hkgreg

Documentation

Overview

Package hkgreg asks Hackage what it knows about the Haskell packages a diff touches (stack.yaml.lock and cabal.project.freeze pin Hackage releases). deps.dev has no Hackage system at all, so — like Packagist, hex.pm, pub.dev and CRAN before it — this package IS the metadata layer for Haskell, not a fallback:

• Release ages and the ⏱ cooldown flag, from the per-version upload-time endpoint (hackage.haskell.org is the canonical registry, so timestamps are authoritative, not mirrored).
• Deprecated packages from Hackage's registry-wide deprecation list, including the maintainer's suggested replacements (cryptonite → crypton and friends), land in the deprecation lane.
• Deprecated *versions* (Hackage's preferred-versions mechanism — its yank equivalent; the tarball stays but solvers avoid it) land in the same lane.
• Unlisted detection: Hackage never deletes versions — deprecated ones stay in the package's version map — so a version absent from the map while the package IS known is real evidence (admin removals and malicious uploads look exactly like this). Absence is re-proven with an uncached fetch before any claim, so a same-hour release can never be flagged off a stale cache.
• The upstream source repository from the release's .cabal file (source-repository head, with homepage as fallback), which the changelog layers turn into verified compare links and release notes.

License-change detection is honestly skipped: Hackage's per-version license metadata uses SPDX for new uploads but legacy identifiers historically, and the .cabal-per-version fetches to compare both sides would double the request budget for a signal that is noisy across the cabal-license-format migration.

hackage.haskell.org sends no CORS headers, so the browser (wasm) playground skips this layer; the native CLI is unaffected.

Index

• Variables
• func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)
• func Latest(name string) (string, error)

Variables

var BaseURL = "https://hackage.haskell.org"

BaseURL is the Hackage server; a var so tests can fake it.

var Enabled = true

Enabled gates the whole layer; the wasm playground sets it false (no CORS on hackage.haskell.org).

var Now = time.Now

Now is a var so tests can pin the clock.

Functions

func Annotate

func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)

Annotate fills Hackage metadata on the diffs; see the package comment for what it covers. The returned bool reports whether at least one package was actually vetted against Hackage (deps.dev never covers Hackage, so this decides whether release metadata was checked at all for Haskell). freshDays mirrors -fresh-days. Best-effort: per-package failures skip that package; only total failure returns an error.

func Latest

func Latest(name string) (string, error)

Latest returns the current preferred Hackage release of name, for `lockvet pkg hackage:<name>` — the highest version not marked deprecated/unpreferred.