GNU bug report logs - #66347
GHC packages inputs leak in guix shell

Message received at submit <at> debbugs.gnu.org:

Received: (at submit) by debbugs.gnu.org; 4 Oct 2023 18:32:51 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Wed Oct 04 14:32:51 2023
Received: from localhost ([127.0.0.1]:45353 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1qo6fy-0005TC-Ot
	for submit <at> debbugs.gnu.org; Wed, 04 Oct 2023 14:32:51 -0400
Received: from lists.gnu.org ([2001:470:142::17]:47976)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <zimon.toutoune@HIDDEN>) id 1qo6fw-0005Sy-W9
 for submit <at> debbugs.gnu.org; Wed, 04 Oct 2023 14:32:49 -0400
Received: from eggs.gnu.org ([2001:470:142:3::10])
 by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <zimon.toutoune@HIDDEN>)
 id 1qo6fS-0008HV-6v
 for bug-guix@HIDDEN; Wed, 04 Oct 2023 14:32:22 -0400
Received: from mail-wm1-x32b.google.com ([2a00:1450:4864:20::32b])
 by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)
 (Exim 4.90_1) (envelope-from <zimon.toutoune@HIDDEN>)
 id 1qo6fM-0007PY-8u
 for bug-guix@HIDDEN; Wed, 04 Oct 2023 14:32:17 -0400
Received: by mail-wm1-x32b.google.com with SMTP id
 5b1f17b1804b1-406532c49dcso280295e9.0
 for <bug-guix@HIDDEN>; Wed, 04 Oct 2023 11:32:11 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1696444330; x=1697049130; darn=gnu.org;
 h=mime-version:message-id:date:references:subject:to:from:from:to:cc
 :subject:date:message-id:reply-to;
 bh=swNBjaXgCEhe9TrRyuaf4qYQOXjT/kmdsL5KkW58Wis=;
 b=R1ckMz7wa9x5EPpu7bodL7QWn7mxwtI+2w/3K92uZ+5IO/t8cQECqSIIryKkj0eyAm
 i/Yy1iTFPNp9woWLStzkIzrojL/JLIeWJsGsaKqlD2XNVMIBJDDKmQ2FYus9B/+x4cLM
 IJI0SAGtOGvVv6vryVvIKgUleOyqfWjy2SfBI6TWlWsdYuGk5n0hiohqAJRqxMhKqnL/
 WYbtPPYdNWO5BNs6KLErst1FSSU5W6PXTwNI59GzJ9PiAUWIKdfzzLZql4E6EKMr3jI4
 HiUQVHC3Vlorqfub1v9NFztpB5ZpQkhiFRP2ZYJvq45TpcuLAS+q6JyrQYCMmG3f7tEU
 0zQg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1696444330; x=1697049130;
 h=mime-version:message-id:date:references:subject:to:from
 :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
 bh=swNBjaXgCEhe9TrRyuaf4qYQOXjT/kmdsL5KkW58Wis=;
 b=r9Zk5F1LXRy0PMYQvCTfJzXsMLHExMJDcIKnpjZvYlHCFGLnlJM3IzSdyoz1ebTzge
 LlabmetQbbJGE+Gz9SJTxwcVw8TAMyokcF1Vhq3QBFyHg89r+uQRbDawyIgaejjkF28W
 N3m/zZVZOEVO2xphL/jxOby8Lnq2W3ZvOObwL+l89VAbRDBSAFvHmtfFX6NR5Z+S4/x+
 c+E5UjCD9dDofD51vv+6hI7aDo8/p9j5goLyGTRSdVbL0xPVKLiHQimoE2spWPphtMn/
 WPMbbhy3rZwSatiQt3Ju67aZ7k0C68PVDU8XZ2Ld8/4Qway69+x+IpY5GSBLtKvhtFvu
 FDpg==
X-Gm-Message-State: AOJu0YyCkfNvenf/oQc7pNs43BODrK+BtAFnJIM4G6yEHhhWIn5WtPEE
 gRxqG8H2Tfaq2srPbWb4BbhiyblJJvQ=
X-Google-Smtp-Source: AGHT+IG6sFrrXS5Ib7v8STIhyLEK/hm+3Ijgi9AoMAxKB9qXoFUGygjyr2K1Yv6jGCMK2KNQ0sXCBw==
X-Received: by 2002:a5d:5707:0:b0:323:2e5d:b7c6 with SMTP id
 a7-20020a5d5707000000b003232e5db7c6mr2792123wrv.0.1696444330448; 
 Wed, 04 Oct 2023 11:32:10 -0700 (PDT)
Received: from pfiuh07 ([193.48.40.241]) by smtp.gmail.com with ESMTPSA id
 y9-20020a5d4ac9000000b0030ada01ca78sm4567551wrs.10.2023.10.04.11.32.10
 for <bug-guix@HIDDEN>
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Wed, 04 Oct 2023 11:32:10 -0700 (PDT)
From: Simon Tournier <zimon.toutoune@HIDDEN>
To: bug-guix@HIDDEN
Subject: GHC packages inputs leak in guix shell
References: <p4jjdigofugtd66rsmq336z2obcj3jfbrbeiui7jitr37czyyc@s3ueljv5sroe>
Date: Wed, 04 Oct 2023 20:26:29 +0200
Message-ID: <87jzs2z1ka.fsf@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain
Received-SPF: pass client-ip=2a00:1450:4864:20::32b;
 envelope-from=zimon.toutoune@HIDDEN; helo=mail-wm1-x32b.google.com
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001,
 RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: submit
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -0.0 (/)

Hi,

Consider this:

--8<---------------cut here---------------start------------->8---
$ guix shell -C ghc-esqueleto ghc gcc-toolchain -- ghci
GHCi, version 9.2.5: https://www.haskell.org/ghc/  :? for help
ghci> import Data.ByteString.Base64.URL.Lazy
ghci> :t encode
encode
  :: Data.ByteString.Lazy.Internal.ByteString
     -> Data.ByteString.Lazy.Internal.ByteString
--8<---------------cut here---------------end--------------->8---

The package ghc-base64-bytestring should not be visible and instead, the
user should see:

    <no location info>: error:
        Could not find module `Data.ByteString.Base64.URL.Lazy'
        It is not a module in the current program, or in any known package.

See discussion for more details if needed.

        GHC packages' inputs leak in guix shell
        Saku Laesvuori <saku@HIDDEN>
        Tue, 15 Aug 2023 09:51:50 +0300
        id:20230815065150.5joaxyts646mnpex@X-kone
        https://lists.gnu.org/archive/html/help-guix/2023-08
        https://yhetil.org/guix/20230815065150.5joaxyts646mnpex@X-kone


As reported in the discussion above, cabal is not exposing the package
required as dependency.

--8<---------------cut here---------------start------------->8---
$ guix shell -CN cabal-install coreutils zlib -D ghc-old-time
$ cabal update
$ env -u GHC_PACKAGE_PATH cabal install --lib esqueleto
$ ghci
ghci> import Database.Esqueleto.Experimental
ghci> :t encode

<interactive>:1:1: error: Variable not in scope: encode
ghci> import Data.ByteString.Base64.URL.Lazy

<no location info>: error:
    Could not load module `Data.ByteString.Base64.URL.Lazy'
    It is a member of the hidden package `base64-bytestring-1.2.1.0'.
    You can run `:set -package base64-bytestring' to expose it.
    (Note: this unloads all the modules in the current scope.)
--8<---------------cut here---------------end--------------->8---


Cheers,
simon