lower pvp-bounds: extraneous version range for a dependency on an internal library

[mfine]

General summary/comments

Publishing with pvp-bounds: lower has stopped working with no change in tooling. Hackage is now returning an "extraneous version range" on an internal library error and failing the upload with 400 "Invalid package" - previously this hadn't been the case.

I see this check in cabal - potentially this is from updated software on hackage?

Steps to reproduce

Publish a package to hackage containing an executable with an unbounded dependency on the package's library with a stack.yaml containing pvp-bounds: lower.

Expected

The publish has in the past passed without issues. In hackage I see that the unbounded dependency on the package's library has a lower bound in wolf-0.3.23.cabal, like:

executable wolf-actor
    build-depends:
        wolf >=0.3.23,

Actual

Now the publish fails with:

Getting file list for /Users/mark/repos/wolf/
Building sdist tarball for /Users/mark/repos/wolf/
Checking package 'wolf' for common mistakes
Uploading wolf-0.3.24.tar.gz... unhandled status code: 400
Error: Invalid package

The package has an extraneous version range for a dependency on an internal library: wolf >=0.3.24, wolf >=0.3.24, wolf >=0.3.24. This version range includes the current package but isn't needed as the current package's library will always be used.
Upload failed on wolf-0.3.24.tar.gz

I am able to get the publish to pass by manually removing the bounds on the internal library in wolf-0.3.24.cabal, like:

executable wolf-actor
    main-is: actor.hs
    build-depends:
        wolf,

Stack version

$ stack --version
Version 1.4.0, Git revision e714f1dd3fade19496d91bd6a017e435a96a6bcd (4640 commits) x86_64 hpack-0.17.0

Also tried with 1.5.0:

$ ~/Downloads/stack-1.5.0-osx-x86_64/stack --version
Version 1.5.0, Git revision 63267f94d7c819cbecc2d59aa259d17240838e43 (4845 commits) x86_64 hpack-0.17.1

Method of installation

• Official binary, downloaded from fpcomplete's package repository

[borsboom]

I just hit the same error uploading stack-1.5.0 with --pvp-bounds=both.

[borsboom]

I'm not sure if this is related, but --pvp-bounds also seems to drop the custom-setup section.

[mfine]

There's probably much better solutions, but something like filtering out the package from adding bounds master...mfine:mfine/filter-internal-dependencies

[Blaisorblade]

Lookin at #3413's "user story": it seems the bug was hard to debug because stack upload didn't warn/inform it was modifying the .cabal fine.
@harendra-kumar if that makes sense to you, do you want to add an info message to that effect? (Not sure on the right priority, but a warning seems overkill).

That's in addition to fixing this specific pvp-bounds bug—the warning will stay useful. People will never need this piece of info if pvp-bounds has either bugs or bad interactions with other components.

[harendra-kumar]

When the --pvp-bound options is in effect it can say something like - "applying upper and lower bounds to dependencies...". In a more verbose mode it can tell exactly what bounds it applied to which packages.

[chshersh]

I also can't upload to Hackage with any option for --pvp-bounds. My .cabal file doesn't contain dependencies at all but I see error:

Uploading universum-0.7.1.tar.gz... unhandled status code: 400
Error: Invalid package

The package has an extraneous version range for a dependency on an internal library: universum <0.8. This version range includes the current package but isn't needed as the current package's library will always be used.
Upload failed on universum-0.7.1.tar.gz

I have benchmarks in package which depend on library itself.

[mgsloan]

@chshersh Ah, thanks for the more minimal repro. I think I've resolved this, but can't test the hackage upload. I've pushed a fix to master, can you please test after running stack upgrade --git? (or building from the stack repo)

[chshersh]

@mgsloan Thanks for your work! Sorry for long answer...

I tested after stack upgrade --git. This didn't fix issue :(

I'm testing on this universum repository in master branch while trying to upload version 0.7.1.1.

Stack version

$ stack --version
Version 1.5.1, Git revision 600c1f01435a10d127938709556c1682ecfd694e (4861 commits) x86_64 hpack-0.17.1

Observed error

$ stack sdist --pvp-bounds upper
$ stack upload --pvp-bounds upper .
Getting file list for /home/fenx/programming/haskell/serokell/universum/
Building sdist tarball for /home/fenx/programming/haskell/serokell/universum/
Checking package 'universum' for common mistakes
Uploading universum-0.7.1.1.tar.gz... unhandled status code: 400
Error: Invalid package

The package has an extraneous version range for a dependency on an internal library: universum <0.8. This version range includes the current package but isn't needed as the current package's library will always be used.
Upload failed on universum-0.7.1.1.tar.gz

[mgsloan]

@chshersh Hmm, did stack upgrade --git give a warning about it not being on the path? It looks like you are still using 1.5.1 but the HEAD version is 1.6

May be helpful to do which stack, and compare to where stack upgrade --git is installing it.