haskell / haskell/hackage-server

RFC: Adapt wording & tooling to discourage uploading experimental "DO NOT USE" packages into the main index

Open
#461 13 comments 4 reactions 0 assignees View on GitHub
enhancement
Dominant language
Haskell
Stars
467
Forks
225
PR merge metrics
No merged PRs in 30d

Description

Just today I noticed https://hackage.haskell.org/package/wsdl-0.1.0.0 which comes with a
big "DO NOT USE, UNSTABLE AND INCOMPLETE." disclaimer in its description.

IMO, such packages don't belong into the main 00-index.tar, as they're clearly not meant for public consumption yet. And such uploads add to the self-fulfilling prophecy (c.f. broken window theory) that Hackage has no quality standards and anything goes.

I'm not sure what the motivation/assumption for uploading a package to Hackage is, but I've noticed in the past that uploaders often didn't know about the Hackage candidate feature, and just wanted to try out the workflow.

In any case, as soon as a package becomes part of the 00-index.tar, it becomes a package that causes overhead for several entities (including us Hackage Trustees ;-) ). It gets picked up by search engines, is considered by Hackage's own package search, gets picked up by matrix.h.h.o eventually, etc.

Also, experiments that end up in a dead end effectively use up precious names from the package namespaces seem troublesome to me (sure, the package names could be reclaimed in theory, but it's very confusing if a package changes its scope/purpose completely depending on the version -- so this should rather be the exception). A name like `wsdl` is certainly one of the premium names which deserve to be handled with more responsibility, as such a principal name suggest to be the blessed "go to packages" for a given task.

So a package added to 00-index.tar should ideally satisfy a few baseline requirements, IMO.

More specifically, a package uploaded as non-candidate ought to come with a bit more responsibilty to improve the overall quality of Hackage packages (and keep the Trustee-workload manageable). So, **for non-candidate uploads** I suggest something along the lines of:
- An uploaded package ought to be useful and usable for other users (for personal experiments there are other ways to publish your work)
- An uploaded package ought to have an useful synopsis and description
- At time of upload a package ought to build successfully with a recent GHC release
(I'm planning to add support to matrix.h.h.o for picking up package candidates as well for testing to help)
- `cabal upload` ought to upload as candidate by default (unless a `--no-candidate` flag is used). Or some other mechanism that increases the threshold of uploading packages straight to the index without consideration.

A more drastic way would be to require approval when new package names are being created (i.e. you'd still be able to upload candidates for new packages names w/o approval, but publishing a new package name to the main index for the first time would require such an approval). We'd need to make sure that the approval process takes at most 24h or so, by having a large enough group of people being able to approve a new package name.

/cc @bergmark @dcoutts @gbaz

-----

Related, there's also the issue of trivial packages using up short package names, but failing the equivalent of the Fairbairn-threshold for packages:

- **`sort`** : https://hackage.haskell.org/package/sort-0.0.0.1/docs/src/Data-Sort.html
- **`sorting`** : http://hackage.haskell.org/package/sorting-1.0.0.1/docs/src/Data-Ord-Sorting.html
- **`elo`**: https://hackage.haskell.org/package/elo-0.1.0/docs/src/Statistics-Elo.html
- **`conf-json`**: https://hackage.haskell.org/package/conf-json-1.1/docs/src/Data-Conf-Json.html

Other premium names taken (although maybe with a less clear verdict whether they fall below the threshold):

- **`functor`**: http://hackage.haskell.org/package/functor
- **`category`**: http://hackage.haskell.org/package/category
- **`product`**: https://hackage.haskell.org/package/product-0.1.0.0/src/Control/Category/Product.hs

A different class of questionable packages are "personal" packages which appear to have an audience of one, the author himself:

- **`rfc`**: https://hackage.haskell.org/package/rfc
- **`util`**: https://hackage.haskell.org/package/util-0.1.0.0/docs/src/Util.html

*(TODO: add more examples)*

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.