b10e89beed2365af84251991" -it ogma-verify-74

• Implementation is documented. Details:
  No changes needed.
• Change history is clear.
• Commit messages are clear.
• Changelogs are updated.
• Examples are updated. Details:
  No examples affected.
• Required version bumps are evaluated. Details:
  No bump needed (change to curation setting, API not affected).

[ivanperez-keera]

Change Manager: Implementation ready to be merged.