StateVar-1.1.0.4:Data.StateVar can't be safely imported! The module itself isn't safe.

[TheThirdOne]

I got the following error when running cabal install contravariant-1.4

Resolving dependencies...
cabal: Entering directory '/tmp/cabal-tmp-8231/contravariant-1.4'
Configuring contravariant-1.4...
Building contravariant-1.4...
Preprocessing library contravariant-1.4...
[1 of 4] Compiling Data.Functor.Contravariant ( src/Data/Functor/Contravariant.hs, dist/build/Data/Functor/Contravariant.o )

src/Data/Functor/Contravariant.hs:111:1:
    StateVar-1.1.0.4:Data.StateVar can't be safely imported! The module itself isn't safe.
cabal: Leaving directory '/tmp/cabal-tmp-8231/contravariant-1.4'
Failed to install contravariant-1.4
cabal: Error: some packages failed to install:
contravariant-1.4 failed during the building phase. The exception was:
ExitFailure 1

It seems that this is similar to #3, and might be a simple fix that would make the project more stable (in terms of installation).

GHC Version: 7.4.1 Cabal Version: 1.24.0.2

[glguy]

Is this something that changed between 7.4.1 and 7.4.2? Travis builds contravariant-1.4 and StateVar-1.1.0.4 together using GHC 7.4.2

https://travis-ci.org/ekmett/contravariant/jobs/220776830

[ekmett]

I don't have a copy of GHC 7.4.1 to test with, which will make this rather difficult to test.

[ekmett]

If you aren't going to use StateVar, you can always get this limping along with

    cabal install contravariant -f-StateVar

for now.

[ekmett]

If looks like some of the modules Data.StateVar depends upon in base were explicitly tagged Safe in the move to 7.4.2. That's really annoying.

[ekmett]

Okay, that's not it.

Data.IORef, Data.Typeable, Foreign.Ptr and Foreign.Storable` are all Trustworthy in base 4.5.0.0 which is what shipped with 7.4.1

[RyanGlScott]

Indeed, I managed to install contravariant-1.4 with GHC 7.4.1 (and depending on StateVar-1.1.0.4) without any issues.

Can you run cabal install contravariant-1.4 -v2 so that we can determine which dependencies you're using?

[ekmett]

On the other hand stm-2.2.0.0 isn't flagged Safe and that is a dependency here.

[ekmett]

You're likely running into a very untested set of messy dependencies. Unfortunately due to the absolutely terrible design of the warning system for SafeHaskell there isn't a way for me to spackle over all of these holes without omniscience or warnings.

[ekmett]

We could normally patch StateVar to claim Trustworthy for a narrow band of STM releases. Unfortunately, someone released 2.2.0.1 with the fix rather than 2.2.1, violating the intent of the PVP, and if we try to explicitly exclude just that one broken version using cabal version bounds then everything that transitively depends on this package will get a branch in the backtracking scheme, which will break a huge number of users of packages downstream, including probably you, since 7.4.1 will be old enough to be using a buggy old version of Cabal where such branches are dangerous.

[ekmett]

Moving forward I can fix this so that new versons of StateVar won't accept anything below 2.2.0.1 for stm, which will at least keep it from running into this problem, but such new versions won't be of any use to you on that compiler without installing an updated stm.

[ekmett]

I'd recommend doing one of:

• updating to at least the final point release of ghc 7.4,
• downloading the source to StateVar with cabal unpack StateVar-1.1.0.4 and adding the {-# LANGUAGE Trustworthy #-} line to the top of the source file, and compiling it by hand
• upgrading stm by hand

One of those will get you out of this rut.

That's I think all we can offer at this point.