stackage-update 0.1.0.4 → 0.1.1.0
raw patch · 5 files changed
+130/−19 lines, 5 files
Files
- ChangeLog.md +5/−0
- README.md +37/−1
- Stackage/Update.hs +71/−12
- app/stackage-update.hs +16/−5
- stackage-update.cabal +1/−1
ChangeLog.md view
@@ -1,3 +1,8 @@+## 0.1.1.0++* Optional signature verification (--verify)+* Optional download from all-cabal-hashes (--hashes)+ ## 0.1.0.4 * Move to ~/.stackage/update [#6](https://github.com/fpco/stackage-update/issues/6)
README.md view
@@ -42,6 +42,43 @@ majority of users tend to not modify their remote-repos, so `stackage-update` should work for most people most of the time. +### GPG signature verification++Since version 0.1.1.0, stackage-update supports verifying the GPG signature. In+order to do so, you pass in the `--verify` argument. You must first set up your+GPG keychain to trust the relevant key, such as with the following commands:++```+$ gpg --recv-key --keyserver keyserver.ubuntu.com D6CF60FD+$ gpg --edit D6CF60FD+gpg> trust+Your decision? 3+gpg> quit+```++This is an example session, and not intended to be a guide to good GPG and+cryptography practice. If you would like to verify this signing key properly+via a web of trust, you can contact Michael Snoyman, who is already a signer+for this key. The fingerprint is:++```+E595 AD42 14AF A6BB 1552 0B23 E40D 74D6 D6CF 60FD+```++Note: the GPG key may be updated in the future following standard key rotation+policies. If you note that the key information listed here is out of date,+please open an issue/send a pull request.++### Hash downloads++When run with the `--hashes` command line argument, this tool instead downloads+from the+[all-cabal-hashes](https://github.com/commercialhaskell/all-cabal-hashes)+repository, which contains additional information for verifying the accuracy of+a tarball. While `stackage-update` does nothing with this extra information,+other tools (like [stackage-install](https://github.com/fpco/stackage-install))+may do so.+ ### Why stackage? You may be wondering why this tool is called `stackage-update`, when in fact@@ -54,7 +91,6 @@ ### Future enhancements -* If desired, add support for GPG signature checking when cloning/pulling from the `all-cabal-files` repository. * Detect modified remote-repos and warn the user ### Some notes
Stackage/Update.hs view
@@ -2,6 +2,11 @@ ( stackageUpdate , StackageUpdateSettings , defaultStackageUpdateSettings+ , setVerify+ , setRemote+ , setDirectoryName+ , allCabalFiles+ , allCabalHashes ) where import Control.Exception (IOException, try)@@ -25,13 +30,57 @@ -- -- Since 0.1.0.0 data StackageUpdateSettings = StackageUpdateSettings+ { verify :: Bool+ , remote :: String+ , name :: FilePath+ } +-- | Should we verify the signature on the Git tag.+--+-- Default: False+--+-- Since 0.1.1.0+setVerify :: Bool -> StackageUpdateSettings -> StackageUpdateSettings+setVerify x s = s { verify = x }++-- | Remote repository to use+--+-- Default: 'allCabalFiles'+--+-- Since 0.1.1.0+setRemote :: String -> StackageUpdateSettings -> StackageUpdateSettings+setRemote x s = s { remote = x }++-- | Local directory name to clone into+--+-- Default: \"all-cabal-files\"+--+-- Since 0.1.1.0+setDirectoryName :: FilePath -> StackageUpdateSettings -> StackageUpdateSettings+setDirectoryName x s = s { name = x }+ -- | Default settings for the update process. -- -- Since 0.1.0.0 defaultStackageUpdateSettings :: StackageUpdateSettings defaultStackageUpdateSettings = StackageUpdateSettings+ { verify = False+ , remote = allCabalFiles+ , name = "all-cabal-files"+ } +-- | URL for the all-cabal-files repo+--+-- Since 0.1.1.0+allCabalFiles :: String+allCabalFiles = "https://github.com/commercialhaskell/all-cabal-files.git"++-- | URL for the all-cabal-hashes repo+--+-- Since 0.1.1.0+allCabalHashes :: String+allCabalHashes = "https://github.com/commercialhaskell/all-cabal-hashes.git"+ -- | Since internal representation of Version will change in the future. version19 :: Version version19 =@@ -41,7 +90,7 @@ -- | Perform an update from the Git repository stackageUpdate :: StackageUpdateSettings -> IO ()-stackageUpdate StackageUpdateSettings = do+stackageUpdate set = do mgit <- findExecutable "git" git <- case mgit of@@ -59,7 +108,7 @@ [] -> False [] -> False cloneArgs =- "clone" : "https://github.com/commercialhaskell/all-cabal-files.git" : rest+ "clone" : remote set : name set : rest where rest | hasNSB =@@ -73,11 +122,11 @@ sDir <- getAppUserDataDirectory "stackage" let suDir = sDir </> "update"- acfDir = suDir </> "all-cabal-files"+ acfDir = suDir </> name set repoExists <- doesDirectoryExist acfDir if repoExists- then runIn suDir acfDir "git" ["fetch"]- else runIn suDir suDir "git" cloneArgs+ then runIn suDir acfDir "git" ["fetch", "--tags"] Nothing+ else runIn suDir suDir "git" cloneArgs Nothing cabalDir <- getAppUserDataDirectory "cabal" let hackageDir = cabalDir </> "packages" </> "hackage.haskell.org"@@ -87,7 +136,14 @@ gzFile = tarFile <.> "gz" _ <- tryIO $ removeFile tarFile- runIn suDir acfDir "git" ["archive", "--format=tar", "-o", tarFile, "origin/hackage"]+ when (verify set) $ do+ runIn suDir acfDir "git" ["tag", "-v", "current-hackage"] $ Just $ unlines+ [ "Signature verification failed. Please ensure you've set up your"+ , "GPG keychain to accept the D6CF60FD signing key."+ , "For more information, see:"+ , "https://github.com/fpco/stackage-update#readme"+ ]+ runIn suDir acfDir "git" ["archive", "--format=tar", "-o", tarFile, "current-hackage"] Nothing tryIO :: IO a -> IO (Either IOException a) tryIO = try@@ -96,8 +152,9 @@ -> FilePath -- ^ directory -> FilePath -- ^ command -> [String] -- ^ command line arguments+ -> Maybe String -- ^ error message -> IO ()-runIn suDir dir cmd args = do+runIn suDir dir cmd args errMsg = do createDirectoryIfMissing True dir (Nothing, Nothing, Nothing, ph) <- createProcess (proc cmd args) { cwd = Just dir@@ -112,9 +169,11 @@ , " in " , dir ]- hPutStrLn stderr $ concat- [ "If the problem persists, please delete the following directory "- , "and try again"- ]- hPutStrLn stderr suDir+ hPutStrLn stderr $ maybe defErrMsg id errMsg exitWith ec++defErrMsg :: String+defErrMsg = concat+ [ "If the problem persists, please delete the following directory "+ , "and try again"+ ]
app/stackage-update.hs view
@@ -6,10 +6,21 @@ main = do args <- getArgs case args of- ["--help"] -> putStrLn $ "Usage: stackage-update \n" ++- "Run this command with no arguments to update your package index."+ ["--help"] -> putStrLn $ unlines+ [ "Usage: stackage-update [--verify] [--hashes]"+ , "Run this command with no arguments to update your package index."+ , ""+ , " --verify : Verify GPG signature on the repo"+ , " --hashes : Download from the all-cabal-hashes repo"+ ] ["--summary"] -> putStrLn "Update your package index incrementally (requires git)"- [] -> stackageUpdate defaultStackageUpdateSettings- xs -> putStrLn $ "stackage-update: unrecognized argument \'" ++- (concat $ intersperse " " xs) ++ "\'\nTry \'stackage-update --help\' for more information"+ _ -> stackageUpdate $ foldr addArg defaultStackageUpdateSettings args +addArg :: String -> StackageUpdateSettings -> StackageUpdateSettings+addArg "--verify" = setVerify True+addArg "--hashes" = setRemote allCabalHashes . setDirectoryName "all-cabal-hashes"+addArg s = error $ concat+ [ "Did not understand argument "+ , show s+ , ", try 'stackage-update --help' for more information"+ ]
stackage-update.cabal view
@@ -1,5 +1,5 @@ name: stackage-update-version: 0.1.0.4+version: 0.1.1.0 synopsis: Update your package index incrementally (requires git) description: Please see <https://www.stackage.org/package/stackage-update> for description homepage: https://github.com/fpco/stackage-update