Additional version bound checks

[philderbeast]

Fixes #9806. Checks that lower bounds are inclusive, upper bounds are exclusive and don't have trailing zeros.

• Patches conform to the coding conventions.
• Any changes that could be relevant to users have been recorded in the changelog.
  • Is the change significant?
• The documentation has been updated, if necessary.
• Manual QA notes have been included.
• Tests have been added.

[ulysses4ever]

Cool!

[ffaf1]

And of course, if something is not clear in the checks scaffold, ask!

[philderbeast]

Converted to draft as I think there's more work to do:

$ cabal init "version-checks" --non-interactive
Warning: this is a debug build of cabal-install with assertions enabled.
[Info] Guessing dependencies...
[Info] Using cabal specification: 3.0
[Warn] unknown license type, you must put a copy in LICENSE yourself.
[Info] Creating fresh file CHANGELOG.md...
[Info] Creating fresh directory ./app...
[Info] Creating fresh file app/Main.hs...
[Info] Creating fresh file version-checks.cabal...
[Warn] No synopsis given. You should edit the .cabal file and add one.
[Info] You may want to edit the .cabal file and add a Description field.

$ cd version-checks/

$ grep -R -E 'base' *.cabal
    build-depends:    base ^>=4.20.0.0

$ cabal check
Warning: this is a debug build of cabal-install with assertions enabled.
These warnings will likely cause trouble when distributing the package:
Warning: [no-category] No 'category' field.
These warnings may cause trouble when distributing the package:
Warning: [less-than-equals-upper-bounds] On executable 'version-checks', these
packages have less than or equals (<=) upper bounds:
- base
Please use less than (<) for upper bounds. There is more information at
https://pvp.haskell.org/
Warning: [trailing-zero-upper-bounds] On executable 'version-checks', these
packages have upper bounds with trailing zeros:
- base
Please avoid trailing zeros for upper bounds. There is more information at
https://pvp.haskell.org/
Warning: [greater-than-lower-bounds] On executable 'version-checks', these
packages have greater than (>) lower bounds:
- base
Please use greater than or equals (>=) for lower bounds. There is more
information at https://pvp.haskell.org/
The following errors will cause portability problems on other environments:
Error: [no-syn-desc] No 'synopsis' or 'description' field.
Error: [license-none] The 'license' field is missing or is NONE.
Error: Hackage would reject this package.

[ffaf1]

Thanks, most likely I will review this this weekend.

[ffaf1]

Excellent work.
I have some things I don't agree with and I was overt in my thoughts (apologies if I missed some of your earlier notes).

I am sure we can work together to make this in master speedily~

[ffaf1]

@philderbeast is this ready for a re-review?

(no fret if it is not)

[philderbeast]

@ffaf1 I've rebased and this is ready for review.

[ffaf1]

I have added a few more comments @philderbeast.

If you need help or are ready for another review, just ping me and I will chime in!

[ffaf1]

Ping me when this is ready, almost everything I see is very good.

[philderbeast]

@ffaf1 I've moved all of the dependency version range checks to cabal-testsuite/PackageTests/Check/DepVersionRange.

$ cd cabal-testsuite/PackageTests/Check/DepVersionRange

$ tree -P '*.test.hs'
.
├── BaseDep
│   └── cabal.test.hs
├── CustomSetupBaseDep
│   └── cabal.test.hs
├── InternalLibDep
│   └── cabal.test.hs
├── UnboundedInternalDep
│   └── cabal.test.hs
└── VersionConstraintOperators
    └── cabal.test.hs

As for missing bounds checks, I don't think we have any duplication:

• BaseDep Error: [missing-bounds-important] is a check on upper bounds of base.
• CustomSetupBaseDep Error: [missing-bounds-setup] is a check that a custom setup has upper bounds on base.
• InternalLibDep Warning: [missing-upper-bounds] is a check of upper bounds of the dependencies an internal library (but not on the dependencies of the main package library).
• UnboundedInternalDep Warning: [missing-upper-bounds] is a check of internal dependencies, of an executable component depending on the library component within the same package.
• VersionConstraintOperators Warning: [missing-upper-bounds] checks version operators and missing upper bounds of the main (unnamed¹) package library.

$ grep -R -E '\[missing-upper-bounds\] On library' */**/*.out
InternalLibDep/cabal.out:Warning: [missing-upper-bounds] On library 'int-lib', these packages miss upper bounds:
VersionConstraintOperators/cabal.out:Warning: [missing-upper-bounds] On library, these packages miss upper bounds:

Footnotes

1. In this case shouldn't we be reporting "On library 'package-name'" instead of "On library"? ↩

[ffaf1]

Thanks for the excellent work!

[philderbeast]

Label merge+no rebase is necessary when the pull request is from an organisation.

[philderbeast]

Thanks for the thorough reviews @ffaf1.

[Kleidukos]

@Mergifyio backport 3.14

[mergify]

backport 3.14

✅ Backports have been created

• #10749 Backport #10554: Additional version bound checks has been created for branch 3.14 but encountered conflicts