sqlcipher support?

sqlcipher: https://github.com/sqlcipher/sqlcipher has the sqlite C/C++ API but adds encryption support. To enable encryption support you must set a PRAGMA before opening a file. I tried to build persistent against sqlcipher, by modifying persistent-sqlite.cabal, adding a new flag:

+flag sqlcipher
+  description: Build against the system-wide sqlcipher library
+  default: False

and lower:

+    else if flag(sqlcipher)
+        extra-libraries: sqlcipher

Removing the sqlite-devel package, then pointing to that app using extra-lib-dirs & extra-include-dirs:

cabal install persistent-sqlite -fsqlcipher --extra-lib-dirs=/home/emmanuel/programs/sqlcipher-3.2.0-install/lib/ --extra-include-dirs=/home/emmanuel/programs/sqlcipher-3.2.0-install/include/

then when I open I do:

main = runSqlite "test1.db" $ do
    rawExecute "PRAGMA key = 'passphrase'" []
    ...

However the decryption doesn't work, it fails as though I did not set the password or as though it was linking against the normal sqlite. I assume it's the latter.

Well, I'd be happy if you have hints on how to make it work, and if I can make it work, I wonder whether it could be included upstream in persistent-sqlite. It's not that many projects that require such a feature, and I'm not sure how it would be handled: if it's a build flag, I don't think an application could depend on persistent-sqlcipher. It would have to require that the user first installs persistent-sqlite manually with the right flag. And if the app is paranoid about data storage, it would probably need a runtime way to check whether it was in fact built against a persistent-sqlite package built against sqlchipher and not the ordinary sqlite (otherwise all data would be stored as plain text, a disaster!). So would that mean a persistent-sqlite fork? Any idea?

Start with persistent-sqlite.cabal and reproduce the documented cabal install using the sqlcipher flag, extra library directory, and extra include directory. Investigate why the PRAGMA key does not produce encrypted storage and determine whether upstream support needs a build-time or runtime distinction. Done means there is a clearly defined, reliably detectable supported path for sqlcipher users.