You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It seems to me that when performing cabal install in a sandbox, cabal-install can break the intended sandbox isolation by using the Cabal library installed in the GHC user package DB, as opposed to its internal Cabal library.
Install GHC 7.8.4 and cabal-install 1.20.0.3. Ensure ~/.ghc is empty:
Note cabal is still seemingly using its internal Cabal library:
$ cabal --version
cabal-install version 1.20.0.3
using version 1.20.0.0 of the Cabal library
Use cabal-install 1.20.0.3 to install some package in a sandbox. Note warnings:
$ mkdir ~/alex-a && cd ~/alex-a && cabal sandbox init && cabal install alex-3.1.4
Writing a default package environment file to
/root/alex-a/cabal.sandbox.config
Creating a new sandbox at /root/alex-a/.cabal-sandbox
Resolving dependencies...
Notice: installing into a sandbox located at /root/alex-a/.cabal-sandbox
Configuring primitive-0.5.4.0...
Configuring random-1.1...
Building primitive-0.5.4.0...
Building random-1.1...
Warning: /tmp/pkgConf-primitive-0.5.419500.0: Unrecognized field data-dir on
line 24
/tmp/pkgConf-primitive-0.5.419500.0: Unrecognized field key on line 4
Installed primitive-0.5.4.0
Warning: /tmp/pkgConf-random-119500.1: Unrecognized field data-dir on line 19
/tmp/pkgConf-random-119500.1: Unrecognized field key on line 4
Installed random-1.1
Configuring tf-random-0.5...
Building tf-random-0.5...
Warning: /tmp/pkgConf-tf-random-019500.5: Unrecognized field data-dir on line
33
/tmp/pkgConf-tf-random-019500.5: Unrecognized field key on line 4
Installed tf-random-0.5
Configuring QuickCheck-2.7.6...
Building QuickCheck-2.7.6...
Warning: /tmp/pkgConf-QuickCheck-2.719500.6: Unrecognized field data-dir on
line 37
/tmp/pkgConf-QuickCheck-2.719500.6: Unrecognized field key on line 4
Installed QuickCheck-2.7.6
Configuring alex-3.1.4...
Building alex-3.1.4...
Installed alex-3.1.4
Remove populated ~/.ghc:
$ rm -rf ~/.ghc
Use cabal-install 1.20.0.3 to install the same package in another sandbox. Note lack of warnings:
$ mkdir ~/alex-b && cd ~/alex-b && cabal sandbox init && cabal install alex-3.1.4
Writing a default package environment file to
/root/alex-b/cabal.sandbox.config
Creating a new sandbox at /root/alex-b/.cabal-sandbox
Resolving dependencies...
Notice: installing into a sandbox located at /root/alex-b/.cabal-sandbox
Configuring primitive-0.5.4.0...
Configuring random-1.1...
Building random-1.1...
Building primitive-0.5.4.0...
Installed primitive-0.5.4.0
Installed random-1.1
Configuring tf-random-0.5...
Building tf-random-0.5...
Installed tf-random-0.5
Configuring QuickCheck-2.7.6...
Building QuickCheck-2.7.6...
Installed QuickCheck-2.7.6
Configuring alex-3.1.4...
Building alex-3.1.4...
Installed alex-3.1.4
Judging by the warnings in step 5, which seem to be due to changes introduced in Cabal 1.22.0.0, the version of the Cabal library installed in the GHC user package DB somehow appears to be leaking into the sandbox. This is bad, as sandboxes are expected to isolate the user from the contents of the GHC user package DB (#1621 (comment)).
It seems to me that when performing
cabal install
in a sandbox, cabal-install can break the intended sandbox isolation by using the Cabal library installed in the GHC user package DB, as opposed to its internal Cabal library.~/.ghc
is empty:cabal
is really 1.20.0.3:~/.ghc
is populated:cabal
is still seemingly using its internal Cabal library:~/.ghc
:Judging by the warnings in step 5, which seem to be due to changes introduced in Cabal 1.22.0.0, the version of the Cabal library installed in the GHC user package DB somehow appears to be leaking into the sandbox. This is bad, as sandboxes are expected to isolate the user from the contents of the GHC user package DB (#1621 (comment)).
cc @23Skidoo @tibbe
The text was updated successfully, but these errors were encountered: