Make lukko flag default to off.

[a-02]

Based on discussions from haskell/cabal#10724, which was spurred by the comment here: haskellari/lukko#39 (comment)

[Mikolaj]

I was thinking we could start by flipping the flag in cabal, as the main user of hackage-security. However, this PR is a sensible second step. Or am I missing something?

[andreasabel]

Note that so far we have a commented-out line turning off lukko in the project file:

hackage-security/cabal.project

Line 15 in d160ca4

-- constraints: hackage-security -lukko

This PR should also touch this line. Probably it makes sense to just delete it.

[a-02]

I think I just misunderstood the ask from the dev meeting on Thursday. I can make the PR to set the lukko flag to off in cabal and get that done first before this.

[Bodigrim]

I was thinking we could start by flipping the flag in cabal, as the main user of hackage-security.

You can flip it in cabal.project of Cabal, but it would not meaningfully help anyone who relies on Hackage source distribution. E. g., Stackage will still be in trouble if lukko is not updated in time.

However, this PR is a sensible second step.

One possibility is to keep default: True but set manual: False. In which case the solver will keep using lukko if available in current configuration but will flip the flag automatically and switch to base otherwise.

[Mikolaj]

@Bodigrim: see haskell/cabal#10724 (comment)

[Bodigrim]

@Mikolaj @andreasabel what's the status of this? Could we please get it merged?

[Mikolaj]

I'm sorry I've read the comment chain one time too many and now I'm confused. Weren't we supposed to change the flag first in cabal (I don't think we did; did we?) and only then, after some time, in hackage-security? See haskell/cabal#10724 (comment), unless we've developed a better deprecation plan since then. Did we?

[Bodigrim]

You do you, but I think all this "developing a deprecation plan" is greatly overcomplicated. What's wrong with simply switching the flag in hackage-security? If you want to be super duper extra safe, both switch the default value and mark the flag as automatic, so that it can be switched back via a Hackage revision.

[Mikolaj]

It's all about incentives. If anybody is keen enough to see this change through quickly and would like to take responsibility for the change process, patching and reverting as needed, I'm more than happy to assist in enacting the fast plan and then cleaning up the fallout.

By default, the cabal/hackage-security team is conservative, though.

[Bodigrim]

Count me keen enough then :)

@a-02 could you please make the flag both automatic manual: False and disabled default: False? Making it automatic would allow me to switch it back by revision, if anything unforeseen happens.

[Mikolaj]

Great! Let's do it!

[a-02]

You got it, now its set to False in both fields.

[Mikolaj]

Could you also please rebase? Maybe then Ci failures would vanish...

[Bodigrim]

@Mikolaj good to go? CI is green now.

[Mikolaj]

Yes, LGTM. Rebasing and merging.