From 928d05e7352d73ad44289afbe89d3979294f3d6a Mon Sep 17 00:00:00 2001
From: Phil de Joux <philderbeast@gmail.com>
Date: Sat, 20 Jan 2024 08:46:11 -0500
Subject: [PATCH 01/17] Bump base lower bound to >=4.11

---
 example-client/example-client.cabal                           | 2 +-
 hackage-repo-tool/hackage-repo-tool.cabal                     | 2 +-
 hackage-root-tool/hackage-root-tool.cabal                     | 2 +-
 hackage-security-HTTP/hackage-security-HTTP.cabal             | 2 +-
 hackage-security-curl/hackage-security-curl.cabal             | 2 +-
 .../hackage-security-http-client.cabal                        | 2 +-
 hackage-security/hackage-security.cabal                       | 4 ++--
 precompute-fileinfo/precompute-fileinfo.cabal                 | 2 +-
 8 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/example-client/example-client.cabal b/example-client/example-client.cabal
index 2c37d215..c89e11dc 100644
--- a/example-client/example-client.cabal
+++ b/example-client/example-client.cabal
@@ -37,7 +37,7 @@ executable example-client
   main-is:             Main.hs
   other-modules:       ExampleClient.Options
 
-  build-depends:       base                 >= 4.9 && < 4.20,
+  build-depends:       base                 >= 4.11 && < 4.20,
                        bytestring           >= 0.9,
                        directory            >= 1.2,
                        filepath             >= 1.2,
diff --git a/hackage-repo-tool/hackage-repo-tool.cabal b/hackage-repo-tool/hackage-repo-tool.cabal
index 64d3e26b..e431df4b 100644
--- a/hackage-repo-tool/hackage-repo-tool.cabal
+++ b/hackage-repo-tool/hackage-repo-tool.cabal
@@ -62,7 +62,7 @@ executable hackage-repo-tool
 
   -- For boot libraries we try to accomodate the versions bundled with
   -- the respective GHC release
-  build-depends:       base                 >= 4.9  && < 4.20,
+  build-depends:       base                 >= 4.11  && < 4.20,
                        bytestring           >= 0.9  && < 0.13,
                        directory            >= 1.2  && < 1.4,
                        filepath             >= 1.3  && < 1.5,
diff --git a/hackage-root-tool/hackage-root-tool.cabal b/hackage-root-tool/hackage-root-tool.cabal
index 738f865a..1488d27a 100644
--- a/hackage-root-tool/hackage-root-tool.cabal
+++ b/hackage-root-tool/hackage-root-tool.cabal
@@ -38,7 +38,7 @@ source-repository head
 
 executable hackage-root-tool
   main-is:             Main.hs
-  build-depends:       base                 >= 4.9  && < 5,
+  build-depends:       base                 >= 4.11  && < 5,
                        filepath             >= 1.2  && < 1.5,
                        optparse-applicative >= 0.11 && < 0.18,
                        hackage-security     >= 0.5  && < 0.7
diff --git a/hackage-security-HTTP/hackage-security-HTTP.cabal b/hackage-security-HTTP/hackage-security-HTTP.cabal
index f0b1f735..9806afad 100644
--- a/hackage-security-HTTP/hackage-security-HTTP.cabal
+++ b/hackage-security-HTTP/hackage-security-HTTP.cabal
@@ -43,7 +43,7 @@ flag use-network-uri
 
 library
   exposed-modules:     Hackage.Security.Client.Repository.HttpLib.HTTP
-  build-depends:       base             >= 4.9       && < 4.20,
+  build-depends:       base             >= 4.11      && < 4.20,
                        bytestring       >= 0.9       && < 0.13,
                        HTTP             >= 4000.2.19 && < 4000.5,
                        mtl              >= 2.1       && < 2.4,
diff --git a/hackage-security-curl/hackage-security-curl.cabal b/hackage-security-curl/hackage-security-curl.cabal
index ebde2691..27b14299 100644
--- a/hackage-security-curl/hackage-security-curl.cabal
+++ b/hackage-security-curl/hackage-security-curl.cabal
@@ -34,7 +34,7 @@ flag use-network-uri
 
 library
   exposed-modules:     Hackage.Security.Client.Repository.HttpLib.Curl
-  build-depends:       base        >= 4.9 && < 4.20,
+  build-depends:       base        >= 4.11 && < 4.20,
                        bytestring  >= 0.9,
                        process     >= 1.1,
                        hackage-security
diff --git a/hackage-security-http-client/hackage-security-http-client.cabal b/hackage-security-http-client/hackage-security-http-client.cabal
index 6638477f..3e91fb86 100644
--- a/hackage-security-http-client/hackage-security-http-client.cabal
+++ b/hackage-security-http-client/hackage-security-http-client.cabal
@@ -33,7 +33,7 @@ flag use-network-uri
 
 library
   exposed-modules:     Hackage.Security.Client.Repository.HttpLib.HttpClient
-  build-depends:       base               >= 4.9 && < 4.20,
+  build-depends:       base               >= 4.11 && < 4.20,
                        bytestring         >= 0.9,
                        http-client        >= 0.4 && < 0.8,
                        http-types         >= 0.8,
diff --git a/hackage-security/hackage-security.cabal b/hackage-security/hackage-security.cabal
index 1ee687e5..6ad720ef 100644
--- a/hackage-security/hackage-security.cabal
+++ b/hackage-security/hackage-security.cabal
@@ -110,7 +110,7 @@ library
                        Hackage.Security.Util.Stack
                        Hackage.Security.Util.TypedEmbedded
 
-  build-depends:       base              >= 4.9     && < 4.20,
+  build-depends:       base              >= 4.11    && < 4.20,
                        base16-bytestring >= 0.1.1   && < 1.1,
                        base64-bytestring >= 1.0     && < 1.3,
                        bytestring        >= 0.9     && < 0.13,
@@ -135,7 +135,7 @@ library
   if flag(lukko)
     build-depends:     lukko      >= 0.1     && < 0.2
   else
-    build-depends:     base       >= 4.10
+    build-depends:     base       >= 4.11
 
   if flag(Cabal-syntax) && impl(ghc >= 8.2)
     build-depends: Cabal-syntax >= 3.7 && < 3.12
diff --git a/precompute-fileinfo/precompute-fileinfo.cabal b/precompute-fileinfo/precompute-fileinfo.cabal
index dd1497ac..9e077d7b 100644
--- a/precompute-fileinfo/precompute-fileinfo.cabal
+++ b/precompute-fileinfo/precompute-fileinfo.cabal
@@ -20,7 +20,7 @@ tested-with:
 
 executable precompute-fileinfo
   main-is:             Main.hs
-  build-depends:       base                 >= 4.9,
+  build-depends:       base                 >= 4.11,
                        bytestring           >= 0.9,
                        containers           >= 0.4,
                        deepseq              >= 1.3,

From aa561d243ea8a3c47d34a4ddc3d431dd4e794530 Mon Sep 17 00:00:00 2001
From: Phil de Joux <philderbeast@gmail.com>
Date: Sat, 20 Jan 2024 08:52:39 -0500
Subject: [PATCH 02/17] Satisfy -Wunused-imports

---
 hackage-root-tool/Main.hs                | 3 +--
 hackage-security/tests/TestSuite/JSON.hs | 1 -
 precompute-fileinfo/src/Main.hs          | 2 --
 3 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/hackage-root-tool/Main.hs b/hackage-root-tool/Main.hs
index da80d596..fbbceae0 100644
--- a/hackage-root-tool/Main.hs
+++ b/hackage-root-tool/Main.hs
@@ -1,7 +1,6 @@
-{-# LANGUAGE CPP, ScopedTypeVariables, RecordWildCards #-}
+{-# LANGUAGE ScopedTypeVariables, RecordWildCards #-}
 module Main (main) where
 
-import Data.Monoid
 import Control.Exception
 import GHC.Conc.Sync (setUncaughtExceptionHandler)
 import System.Exit
diff --git a/hackage-security/tests/TestSuite/JSON.hs b/hackage-security/tests/TestSuite/JSON.hs
index 793865de..0e5723f0 100644
--- a/hackage-security/tests/TestSuite/JSON.hs
+++ b/hackage-security/tests/TestSuite/JSON.hs
@@ -11,7 +11,6 @@ module TestSuite.JSON (
 import Data.Int
 import Data.List (sortBy, nubBy)
 import Data.Function (on)
-import Control.Applicative
 import qualified Data.ByteString.Lazy.Char8 as BS
 import Test.QuickCheck
 
diff --git a/precompute-fileinfo/src/Main.hs b/precompute-fileinfo/src/Main.hs
index 5e6ca5a2..0781ef38 100644
--- a/precompute-fileinfo/src/Main.hs
+++ b/precompute-fileinfo/src/Main.hs
@@ -1,12 +1,10 @@
 module Main where
 
-import Control.Applicative
 import Control.Concurrent
 import Control.DeepSeq
 import Control.Exception
 import Control.Monad
 import Data.Map.Strict (Map)
-import Data.Monoid
 import Options.Applicative
 import System.FilePath
 import System.IO

From bec837b1e2fbf7cabf5720c1f6b804207a701dcf Mon Sep 17 00:00:00 2001
From: Phil de Joux <philderbeast@gmail.com>
Date: Sat, 20 Jan 2024 13:39:37 -0500
Subject: [PATCH 03/17] Follow hlint suggestion: use fewer imports

---
 hackage-security/src/Text/JSON/Canonical.hs | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hackage-security/src/Text/JSON/Canonical.hs b/hackage-security/src/Text/JSON/Canonical.hs
index 3166bb85..4d3eefd9 100644
--- a/hackage-security/src/Text/JSON/Canonical.hs
+++ b/hackage-security/src/Text/JSON/Canonical.hs
@@ -38,8 +38,7 @@ import Text.ParserCombinators.Parsec
 import Text.PrettyPrint hiding (char)
 import qualified Text.PrettyPrint as Doc
 import Control.Arrow (first)
-import Data.Bits (Bits)
-import Data.Bits (FiniteBits)
+import Data.Bits (Bits, FiniteBits)
 import Data.Char (isDigit, digitToInt)
 import Data.Data (Data)
 import Data.Function (on)

From e8bb54a6d10190f0abc7726f88e49e9502e2c47b Mon Sep 17 00:00:00 2001
From: Phil de Joux <philderbeast@gmail.com>
Date: Sat, 20 Jan 2024 13:48:19 -0500
Subject: [PATCH 04/17] Remove unused -XCPP

---
 .../src/Hackage/Security/Client/Repository/HttpLib/HTTP.hs      | 1 -
 hackage-security/src/Hackage/Security/Client.hs                 | 1 -
 .../src/Hackage/Security/Client/Repository/HttpLib.hs           | 1 -
 hackage-security/src/Hackage/Security/TUF/Patterns.hs           | 1 -
 hackage-security/src/Hackage/Security/Trusted.hs                | 1 -
 hackage-security/src/Hackage/Security/Trusted/TCB.hs            | 1 -
 hackage-security/src/Hackage/Security/Util/Checked.hs           | 1 -
 hackage-security/src/Hackage/Security/Util/JSON.hs              | 2 --
 hackage-security/src/Hackage/Security/Util/Path.hs              | 1 -
 hackage-security/src/Hackage/Security/Util/Some.hs              | 1 -
 hackage-security/src/Text/JSON/Canonical.hs                     | 2 --
 11 files changed, 13 deletions(-)

diff --git a/hackage-security-HTTP/src/Hackage/Security/Client/Repository/HttpLib/HTTP.hs b/hackage-security-HTTP/src/Hackage/Security/Client/Repository/HttpLib/HTTP.hs
index dd3ca6f7..04a40c8b 100644
--- a/hackage-security-HTTP/src/Hackage/Security/Client/Repository/HttpLib/HTTP.hs
+++ b/hackage-security-HTTP/src/Hackage/Security/Client/Repository/HttpLib/HTTP.hs
@@ -1,4 +1,3 @@
-{-# LANGUAGE CPP #-}
 -- | Implementation of 'HttpClient' using the HTTP package
 module Hackage.Security.Client.Repository.HttpLib.HTTP (
     withClient
diff --git a/hackage-security/src/Hackage/Security/Client.hs b/hackage-security/src/Hackage/Security/Client.hs
index bef41438..172136b6 100644
--- a/hackage-security/src/Hackage/Security/Client.hs
+++ b/hackage-security/src/Hackage/Security/Client.hs
@@ -1,4 +1,3 @@
-{-# LANGUAGE CPP #-}
 {-# LANGUAGE StaticPointers #-}
 
 -- | Main entry point into the Hackage Security framework for clients
diff --git a/hackage-security/src/Hackage/Security/Client/Repository/HttpLib.hs b/hackage-security/src/Hackage/Security/Client/Repository/HttpLib.hs
index 6af1df02..fd196fb4 100644
--- a/hackage-security/src/Hackage/Security/Client/Repository/HttpLib.hs
+++ b/hackage-security/src/Hackage/Security/Client/Repository/HttpLib.hs
@@ -1,4 +1,3 @@
-{-# LANGUAGE CPP #-}
 -- | Abstracting over HTTP libraries
 module Hackage.Security.Client.Repository.HttpLib (
     HttpLib(..)
diff --git a/hackage-security/src/Hackage/Security/TUF/Patterns.hs b/hackage-security/src/Hackage/Security/TUF/Patterns.hs
index 20bfb153..e0b90318 100644
--- a/hackage-security/src/Hackage/Security/TUF/Patterns.hs
+++ b/hackage-security/src/Hackage/Security/TUF/Patterns.hs
@@ -2,7 +2,6 @@
 --
 -- NOTE: This module was developed to prepare for proper delegation (#39).
 -- It is currently unused.
-{-# LANGUAGE CPP #-}
 {-# LANGUAGE DeriveLift #-}
 {-# LANGUAGE StandaloneDeriving #-}
 
diff --git a/hackage-security/src/Hackage/Security/Trusted.hs b/hackage-security/src/Hackage/Security/Trusted.hs
index 5931d992..b6386110 100644
--- a/hackage-security/src/Hackage/Security/Trusted.hs
+++ b/hackage-security/src/Hackage/Security/Trusted.hs
@@ -1,4 +1,3 @@
-{-# LANGUAGE CPP #-}
 {-# LANGUAGE StaticPointers #-}
 
 module Hackage.Security.Trusted (
diff --git a/hackage-security/src/Hackage/Security/Trusted/TCB.hs b/hackage-security/src/Hackage/Security/Trusted/TCB.hs
index eecd7712..efef4cc1 100644
--- a/hackage-security/src/Hackage/Security/Trusted/TCB.hs
+++ b/hackage-security/src/Hackage/Security/Trusted/TCB.hs
@@ -1,4 +1,3 @@
-{-# LANGUAGE CPP #-}
 module Hackage.Security.Trusted.TCB (
     -- * Trusted values
     Trusted(DeclareTrusted)
diff --git a/hackage-security/src/Hackage/Security/Util/Checked.hs b/hackage-security/src/Hackage/Security/Util/Checked.hs
index dcac49ba..415f3535 100644
--- a/hackage-security/src/Hackage/Security/Util/Checked.hs
+++ b/hackage-security/src/Hackage/Security/Util/Checked.hs
@@ -1,4 +1,3 @@
-{-# LANGUAGE CPP #-}
 {-# LANGUAGE DeriveDataTypeable  #-}
 {-# LANGUAGE IncoherentInstances #-}
 {-# LANGUAGE RoleAnnotations     #-}
diff --git a/hackage-security/src/Hackage/Security/Util/JSON.hs b/hackage-security/src/Hackage/Security/Util/JSON.hs
index 6dbd3d02..00342105 100644
--- a/hackage-security/src/Hackage/Security/Util/JSON.hs
+++ b/hackage-security/src/Hackage/Security/Util/JSON.hs
@@ -1,5 +1,3 @@
-{-# LANGUAGE CPP #-}
-
 -- |
 module Hackage.Security.Util.JSON (
     -- * Type classes
diff --git a/hackage-security/src/Hackage/Security/Util/Path.hs b/hackage-security/src/Hackage/Security/Util/Path.hs
index 00a115e1..55e15951 100644
--- a/hackage-security/src/Hackage/Security/Util/Path.hs
+++ b/hackage-security/src/Hackage/Security/Util/Path.hs
@@ -7,7 +7,6 @@
 --
 -- Note that his module does not import any other modules from Hackage.Security;
 -- everywhere else we use Path instead of FilePath directly.
-{-# LANGUAGE CPP #-}
 module Hackage.Security.Util.Path (
     -- * Paths
     Path(..)
diff --git a/hackage-security/src/Hackage/Security/Util/Some.hs b/hackage-security/src/Hackage/Security/Util/Some.hs
index e36fa4f8..5f27ea86 100644
--- a/hackage-security/src/Hackage/Security/Util/Some.hs
+++ b/hackage-security/src/Hackage/Security/Util/Some.hs
@@ -1,4 +1,3 @@
-{-# LANGUAGE CPP #-}
 -- | Hiding existentials
 module Hackage.Security.Util.Some (
     Some(..)
diff --git a/hackage-security/src/Text/JSON/Canonical.hs b/hackage-security/src/Text/JSON/Canonical.hs
index 4d3eefd9..936e11b3 100644
--- a/hackage-security/src/Text/JSON/Canonical.hs
+++ b/hackage-security/src/Text/JSON/Canonical.hs
@@ -1,5 +1,3 @@
-{-# LANGUAGE CPP #-}
---------------------------------------------------------------------
 -- |
 -- Module    : Text.JSON.Parsec
 -- Copyright : (c) Galois, Inc. 2007-2009, Duncan Coutts 2015

From 51d8113d92e931d118141122d9c736791340e02d Mon Sep 17 00:00:00 2001
From: Phil de Joux <philderbeast@gmail.com>
Date: Sat, 20 Jan 2024 13:56:58 -0500
Subject: [PATCH 05/17] Satisfy -Wunused-record-wildcards

---
 hackage-repo-tool/src/Main.hs                                 | 4 ++--
 hackage-security/src/Hackage/Security/Client.hs               | 2 +-
 .../src/Hackage/Security/Client/Repository/Remote.hs          | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/hackage-repo-tool/src/Main.hs b/hackage-repo-tool/src/Main.hs
index e871b4de..bdd67363 100644
--- a/hackage-repo-tool/src/Main.hs
+++ b/hackage-repo-tool/src/Main.hs
@@ -410,7 +410,7 @@ createPackageMetadata opts repoLoc whenWrite pkgId = do
 
 -- | Find the files we need to add to the index
 findNewIndexFiles :: GlobalOpts -> RepoLoc -> WhenWrite -> IO [IndexPath]
-findNewIndexFiles opts@GlobalOpts{..} repoLoc whenWrite = do
+findNewIndexFiles opts@GlobalOpts{} repoLoc whenWrite = do
     indexTS    <- getFileModTime opts repoLoc (InRep repoLayoutIndexTar)
     indexFiles <- getRecursiveContents absIndexDir
 
@@ -430,7 +430,7 @@ findNewIndexFiles opts@GlobalOpts{..} repoLoc whenWrite = do
 
 -- | Extract the cabal file from the package tarball and copy it to the index
 extractCabalFile :: GlobalOpts -> RepoLoc -> WhenWrite -> PackageIdentifier -> IO ()
-extractCabalFile opts@GlobalOpts{..} repoLoc whenWrite pkgId = do
+extractCabalFile opts@GlobalOpts{} repoLoc whenWrite pkgId = do
     srcTS <- getFileModTime opts repoLoc src
     dstTS <- getFileModTime opts repoLoc dst
     let skip = case whenWrite of
diff --git a/hackage-security/src/Hackage/Security/Client.hs b/hackage-security/src/Hackage/Security/Client.hs
index 172136b6..6dcb426f 100644
--- a/hackage-security/src/Hackage/Security/Client.hs
+++ b/hackage-security/src/Hackage/Security/Client.hs
@@ -374,7 +374,7 @@ getRemoteFile :: ( Throws VerificationError
               -> Maybe UTCTime
               -> RemoteFile (f :- ()) Metadata
               -> Verify (Trusted a, down Metadata)
-getRemoteFile rep@Repository{..} cachedInfo@CachedInfo{..} isRetry mNow file = do
+getRemoteFile rep@Repository{} cachedInfo@CachedInfo{..} isRetry mNow file = do
     (targetPath, tempPath) <- getRemote' rep isRetry file
     verifyFileInfo' (remoteFileDefaultInfo file) targetPath tempPath
     signed   <- throwErrorsChecked (VerificationErrorDeserialization targetPath) =<<
diff --git a/hackage-security/src/Hackage/Security/Client/Repository/Remote.hs b/hackage-security/src/Hackage/Security/Client/Repository/Remote.hs
index 47640190..8bf7073b 100644
--- a/hackage-security/src/Hackage/Security/Client/Repository/Remote.hs
+++ b/hackage-security/src/Hackage/Security/Client/Repository/Remote.hs
@@ -238,7 +238,7 @@ getRemote remoteConfig selectedMirror attemptNr remoteFile = do
 -- error we want to make sure caches get files upstream in case the validation
 -- error was because the cache updated files out of order.
 httpRequestHeaders :: RemoteConfig -> AttemptNr -> [HttpRequestHeader]
-httpRequestHeaders RemoteConfig{..} attemptNr =
+httpRequestHeaders RemoteConfig{} attemptNr =
     if attemptNr == 0 then defaultHeaders
                       else HttpRequestMaxAge0 : defaultHeaders
   where
@@ -256,7 +256,7 @@ withMirror :: forall a.
            -> Maybe [Mirror]         -- ^ TUF mirrors
            -> IO a                   -- ^ Callback
            -> IO a
-withMirror HttpLib{..}
+withMirror HttpLib{}
            selectedMirror
            logger
            oobMirrors

From 07a05c7892d82e78869a04f42d5dc063944f1ba8 Mon Sep 17 00:00:00 2001
From: Phil de Joux <philderbeast@gmail.com>
Date: Sat, 20 Jan 2024 14:07:06 -0500
Subject: [PATCH 06/17] Satisfy -Wstar-is-type

---
 hackage-security/src/Hackage/Security/Client/Formats.hs  | 7 ++++---
 .../src/Hackage/Security/Client/Repository.hs            | 9 +++++----
 .../src/Hackage/Security/Client/Repository/Remote.hs     | 5 +++--
 .../src/Hackage/Security/TUF/Layout/Index.hs             | 3 ++-
 .../src/Hackage/Security/Util/TypedEmbedded.hs           | 3 ++-
 hackage-security/tests/TestSuite/InMemRepo.hs            | 3 ++-
 6 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/hackage-security/src/Hackage/Security/Client/Formats.hs b/hackage-security/src/Hackage/Security/Client/Formats.hs
index 58d5c0c3..5c4f04dc 100644
--- a/hackage-security/src/Hackage/Security/Client/Formats.hs
+++ b/hackage-security/src/Hackage/Security/Client/Formats.hs
@@ -18,6 +18,7 @@ module Hackage.Security.Client.Formats (
   ) where
 
 import Prelude
+import Data.Kind (Type)
 import Hackage.Security.Util.Stack
 import Hackage.Security.Util.TypedEmbedded
 
@@ -31,7 +32,7 @@ data FormatGz
 -- | Format is a singleton type (reflection type to term level)
 --
 -- NOTE: In the future we might add further compression formats.
-data Format :: * -> * where
+data Format :: Type -> Type where
   FUn :: Format FormatUn
   FGz :: Format FormatGz
 
@@ -55,7 +56,7 @@ instance Unify Format where
 --
 -- NOTE: If we add additional cases here (for dealing with additional formats)
 -- all calls to @error "inaccessible"@ need to be reevaluated.
-data Formats :: * -> * -> * where
+data Formats :: Type -> Type -> Type where
   FsNone :: Formats () a
   FsUn   :: a -> Formats (FormatUn :- ()) a
   FsGz   :: a -> Formats (FormatGz :- ()) a
@@ -74,7 +75,7 @@ instance Functor (Formats fs) where
 -- | @HasFormat fs f@ is a proof that @f@ is a key in @fs@.
 --
 -- See 'formatsMember' and 'formatsLookup' for typical usage.
-data HasFormat :: * -> * -> * where
+data HasFormat :: Type -> Type -> Type where
   HFZ :: Format f       -> HasFormat (f  :- fs) f
   HFS :: HasFormat fs f -> HasFormat (f' :- fs) f
 
diff --git a/hackage-security/src/Hackage/Security/Client/Repository.hs b/hackage-security/src/Hackage/Security/Client/Repository.hs
index 93dd76b0..dbe42723 100644
--- a/hackage-security/src/Hackage/Security/Client/Repository.hs
+++ b/hackage-security/src/Hackage/Security/Client/Repository.hs
@@ -32,6 +32,7 @@ module Hackage.Security.Client.Repository (
 
 import Prelude
 import Control.Exception
+import Data.Kind (Type)
 import Data.Typeable (Typeable)
 import qualified Codec.Archive.Tar.Index as Tar
 import qualified Data.ByteString.Lazy    as BS.L
@@ -63,7 +64,7 @@ data Binary
 -- is metadata actual binary content.
 --
 -- NOTE: Haddock lacks GADT support so constructors have only regular comments.
-data RemoteFile :: * -> * -> * where
+data RemoteFile :: Type -> Type -> Type where
     -- Timestamp metadata (@timestamp.json@)
     --
     -- We never have (explicit) file length available for timestamps.
@@ -361,7 +362,7 @@ data UpdateFailure =
   Downloaded files
 -------------------------------------------------------------------------------}
 
-class DownloadedFile (down :: * -> *) where
+class DownloadedFile (down :: Type -> Type) where
   -- | Verify a download file
   downloadedVerify :: down a -> Trusted FileInfo -> IO Bool
 
@@ -381,7 +382,7 @@ class DownloadedFile (down :: * -> *) where
 --
 -- For instance, for repositories using HTTP this might correspond to a 404;
 -- for local repositories this might correspond to file-not-found, etc.
-data SomeRemoteError :: * where
+data SomeRemoteError :: Type where
     SomeRemoteError :: Exception e => e -> SomeRemoteError
   deriving (Typeable)
 
@@ -419,7 +420,7 @@ remoteRepoPath' repoLayout file format =
 -------------------------------------------------------------------------------}
 
 -- | Is a particular remote file cached?
-data IsCached :: * -> * where
+data IsCached :: Type -> Type where
     -- This remote file should be cached, and we ask for it by name
     CacheAs :: CachedFile -> IsCached Metadata
 
diff --git a/hackage-security/src/Hackage/Security/Client/Repository/Remote.hs b/hackage-security/src/Hackage/Security/Client/Repository/Remote.hs
index 8bf7073b..967d5249 100644
--- a/hackage-security/src/Hackage/Security/Client/Repository/Remote.hs
+++ b/hackage-security/src/Hackage/Security/Client/Repository/Remote.hs
@@ -32,6 +32,7 @@ import Control.Concurrent
 import Control.Exception
 import Control.Monad (when, unless)
 import Control.Monad.IO.Class (MonadIO)
+import Data.Kind (Type)
 import Data.List (nub, intercalate)
 import Data.Typeable
 import Network.URI hiding (uriPath, path)
@@ -300,7 +301,7 @@ withMirror HttpLib{}
 -------------------------------------------------------------------------------}
 
 -- | Download method (downloading or updating)
-data DownloadMethod :: * -> * -> * where
+data DownloadMethod :: Type -> Type -> Type where
     -- Download this file (we never attempt to update this type of file)
     NeverUpdated :: {
         neverUpdatedFormat :: HasFormat fs f
@@ -595,7 +596,7 @@ fileLength' = fileLength . fileInfoLength . trusted
   Files downloaded from the remote repository
 -------------------------------------------------------------------------------}
 
-data RemoteTemp :: * -> * where
+data RemoteTemp :: Type -> Type where
     DownloadedWhole :: {
         wholeTemp :: Path Absolute
       } -> RemoteTemp a
diff --git a/hackage-security/src/Hackage/Security/TUF/Layout/Index.hs b/hackage-security/src/Hackage/Security/TUF/Layout/Index.hs
index eaef6501..be04b738 100644
--- a/hackage-security/src/Hackage/Security/TUF/Layout/Index.hs
+++ b/hackage-security/src/Hackage/Security/TUF/Layout/Index.hs
@@ -10,6 +10,7 @@ module Hackage.Security.TUF.Layout.Index (
   ) where
 
 import Prelude
+import Data.Kind (Type)
 import Distribution.Package
 import Distribution.Text
 
@@ -43,7 +44,7 @@ data IndexLayout = IndexLayout  {
 -- TODO: If we wanted to support legacy Hackage, we should also have a case for
 -- the global preferred-versions file. But supporting legacy Hackage will
 -- probably require more work anyway..
-data IndexFile :: * -> * where
+data IndexFile :: Type -> Type where
     -- Package-specific metadata (@targets.json@)
     IndexPkgMetadata :: PackageIdentifier -> IndexFile (Signed Targets)
 
diff --git a/hackage-security/src/Hackage/Security/Util/TypedEmbedded.hs b/hackage-security/src/Hackage/Security/Util/TypedEmbedded.hs
index bbdca6a5..3c968f57 100644
--- a/hackage-security/src/Hackage/Security/Util/TypedEmbedded.hs
+++ b/hackage-security/src/Hackage/Security/Util/TypedEmbedded.hs
@@ -8,6 +8,7 @@ module Hackage.Security.Util.TypedEmbedded (
   ) where
 
 import Prelude
+import Data.Kind (Type)
 
 -- | Type equality proofs
 --
@@ -16,7 +17,7 @@ import Prelude
 data a :=: b where
   Refl :: a :=: a
 
-type family TypeOf (f :: * -> *) :: * -> *
+type family TypeOf (f :: Type -> Type) :: Type -> Type
 
 -- | Equality check that gives us a type-level equality proof.
 class Unify f where
diff --git a/hackage-security/tests/TestSuite/InMemRepo.hs b/hackage-security/tests/TestSuite/InMemRepo.hs
index 9a6ec681..179af81a 100644
--- a/hackage-security/tests/TestSuite/InMemRepo.hs
+++ b/hackage-security/tests/TestSuite/InMemRepo.hs
@@ -8,6 +8,7 @@ module TestSuite.InMemRepo (
 
 -- stdlib
 import Control.Exception
+import Data.Kind (Type)
 import Data.Time
 import qualified Codec.Archive.Tar      as Tar
 import qualified Codec.Compression.GZip as GZip
@@ -33,7 +34,7 @@ import TestSuite.Util.StrictMVar
   "Files" from the in-memory repository
 -------------------------------------------------------------------------------}
 
-data InMemFile :: * -> * where
+data InMemFile :: Type -> Type where
     InMemMetadata :: ToJSON WriteJSON a => RepoLayout -> a -> InMemFile Metadata
     InMemBinary   :: BS.L.ByteString -> InMemFile Binary
 

From f8a7d4304ac0a256a7f0faef4d1b645fffa0107a Mon Sep 17 00:00:00 2001
From: Phil de Joux <philderbeast@gmail.com>
Date: Sat, 20 Jan 2024 14:27:23 -0500
Subject: [PATCH 07/17] Satisfy -Wincomplete-uni-patterns with _ex2

---
 hackage-security/src/Hackage/Security/TUF/Patterns.hs | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hackage-security/src/Hackage/Security/TUF/Patterns.hs b/hackage-security/src/Hackage/Security/TUF/Patterns.hs
index e0b90318..4a3bcc41 100644
--- a/hackage-security/src/Hackage/Security/TUF/Patterns.hs
+++ b/hackage-security/src/Hackage/Security/TUF/Patterns.hs
@@ -323,9 +323,8 @@ _ex1 = matchDelegation del "A/x/y/z.foo"
             )
 
 _ex2 :: Maybe String
-_ex2 = matchDelegation del "A/x/y/z.foo"
-  where
-    Right del = parseDelegation "A/*/*/*.foo" "B/*/C/*/*.bar"
+_ex2 = either (const Nothing) (`matchDelegation` "A/x/y/z.foo")
+  (parseDelegation "A/*/*/*.foo" "B/*/C/*/*.bar")
 
 _ex3 :: Either String Delegation
 _ex3 = parseDelegation "foo" "*/bar"

From 3486f365ae506d3216b406ad566da18a1dee0cd3 Mon Sep 17 00:00:00 2001
From: Phil de Joux <philderbeast@gmail.com>
Date: Sat, 20 Jan 2024 14:48:03 -0500
Subject: [PATCH 08/17] Satisfy -Wincomplete-uni-patterns with splitExtension

---
 hackage-security/src/Hackage/Security/TUF/Patterns.hs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hackage-security/src/Hackage/Security/TUF/Patterns.hs b/hackage-security/src/Hackage/Security/TUF/Patterns.hs
index 4a3bcc41..1089d509 100644
--- a/hackage-security/src/Hackage/Security/TUF/Patterns.hs
+++ b/hackage-security/src/Hackage/Security/TUF/Patterns.hs
@@ -126,8 +126,8 @@ matchPattern = go . splitDirectories
     go []    _                    = Nothing
     go [f]   (PatFileConst f')    = do guard (f == f')
                                        return ()
-    go [f]   (PatFileExt   e')    = do let (bn, _:e) = splitExtension f
-                                       guard $ e == e'
+    go [f]   (PatFileExt   e')    = do let (bn, dotExt) = splitExtension f
+                                       guard $ dotExt == '.':e'
                                        return (bn :- ())
     go [_]   _                    = Nothing
     go (d:p) (PatDirConst  d' p') = do guard (d == d')

From f3f5c0ad6df710d7aaa8e4b36af98f9fdb4bb590 Mon Sep 17 00:00:00 2001
From: Phil de Joux <philderbeast@gmail.com>
Date: Sat, 20 Jan 2024 14:58:38 -0500
Subject: [PATCH 09/17] Satisfy -Wincomplete-uni-patterns with toTarPath

---
 hackage-security/tests/TestSuite.hs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hackage-security/tests/TestSuite.hs b/hackage-security/tests/TestSuite.hs
index 598e1519..f5c038ae 100644
--- a/hackage-security/tests/TestSuite.hs
+++ b/hackage-security/tests/TestSuite.hs
@@ -238,7 +238,7 @@ testRepoIndex inMemRepo repo = do
     length (directoryEntries dir1) @?= 0
 
     now <- getCurrentTime
-    inMemRepoSetIndex inMemRepo now [testEntry1]
+    inMemRepoSetIndex inMemRepo now testEntries1
 
     assertEqual "B" HasUpdates =<< checkForUpdates repo =<< checkExpiry
     dir2 <- getDirectory repo
@@ -264,9 +264,9 @@ testRepoIndex inMemRepo repo = do
              _        -> fail "unexpected index entry content"
          _ -> fail "unexpected index path"
 
-    testEntry1 = Tar.fileEntry path testEntrycontent
-      where
-        Right path = Tar.toTarPath False "foo/preferred-versions"
+    testEntries1 :: [Tar.GenEntry Tar.TarPath linkTarget]
+    testEntries1 = either (const []) (pure . (`Tar.fileEntry` testEntrycontent))
+        (Tar.toTarPath False "foo/preferred-versions")
     testEntrycontent   = BS.pack "foo >= 1"
     testEntryIndexFile = IndexPkgPrefs (mkPackageName "foo")
 

From 09e11ab7718f9ebc87fa083eb206696ab316e138 Mon Sep 17 00:00:00 2001
From: Phil de Joux <philderbeast@gmail.com>
Date: Sat, 20 Jan 2024 16:23:55 -0500
Subject: [PATCH 10/17] Add precompute-fileinfo to project

---
 cabal.project | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/cabal.project b/cabal.project
index e9a0976f..84cebb18 100644
--- a/cabal.project
+++ b/cabal.project
@@ -7,11 +7,9 @@ packages: hackage-security
           hackage-root-tool
           hackage-repo-tool
           hackage-security-HTTP
+          precompute-fileinfo
 
 package hackage-security
   tests: true
 
--- FIXME/TODO
--- packages: precompute-fileinfo
-
--- constraints: hackage-security -lukko
+-- constraints: hackage-security -lukko
\ No newline at end of file

From c18e76ee65eacf3b57e6262648701c3c18d9d0ab Mon Sep 17 00:00:00 2001
From: Phil de Joux <philderbeast@gmail.com>
Date: Sat, 20 Jan 2024 16:24:17 -0500
Subject: [PATCH 11/17] Satisfy -Wincomplete-uni-patterns in
 precompute-fileinfo

---
 precompute-fileinfo/src/Main.hs | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/precompute-fileinfo/src/Main.hs b/precompute-fileinfo/src/Main.hs
index 0781ef38..215c73b5 100644
--- a/precompute-fileinfo/src/Main.hs
+++ b/precompute-fileinfo/src/Main.hs
@@ -1,3 +1,5 @@
+{-# LANGUAGE  ScopedTypeVariables #-}
+
 module Main where
 
 import Control.Concurrent
@@ -167,13 +169,13 @@ writeMap fp hashes = withFile fp WriteMode $ \h ->
 readMap :: FilePath -> IO (Map MD5 (SHA256, Length))
 readMap fp =
     withFile fp ReadMode $ \h -> do
-      hashes <- Map.fromList . map parseEntry . lines <$> hGetContents h
+      hashes <- mapFromParseEntry . lines <$> hGetContents h
       evaluate $ rnf hashes
       return hashes
   where
-    parseEntry :: String -> (MD5, (SHA256, Length))
-    parseEntry line = let [md5, sha256, len] = words line
-                      in (md5, (sha256, read len))
+    mapFromParseEntry :: [String] -> Map MD5 (SHA256, Length)
+    mapFromParseEntry mapLines = Map.fromList
+      [(md5, (sha256, read len)) | [md5, sha256, len] <- words <$> mapLines]
 
 {-------------------------------------------------------------------------------
   Auxiliary

From 1ef5ff2acb90566be5d0af63bcd75a8b775fd63b Mon Sep 17 00:00:00 2001
From: Phil de Joux <philderbeast@gmail.com>
Date: Sat, 20 Jan 2024 16:25:14 -0500
Subject: [PATCH 12/17] Bump tested-with in packages

---
 cabal.haskell-ci                                      |  4 ++--
 example-client/example-client.cabal                   |  2 --
 hackage-repo-tool/hackage-repo-tool.cabal             |  2 --
 hackage-root-tool/hackage-root-tool.cabal             |  2 --
 hackage-security-HTTP/hackage-security-HTTP.cabal     |  2 --
 hackage-security-curl/hackage-security-curl.cabal     |  2 --
 .../hackage-security-http-client.cabal                |  2 --
 hackage-security/hackage-security.cabal               |  2 --
 precompute-fileinfo/precompute-fileinfo.cabal         | 11 +++++++++--
 9 files changed, 11 insertions(+), 18 deletions(-)

diff --git a/cabal.haskell-ci b/cabal.haskell-ci
index 72e1e7aa..19066965 100644
--- a/cabal.haskell-ci
+++ b/cabal.haskell-ci
@@ -15,11 +15,11 @@ raw-project
     base-compat >= 0.12.2
 
 constraint-set no-lukko
-  ghc: >=8.2
+  ghc: >=8.4
   constraints: hackage-security -lukko
 
 constraint-set containers-0.7
-  ghc: >= 8.2 && < 9.8
+  ghc: >= 8.4 && < 9.8
   constraints: containers >= 0.7
   tests: True
   run-tests: True
diff --git a/example-client/example-client.cabal b/example-client/example-client.cabal
index c89e11dc..7520fe17 100644
--- a/example-client/example-client.cabal
+++ b/example-client/example-client.cabal
@@ -21,8 +21,6 @@ tested-with:
   GHC == 8.8.4
   GHC == 8.6.5
   GHC == 8.4.4
-  GHC == 8.2.2
-  GHC == 8.0.2
 
 flag use-network-uri
   description: Are we using network-uri?
diff --git a/hackage-repo-tool/hackage-repo-tool.cabal b/hackage-repo-tool/hackage-repo-tool.cabal
index e431df4b..af07ae54 100644
--- a/hackage-repo-tool/hackage-repo-tool.cabal
+++ b/hackage-repo-tool/hackage-repo-tool.cabal
@@ -32,8 +32,6 @@ tested-with:
   GHC == 8.8.4
   GHC == 8.6.5
   GHC == 8.4.4
-  GHC == 8.2.2
-  GHC == 8.0.2
 
 extra-source-files:
   ChangeLog.md README.md
diff --git a/hackage-root-tool/hackage-root-tool.cabal b/hackage-root-tool/hackage-root-tool.cabal
index 1488d27a..e4a1d7d6 100644
--- a/hackage-root-tool/hackage-root-tool.cabal
+++ b/hackage-root-tool/hackage-root-tool.cabal
@@ -25,8 +25,6 @@ tested-with:
   GHC == 8.8.4
   GHC == 8.6.5
   GHC == 8.4.4
-  GHC == 8.2.2
-  GHC == 8.0.2
 
 extra-source-files:
   ChangeLog.md
diff --git a/hackage-security-HTTP/hackage-security-HTTP.cabal b/hackage-security-HTTP/hackage-security-HTTP.cabal
index 9806afad..75385998 100644
--- a/hackage-security-HTTP/hackage-security-HTTP.cabal
+++ b/hackage-security-HTTP/hackage-security-HTTP.cabal
@@ -27,8 +27,6 @@ tested-with:
   GHC == 8.8.4
   GHC == 8.6.5
   GHC == 8.4.4
-  GHC == 8.2.2
-  GHC == 8.0.2
 
 extra-source-files:
   ChangeLog.md
diff --git a/hackage-security-curl/hackage-security-curl.cabal b/hackage-security-curl/hackage-security-curl.cabal
index 27b14299..1dad0ad8 100644
--- a/hackage-security-curl/hackage-security-curl.cabal
+++ b/hackage-security-curl/hackage-security-curl.cabal
@@ -25,8 +25,6 @@ tested-with:
   GHC == 8.8.4
   GHC == 8.6.5
   GHC == 8.4.4
-  GHC == 8.2.2
-  GHC == 8.0.2
 
 flag use-network-uri
   description: Are we using network-uri?
diff --git a/hackage-security-http-client/hackage-security-http-client.cabal b/hackage-security-http-client/hackage-security-http-client.cabal
index 3e91fb86..72b772cd 100644
--- a/hackage-security-http-client/hackage-security-http-client.cabal
+++ b/hackage-security-http-client/hackage-security-http-client.cabal
@@ -24,8 +24,6 @@ tested-with:
   GHC == 8.8.4
   GHC == 8.6.5
   GHC == 8.4.4
-  GHC == 8.2.2
-  GHC == 8.0.2
 
 flag use-network-uri
   description: Are we using network-uri?
diff --git a/hackage-security/hackage-security.cabal b/hackage-security/hackage-security.cabal
index 6ad720ef..9883b93b 100644
--- a/hackage-security/hackage-security.cabal
+++ b/hackage-security/hackage-security.cabal
@@ -40,8 +40,6 @@ tested-with:
   GHC == 8.8.4
   GHC == 8.6.5
   GHC == 8.4.4
-  GHC == 8.2.2
-  GHC == 8.0.2
 
 extra-source-files:
   ChangeLog.md
diff --git a/precompute-fileinfo/precompute-fileinfo.cabal b/precompute-fileinfo/precompute-fileinfo.cabal
index 9e077d7b..8bcf747b 100644
--- a/precompute-fileinfo/precompute-fileinfo.cabal
+++ b/precompute-fileinfo/precompute-fileinfo.cabal
@@ -15,8 +15,15 @@ build-type:          Simple
 cabal-version:       >=1.10
 
 tested-with:
-  GHC==9.8.1,  GHC==9.6.4, GHC==9.4.8, GHC==9.2.8, GHC==9.0.2,
-  GHC==8.10.7, GHC==8.8.4, GHC==8.6.5, GHC==8.4.4, GHC==8.2.2, GHC==8.0.2
+  GHC == 9.8.1
+  GHC == 9.6.4
+  GHC == 9.4.8
+  GHC == 9.2.8
+  GHC == 9.0.2
+  GHC == 8.10.7
+  GHC == 8.8.4
+  GHC == 8.6.5
+  GHC == 8.4.4
 
 executable precompute-fileinfo
   main-is:             Main.hs

From 4dcc2b62df6377dd7e9dcf8956bd5f3840258828 Mon Sep 17 00:00:00 2001
From: Phil de Joux <philderbeast@gmail.com>
Date: Mon, 22 Jan 2024 15:48:10 -0500
Subject: [PATCH 13/17] Bounds covering ghc-8.4.4 and ghc-9.8.1

- Match ghc-8.4.4 included package lower bounds
- Add cabal gen-bounds bounds
---
 example-client/example-client.cabal           | 12 ++---
 hackage-repo-tool/hackage-repo-tool.cabal     | 17 ++++---
 hackage-root-tool/hackage-root-tool.cabal     |  6 +--
 .../hackage-security-HTTP.cabal               |  4 +-
 .../hackage-security-curl.cabal               |  8 ++--
 .../hackage-security-http-client.cabal        | 11 ++---
 hackage-security/hackage-security.cabal       | 44 +++++++++----------
 precompute-fileinfo/precompute-fileinfo.cabal | 18 ++++----
 8 files changed, 59 insertions(+), 61 deletions(-)

diff --git a/example-client/example-client.cabal b/example-client/example-client.cabal
index 7520fe17..78fae931 100644
--- a/example-client/example-client.cabal
+++ b/example-client/example-client.cabal
@@ -36,11 +36,11 @@ executable example-client
   other-modules:       ExampleClient.Options
 
   build-depends:       base                 >= 4.11 && < 4.20,
-                       bytestring           >= 0.9,
-                       directory            >= 1.2,
-                       filepath             >= 1.2,
-                       optparse-applicative >= 0.11,
-                       time                 >= 1.5,
+                       bytestring           >= 0.10.8.2,
+                       directory            >= 1.3.1.5,
+                       filepath             >= 1.4.2,
+                       optparse-applicative >= 0.13,
+                       time                 >= 1.8.0.2,
                        hackage-security     >= 0.5,
                        hackage-security-HTTP,
                        hackage-security-curl,
@@ -65,5 +65,5 @@ executable example-client
   if flag(Cabal-syntax)
     build-depends: Cabal-syntax >= 3.7 && < 3.12
   else
-    build-depends: Cabal        >= 1.12 && < 3.7,
+    build-depends: Cabal        >= 2.2.0.1 && < 3.7,
                    Cabal-syntax <  3.7
diff --git a/hackage-repo-tool/hackage-repo-tool.cabal b/hackage-repo-tool/hackage-repo-tool.cabal
index af07ae54..7ec7c8b4 100644
--- a/hackage-repo-tool/hackage-repo-tool.cabal
+++ b/hackage-repo-tool/hackage-repo-tool.cabal
@@ -60,18 +60,18 @@ executable hackage-repo-tool
 
   -- For boot libraries we try to accomodate the versions bundled with
   -- the respective GHC release
-  build-depends:       base                 >= 4.11  && < 4.20,
-                       bytestring           >= 0.9  && < 0.13,
-                       directory            >= 1.2  && < 1.4,
-                       filepath             >= 1.3  && < 1.5,
-                       time                 >= 1.5  && < 1.13
+  build-depends:       base                 >= 4.11     && < 4.20,
+                       bytestring           >= 0.10.8.2 && < 0.13,
+                       directory            >= 1.3.1.5  && < 1.4,
+                       filepath             >= 1.4.2    && < 1.5,
+                       time                 >= 1.8.0.2  && < 1.13
   if !os(windows)
-    build-depends:     unix                 >= 2.5  && < 2.9
+    build-depends:     unix                 >= 2.7.2.2  && < 2.9
 
   -- For non-boot libraries we try to support single major versions
   -- to reduce the risk of semantic differences
   build-depends:       microlens            >= 0.4.11.2 && < 0.5,
-                       optparse-applicative >= 0.15.1   && < 0.18,
+                       optparse-applicative >= 0.13     && < 0.19,
                        tar                  >= 0.5      && < 0.7,
                        zlib                 >= 0.6      && < 0.8,
                        hackage-security     >= 0.6      && < 0.7
@@ -87,8 +87,7 @@ executable hackage-repo-tool
   if flag(Cabal-syntax)
     build-depends: Cabal-syntax >= 3.7 && < 3.12
   else
-    build-depends: Cabal        >= 1.14    && < 1.26
-                             || >= 2.0     && < 2.6
+    build-depends: Cabal        >= 2.2.0.1 && < 2.6
                              || >= 3.0     && < 3.7,
                    Cabal-syntax <  3.7
 
diff --git a/hackage-root-tool/hackage-root-tool.cabal b/hackage-root-tool/hackage-root-tool.cabal
index e4a1d7d6..a2c6b1c3 100644
--- a/hackage-root-tool/hackage-root-tool.cabal
+++ b/hackage-root-tool/hackage-root-tool.cabal
@@ -37,9 +37,9 @@ source-repository head
 executable hackage-root-tool
   main-is:             Main.hs
   build-depends:       base                 >= 4.11  && < 5,
-                       filepath             >= 1.2  && < 1.5,
-                       optparse-applicative >= 0.11 && < 0.18,
-                       hackage-security     >= 0.5  && < 0.7
+                       filepath             >= 1.4.2 && < 1.5,
+                       optparse-applicative >= 0.13  && < 0.19,
+                       hackage-security     >= 0.5   && < 0.7
   default-language:    Haskell2010
   other-extensions:    CPP, ScopedTypeVariables, RecordWildCards
   ghc-options:         -Wall
diff --git a/hackage-security-HTTP/hackage-security-HTTP.cabal b/hackage-security-HTTP/hackage-security-HTTP.cabal
index 75385998..bc0304f7 100644
--- a/hackage-security-HTTP/hackage-security-HTTP.cabal
+++ b/hackage-security-HTTP/hackage-security-HTTP.cabal
@@ -42,9 +42,9 @@ flag use-network-uri
 library
   exposed-modules:     Hackage.Security.Client.Repository.HttpLib.HTTP
   build-depends:       base             >= 4.11      && < 4.20,
-                       bytestring       >= 0.9       && < 0.13,
+                       bytestring       >= 0.10.8.2  && < 0.13,
                        HTTP             >= 4000.2.19 && < 4000.5,
-                       mtl              >= 2.1       && < 2.4,
+                       mtl              >= 2.2.2     && < 2.4,
                        zlib             >= 0.5       && < 0.8,
                        hackage-security >= 0.5       && < 0.7
   hs-source-dirs:      src
diff --git a/hackage-security-curl/hackage-security-curl.cabal b/hackage-security-curl/hackage-security-curl.cabal
index 1dad0ad8..96c9bfaf 100644
--- a/hackage-security-curl/hackage-security-curl.cabal
+++ b/hackage-security-curl/hackage-security-curl.cabal
@@ -32,10 +32,10 @@ flag use-network-uri
 
 library
   exposed-modules:     Hackage.Security.Client.Repository.HttpLib.Curl
-  build-depends:       base        >= 4.11 && < 4.20,
-                       bytestring  >= 0.9,
-                       process     >= 1.1,
-                       hackage-security
+  build-depends:       base             >= 4.11     && < 4.20,
+                       bytestring       >= 0.10.8.2 && < 0.13,
+                       process          >= 1.6.3    && < 1.7,
+                       hackage-security >= 0.6.2    && < 0.7
   hs-source-dirs:      src
   default-language:    Haskell2010
   ghc-options:         -Wall
diff --git a/hackage-security-http-client/hackage-security-http-client.cabal b/hackage-security-http-client/hackage-security-http-client.cabal
index 72b772cd..55491881 100644
--- a/hackage-security-http-client/hackage-security-http-client.cabal
+++ b/hackage-security-http-client/hackage-security-http-client.cabal
@@ -13,6 +13,7 @@ copyright:           Copyright 2015 Well-Typed LLP
 category:            Distribution
 build-type:          Simple
 cabal-version:       >=1.10
+extra-source-files:  ChangeLog.md
 
 tested-with:
   GHC == 9.8.1
@@ -31,11 +32,11 @@ flag use-network-uri
 
 library
   exposed-modules:     Hackage.Security.Client.Repository.HttpLib.HttpClient
-  build-depends:       base               >= 4.11 && < 4.20,
-                       bytestring         >= 0.9,
-                       http-client        >= 0.4 && < 0.8,
-                       http-types         >= 0.8,
-                       hackage-security   >= 0.5 && < 0.7
+  build-depends:       base               >= 4.11     && < 4.20,
+                       bytestring         >= 0.10.8.2 && < 0.13,
+                       http-client        >= 0.4      && < 0.8,
+                       http-types         >= 0.12.4   && < 0.13,
+                       hackage-security   >= 0.5      && < 0.7
   hs-source-dirs:      src
   default-language:    Haskell2010
   default-extensions:  FlexibleContexts
diff --git a/hackage-security/hackage-security.cabal b/hackage-security/hackage-security.cabal
index 9883b93b..e8220de3 100644
--- a/hackage-security/hackage-security.cabal
+++ b/hackage-security/hackage-security.cabal
@@ -108,38 +108,37 @@ library
                        Hackage.Security.Util.Stack
                        Hackage.Security.Util.TypedEmbedded
 
-  build-depends:       base              >= 4.11    && < 4.20,
-                       base16-bytestring >= 0.1.1   && < 1.1,
-                       base64-bytestring >= 1.0     && < 1.3,
-                       bytestring        >= 0.9     && < 0.13,
-                       containers        >= 0.4     && < 0.8,
-                       cryptohash-sha256 >= 0.11    && < 0.12,
-                       directory         >= 1.2.2   && < 1.4,
-                       ed25519           >= 0.0     && < 0.1,
-                       filepath          >= 1.2     && < 1.5,
-                       mtl               >= 2.2     && < 2.4,
-                       parsec            >= 3.1     && < 3.2,
-                       pretty            >= 1.0     && < 1.2,
+  build-depends:       base              >= 4.11     && < 4.20,
+                       base16-bytestring >= 0.1.1    && < 1.1,
+                       base64-bytestring >= 1.0      && < 1.3,
+                       bytestring        >= 0.10.8.2 && < 0.13,
+                       containers        >= 0.5.11   && < 0.8,
+                       cryptohash-sha256 >= 0.11     && < 0.12,
+                       directory         >= 1.3.1.5  && < 1.4,
+                       ed25519           >= 0.0      && < 0.1,
+                       filepath          >= 1.4.2    && < 1.5,
+                       mtl               >= 2.2.2    && < 2.4,
+                       parsec            >= 3.1.13   && < 3.2,
+                       pretty            >= 1.0      && < 1.2,
                        -- 0.4.2 introduces TarIndex, 0.4.4 introduces more
                        -- functionality, 0.5.0 changes type of serialise
-                       tar               >= 0.5     && < 0.7,
-                       template-haskell  >= 2.7     && < 2.22,
-                       time              >= 1.5     && < 1.13,
-                       transformers      >= 0.3     && < 0.7,
+                       tar               >= 0.5      && < 0.7,
+                       template-haskell  >= 2.13     && < 2.22,
+                       time              >= 1.8.0.2  && < 1.13,
+                       transformers      >= 0.3      && < 0.7,
                        zlib              >= 0.5     && < 0.8,
                        -- whatever versions are bundled with ghc:
-                       ghc-prim
+                       ghc-prim          >= 0.5.2    && < 0.12
 
   if flag(lukko)
     build-depends:     lukko      >= 0.1     && < 0.2
   else
     build-depends:     base       >= 4.11
 
-  if flag(Cabal-syntax) && impl(ghc >= 8.2)
+  if flag(Cabal-syntax)
     build-depends: Cabal-syntax >= 3.7 && < 3.12
   else
-    build-depends: Cabal        >= 1.14    && < 1.26
-                             || >= 2.0     && < 2.6
+    build-depends: Cabal        >= 2.2.0.1 && < 2.6
                              || >= 3.0     && < 3.7,
                    Cabal-syntax <  3.7
 
@@ -240,12 +239,11 @@ test-suite TestSuite
                        time,
                        zlib
 
-  if flag(Cabal-syntax) && impl(ghc >= 8.2)
+  if flag(Cabal-syntax)
     build-depends: Cabal        >= 3.7 && < 3.12,
                    Cabal-syntax >= 3.7 && < 3.12
   else
-    build-depends: Cabal        >= 1.14    && < 1.26
-                             || >= 2.0     && < 2.6
+    build-depends: Cabal        >= 2.2.0.1 && < 2.6
                              || >= 3.0     && < 3.7,
                    Cabal-syntax <  3.7
 
diff --git a/precompute-fileinfo/precompute-fileinfo.cabal b/precompute-fileinfo/precompute-fileinfo.cabal
index 8bcf747b..ed88ca7f 100644
--- a/precompute-fileinfo/precompute-fileinfo.cabal
+++ b/precompute-fileinfo/precompute-fileinfo.cabal
@@ -27,15 +27,15 @@ tested-with:
 
 executable precompute-fileinfo
   main-is:             Main.hs
-  build-depends:       base                 >= 4.11,
-                       bytestring           >= 0.9,
-                       containers           >= 0.4,
-                       deepseq              >= 1.3,
-                       filepath             >= 1.2,
-                       optparse-applicative >= 0.11,
-                       SHA                  >= 1.6,
-                       tar                  >= 0.4,
-                       zlib                 >= 0.5
+  build-depends:       base                 >= 4.11     && < 4.20,
+                       bytestring           >= 0.10.8.2 && < 0.13,
+                       containers           >= 0.5.11   && < 0.7,
+                       deepseq              >= 1.4.3    && < 1.6,
+                       filepath             >= 1.4.2    && < 1.5,
+                       optparse-applicative >= 0.13     && < 0.19,
+                       SHA                  >= 1.6.4    && < 1.7,
+                       tar                  >= 0.6.0    && < 0.7,
+                       zlib                 >= 0.6.3    && < 0.7
   hs-source-dirs:      src
   default-language:    Haskell2010
   default-extensions:  RecordWildCards

From 45d6bbe3013f2986353dc1586a2ecacadb7c8708 Mon Sep 17 00:00:00 2001
From: Phil de Joux <philderbeast@gmail.com>
Date: Tue, 23 Jan 2024 09:26:03 -0500
Subject: [PATCH 14/17] Use undefined instead of const Nothing

Preserve the original behaviour
---
 hackage-security/src/Hackage/Security/TUF/Patterns.hs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hackage-security/src/Hackage/Security/TUF/Patterns.hs b/hackage-security/src/Hackage/Security/TUF/Patterns.hs
index 1089d509..bb84c6fc 100644
--- a/hackage-security/src/Hackage/Security/TUF/Patterns.hs
+++ b/hackage-security/src/Hackage/Security/TUF/Patterns.hs
@@ -323,7 +323,7 @@ _ex1 = matchDelegation del "A/x/y/z.foo"
             )
 
 _ex2 :: Maybe String
-_ex2 = either (const Nothing) (`matchDelegation` "A/x/y/z.foo")
+_ex2 = either undefined (`matchDelegation` "A/x/y/z.foo")
   (parseDelegation "A/*/*/*.foo" "B/*/C/*/*.bar")
 
 _ex3 :: Either String Delegation

From 13dbda23c84ef0bdc8031f3963f3b2c3265612fe Mon Sep 17 00:00:00 2001
From: Phil de Joux <philderbeast@gmail.com>
Date: Tue, 23 Jan 2024 09:41:59 -0500
Subject: [PATCH 15/17] Preserve previous behaviour

evaluate . rnf should blow up it words aren't as expected
---
 precompute-fileinfo/src/Main.hs | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/precompute-fileinfo/src/Main.hs b/precompute-fileinfo/src/Main.hs
index 215c73b5..a9b4c73a 100644
--- a/precompute-fileinfo/src/Main.hs
+++ b/precompute-fileinfo/src/Main.hs
@@ -175,7 +175,11 @@ readMap fp =
   where
     mapFromParseEntry :: [String] -> Map MD5 (SHA256, Length)
     mapFromParseEntry mapLines = Map.fromList
-      [(md5, (sha256, read len)) | [md5, sha256, len] <- words <$> mapLines]
+      [ case ws of
+          [md5, sha256, len] -> (md5, (sha256, read len))
+          _ -> (unwords ws, undefined)
+      | ws <- words <$> mapLines
+      ]
 
 {-------------------------------------------------------------------------------
   Auxiliary

From 593e4e9fc033e7041530ce067d91e7288f2590d4 Mon Sep 17 00:00:00 2001
From: Phil de Joux <philderbeast@gmail.com>
Date: Tue, 23 Jan 2024 11:14:50 -0500
Subject: [PATCH 16/17] Go for minimal diff

---
 precompute-fileinfo/src/Main.hs | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/precompute-fileinfo/src/Main.hs b/precompute-fileinfo/src/Main.hs
index a9b4c73a..0b6daedc 100644
--- a/precompute-fileinfo/src/Main.hs
+++ b/precompute-fileinfo/src/Main.hs
@@ -1,5 +1,3 @@
-{-# LANGUAGE  ScopedTypeVariables #-}
-
 module Main where
 
 import Control.Concurrent
@@ -169,17 +167,14 @@ writeMap fp hashes = withFile fp WriteMode $ \h ->
 readMap :: FilePath -> IO (Map MD5 (SHA256, Length))
 readMap fp =
     withFile fp ReadMode $ \h -> do
-      hashes <- mapFromParseEntry . lines <$> hGetContents h
+      hashes <- Map.fromList . map parseEntry . lines <$> hGetContents h
       evaluate $ rnf hashes
       return hashes
   where
-    mapFromParseEntry :: [String] -> Map MD5 (SHA256, Length)
-    mapFromParseEntry mapLines = Map.fromList
-      [ case ws of
-          [md5, sha256, len] -> (md5, (sha256, read len))
-          _ -> (unwords ws, undefined)
-      | ws <- words <$> mapLines
-      ]
+    parseEntry :: String -> (MD5, (SHA256, Length))
+    parseEntry line = case words line of
+      [md5, sha256, len] -> (md5, (sha256, read len))
+      _ -> error $ "failed: parseEntry " ++ show line
 
 {-------------------------------------------------------------------------------
   Auxiliary

From 036165c880b93ad6c2071ae8d5bd41af2f781e24 Mon Sep 17 00:00:00 2001
From: Phil de Joux <philderbeast@gmail.com>
Date: Sun, 17 Mar 2024 12:02:29 -0400
Subject: [PATCH 17/17] Regenerate haskell-ci

---
 .github/workflows/haskell-ci.yml | 74 ++++++++++++++++----------------
 1 file changed, 36 insertions(+), 38 deletions(-)

diff --git a/.github/workflows/haskell-ci.yml b/.github/workflows/haskell-ci.yml
index 22b9d40a..c7026642 100644
--- a/.github/workflows/haskell-ci.yml
+++ b/.github/workflows/haskell-ci.yml
@@ -8,9 +8,9 @@
 #
 # For more information, see https://github.com/andreasabel/haskell-ci
 #
-# version: 0.17.20240127
+# version: 0.18.0.20240225
 #
-# REGENDATA ("0.17.20240127",["github","cabal.project"])
+# REGENDATA ("0.18.0.20240225",["github","cabal.project"])
 #
 name: Haskell-CI
 on:
@@ -37,9 +37,9 @@ jobs:
             compilerVersion: 9.8.1
             setup-method: ghcup
             allow-failure: false
-          - compiler: ghc-9.6.3
+          - compiler: ghc-9.6.4
             compilerKind: ghc
-            compilerVersion: 9.6.3
+            compilerVersion: 9.6.4
             setup-method: ghcup
             allow-failure: false
           - compiler: ghc-9.4.8
@@ -77,16 +77,6 @@ jobs:
             compilerVersion: 8.4.4
             setup-method: ghcup
             allow-failure: false
-          - compiler: ghc-8.2.2
-            compilerKind: ghc
-            compilerVersion: 8.2.2
-            setup-method: ghcup
-            allow-failure: false
-          - compiler: ghc-8.0.2
-            compilerKind: ghc
-            compilerVersion: 8.0.2
-            setup-method: ghcup
-            allow-failure: false
       fail-fast: false
     steps:
       - name: apt
@@ -185,6 +175,7 @@ jobs:
           echo "packages: $GITHUB_WORKSPACE/source/hackage-root-tool" >> cabal.project
           echo "packages: $GITHUB_WORKSPACE/source/hackage-repo-tool" >> cabal.project
           echo "packages: $GITHUB_WORKSPACE/source/hackage-security-HTTP" >> cabal.project
+          echo "packages: $GITHUB_WORKSPACE/source/precompute-fileinfo" >> cabal.project
           cat cabal.project
       - name: sdist
         run: |
@@ -210,6 +201,8 @@ jobs:
           echo "PKGDIR_hackage_repo_tool=${PKGDIR_hackage_repo_tool}" >> "$GITHUB_ENV"
           PKGDIR_hackage_security_HTTP="$(find "$GITHUB_WORKSPACE/unpacked" -maxdepth 1 -type d -regex '.*/hackage-security-HTTP-[0-9.]*')"
           echo "PKGDIR_hackage_security_HTTP=${PKGDIR_hackage_security_HTTP}" >> "$GITHUB_ENV"
+          PKGDIR_precompute_fileinfo="$(find "$GITHUB_WORKSPACE/unpacked" -maxdepth 1 -type d -regex '.*/precompute-fileinfo-[0-9.]*')"
+          echo "PKGDIR_precompute_fileinfo=${PKGDIR_precompute_fileinfo}" >> "$GITHUB_ENV"
           rm -f cabal.project cabal.project.local
           touch cabal.project
           touch cabal.project.local
@@ -220,25 +213,28 @@ jobs:
           echo "packages: ${PKGDIR_hackage_root_tool}" >> cabal.project
           echo "packages: ${PKGDIR_hackage_repo_tool}" >> cabal.project
           echo "packages: ${PKGDIR_hackage_security_HTTP}" >> cabal.project
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then echo "package hackage-security" >> cabal.project ; fi
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then echo "    ghc-options: -Werror=missing-methods" >> cabal.project ; fi
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then echo "package hackage-security-http-client" >> cabal.project ; fi
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then echo "    ghc-options: -Werror=missing-methods" >> cabal.project ; fi
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then echo "package example-client" >> cabal.project ; fi
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then echo "    ghc-options: -Werror=missing-methods" >> cabal.project ; fi
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then echo "package hackage-security-curl" >> cabal.project ; fi
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then echo "    ghc-options: -Werror=missing-methods" >> cabal.project ; fi
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then echo "package hackage-root-tool" >> cabal.project ; fi
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then echo "    ghc-options: -Werror=missing-methods" >> cabal.project ; fi
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then echo "package hackage-repo-tool" >> cabal.project ; fi
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then echo "    ghc-options: -Werror=missing-methods" >> cabal.project ; fi
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then echo "package hackage-security-HTTP" >> cabal.project ; fi
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then echo "    ghc-options: -Werror=missing-methods" >> cabal.project ; fi
+          echo "packages: ${PKGDIR_precompute_fileinfo}" >> cabal.project
+          echo "package hackage-security" >> cabal.project
+          echo "    ghc-options: -Werror=missing-methods" >> cabal.project
+          echo "package hackage-security-http-client" >> cabal.project
+          echo "    ghc-options: -Werror=missing-methods" >> cabal.project
+          echo "package example-client" >> cabal.project
+          echo "    ghc-options: -Werror=missing-methods" >> cabal.project
+          echo "package hackage-security-curl" >> cabal.project
+          echo "    ghc-options: -Werror=missing-methods" >> cabal.project
+          echo "package hackage-root-tool" >> cabal.project
+          echo "    ghc-options: -Werror=missing-methods" >> cabal.project
+          echo "package hackage-repo-tool" >> cabal.project
+          echo "    ghc-options: -Werror=missing-methods" >> cabal.project
+          echo "package hackage-security-HTTP" >> cabal.project
+          echo "    ghc-options: -Werror=missing-methods" >> cabal.project
+          echo "package precompute-fileinfo" >> cabal.project
+          echo "    ghc-options: -Werror=missing-methods" >> cabal.project
           cat >> cabal.project <<EOF
           constraints: base-compat >= 0.12.2
           allow-newer: containers
           EOF
-          $HCPKG list --simple-output --names-only | perl -ne 'for (split /\s+/) { print "constraints: $_ installed\n" unless /^(example-client|hackage-repo-tool|hackage-root-tool|hackage-security|hackage-security-HTTP|hackage-security-curl|hackage-security-http-client)$/; }' >> cabal.project.local
+          $HCPKG list --simple-output --names-only | perl -ne 'for (split /\s+/) { print "constraints: $_ installed\n" unless /^(example-client|hackage-repo-tool|hackage-root-tool|hackage-security|hackage-security-HTTP|hackage-security-curl|hackage-security-http-client|precompute-fileinfo)$/; }' >> cabal.project.local
           cat cabal.project
           cat cabal.project.local
       - name: dump install plan
@@ -280,6 +276,8 @@ jobs:
           ${CABAL} -vnormal check
           cd ${PKGDIR_hackage_security_HTTP} || false
           ${CABAL} -vnormal check
+          cd ${PKGDIR_precompute_fileinfo} || false
+          ${CABAL} -vnormal check
       - name: haddock
         run: |
           if [ $((HCNUMVER >= 80600)) -ne 0 ] ; then $CABAL v2-haddock --disable-documentation --haddock-all $ARG_COMPILER --with-haddock $HADDOCK $ARG_TESTS $ARG_BENCH all ; fi
@@ -292,17 +290,17 @@ jobs:
           rm -f cabal.project.local
       - name: constraint set containers-0.7
         run: |
-          if [ $((HCNUMVER >= 80200 && HCNUMVER < 90800)) -ne 0 ] ; then $CABAL v2-build $ARG_COMPILER --enable-tests --disable-benchmarks --constraint='containers >= 0.7' all --dry-run ; fi
-          if [ $((HCNUMVER >= 80200 && HCNUMVER < 90800)) -ne 0 ] ; then cabal-plan topo | sort ; fi
-          if [ $((HCNUMVER >= 80200 && HCNUMVER < 90800)) -ne 0 ] ; then $CABAL v2-build $ARG_COMPILER --enable-tests --disable-benchmarks --constraint='containers >= 0.7' --dependencies-only -j2 all ; fi
-          if [ $((HCNUMVER >= 80200 && HCNUMVER < 90800)) -ne 0 ] ; then $CABAL v2-build $ARG_COMPILER --enable-tests --disable-benchmarks --constraint='containers >= 0.7' all ; fi
-          if [ $((HCNUMVER >= 80200 && HCNUMVER < 90800)) -ne 0 ] ; then $CABAL v2-test $ARG_COMPILER --enable-tests --disable-benchmarks --constraint='containers >= 0.7' all ; fi
+          if [ $((HCNUMVER < 90800)) -ne 0 ] ; then $CABAL v2-build $ARG_COMPILER --enable-tests --disable-benchmarks --constraint='containers >= 0.7' all --dry-run ; fi
+          if [ $((HCNUMVER < 90800)) -ne 0 ] ; then cabal-plan topo | sort ; fi
+          if [ $((HCNUMVER < 90800)) -ne 0 ] ; then $CABAL v2-build $ARG_COMPILER --enable-tests --disable-benchmarks --constraint='containers >= 0.7' --dependencies-only -j2 all ; fi
+          if [ $((HCNUMVER < 90800)) -ne 0 ] ; then $CABAL v2-build $ARG_COMPILER --enable-tests --disable-benchmarks --constraint='containers >= 0.7' all ; fi
+          if [ $((HCNUMVER < 90800)) -ne 0 ] ; then $CABAL v2-test $ARG_COMPILER --enable-tests --disable-benchmarks --constraint='containers >= 0.7' all ; fi
       - name: constraint set no-lukko
         run: |
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then $CABAL v2-build $ARG_COMPILER --disable-tests --disable-benchmarks --constraint='hackage-security -lukko' all --dry-run ; fi
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then cabal-plan topo | sort ; fi
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then $CABAL v2-build $ARG_COMPILER --disable-tests --disable-benchmarks --constraint='hackage-security -lukko' --dependencies-only -j2 all ; fi
-          if [ $((HCNUMVER >= 80200)) -ne 0 ] ; then $CABAL v2-build $ARG_COMPILER --disable-tests --disable-benchmarks --constraint='hackage-security -lukko' all ; fi
+          $CABAL v2-build $ARG_COMPILER --disable-tests --disable-benchmarks --constraint='hackage-security -lukko' all --dry-run
+          cabal-plan topo | sort
+          $CABAL v2-build $ARG_COMPILER --disable-tests --disable-benchmarks --constraint='hackage-security -lukko' --dependencies-only -j2 all
+          $CABAL v2-build $ARG_COMPILER --disable-tests --disable-benchmarks --constraint='hackage-security -lukko' all
       - name: save cache
         uses: actions/cache/save@v4
         if: always()