NOTES.md

Notes

sdists

Do we need to make sdists? I think so. Does cabal sdist need cabal.project? Perhaps using Distribution.Simple directly? Idk, I don't understand sdists.

Note: perhaps include hash validation? this can be done later

usage

quick and easy

served through https (nginx, s3, GitHub)

repository packages.example.org
  url: https://packages.example.org/
  secure: True

Note: we don't even need GitHub Pages. A raw.githubusercontent.com is good enough for cabal.

totally reproducible

repository packages.example.org
  url: https://packages.example.org/HASH
  secure: True

properly secure

repository packages.example.org
  url: https://packages.example.org/
  secure: True
  root-keys: <root-key-IDs>
  key-threshold: <key-threshold>

with root-keys available from webpage

locally available

useful for nix

repository my-local-repo
  url: file:/path/to/local/repo
  secure: True

website

It might be nice to have a minimal website generated along the repository

Things to include:

• list of packages, with their metadata and link to cabal files
• hashes of everything, ready to cut and paste
• instructions, snipped to add to cabal.project or cabal.config
• previous deployments/versions

I would much prefer if there was a way to keep the website separate from the output above (for hash friendliness). The presentation layer can be separate. Perhaps something that can fetch the data and render on the spot? Something with Cloudflare Pages and Workers?

Maybe just a separate directory with a bunch of links, deployed on a separate branch on GitHub

Branches:

• main (the source of all evil)
• repository (the assembled repository)
• website (the rendered website, with links to the repository branch)

References:

1. https://github.com/hvr/hackage-overlay-repo-tool/blob/master/src/Main.hs
2. https://github.com/haskell/hackage-security/blob/master/hackage-repo-tool/src/Main.hs
3. https://cabal.readthedocs.io/en/3.6/installing-packages.html#repository-specification