Cabal freeze qualifies all package constraints with any
- Dominant language
- Haskell
- Stars
- 1.7k
- Forks
- 750
- Avg merge
- 4d 3h
- Merged PRs (30d)
- 28
Description
I was trying to add private-dependencies (#4035, wip at #9743) support to `cabal freeze`.
It looks like the constraints populating the freeze file for every package always use the `any` qualifier. Here's an example of a package in the testsuite:
```
active-repositories: test-local-repo:merge
constraints: any.array ==0.5.6.0,
any.base ==4.19.0.0,
any.binary ==0.8.9.1,
any.bytestring ==0.12.0.2,
any.containers ==0.6.8,
any.deepseq ==1.5.0.0,
any.directory ==1.3.8.1,
any.exceptions ==0.10.7,
any.filepath ==1.4.100.4,
any.ghc-bignum ==1.3,
any.ghc-boot-th ==9.8.1,
any.ghc-prim ==0.11.0,
any.lib01 ==0.1.0.0 || ==0.2.0.0,
any.mtl ==2.3.1,
any.pretty ==1.1.3.6,
any.process ==1.6.18.0,
any.rts ==1.0.2,
any.stm ==2.5.2.1,
any.template-haskell ==2.21.0.0,
any.time ==1.12.2,
any.transformers ==0.6.1.0,
any.unix ==2.8.3.0
index-state: HEAD
```
I think that this design is incompatible with private dependencies, because `any` qualified package constraints will apply to *all* scopes (be them the top-level scope, setup-component scopes, independent goals, or private scopes...).
Is there any reason for this being so?
I believe the right way forward here is to properly qualify the packages in the freeze file according to their qualifier in the package. This would allow private dependencies to introduce qualified constraints on packages for packages in a specific private scope, and would ensure top-level constraints do not apply unnecessarily to private scopes.
cc @grayjay
Contributor guide
Assessment
This issue has not been assessed yet.