Network access required during compilation

[ezzieyguywuf]

The way elm is setup, it requires network access during the installation. This is made evident when trying to package elm using a system that sandboxes the network access, such as gentoo's portage.

To reproduce the error:

wget https://github.com/elm/compiler/archive/0.19.1.tar.gz
tar xvf 0.19.1.tar.gz
# disconnect network somehow
cabal build

I've been able to narrow down the issue to these few lines of code, however I'm not well-versed enough in Template Haskell to figure out what is going on.

Is it possible to modify the build so that it can complete without network access?

[github-actions]

Thanks for reporting this! To set expectations:

• Issues are reviewed in batches, so it can take some time to get a response.
• Ask questions a community forum. You will get an answer quicker that way!
• If you experience something similar, open a new issue. We like duplicates.

Finally, please be patient with the core team. They are trying their best with limited resources.

[razzeee]

You will need to grab dependencies at some point, but you can just use the cache after that.

[ezzieyguywuf]

@razzeee thank you for your response!

I agree that network access at some point is definitely reasonable, but I need to be able to control when that access occurs.

Can you give me any information on precisely what dependencies are needed, and where I can fetch them from?

[r-k-b]

Elm has been added to nixpkgs. Nix packages must be built deterministically (no unexpected network requests), so that implementation might provide some insight?

[ezzieyguywuf]

Thank you for the hint I will take a look at nixpkgs. El jue., 24 de diciembre de 2020 3:20 a. m., Robert K. Bell < notifications@github.com> escribió:

…

Elm has been added to nixpkgs. <https://github.com/NixOS/nixpkgs/tree/master/pkgs/development/compilers/elm> Nix packages must be built deterministically (no unexpected network requests), so that implementation might provide some insight? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#2160 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAEMB5HNERDBUXAS5RAARATSWL2T3ANCNFSM4VGNYRWA> .

[evancz]

The network access is needed to build the UI for elm reactor which is written in Elm. So the couple lines you mention are basically calling elm make and making sure any dependencies for the UI are present.

[ezzieyguywuf]

I think this is the relevant snippet from the nix pkg that I need to implement in the gentoo ebuild.

I'm not familiar with elm make, so please correct me if my thinking is off here - generally, though, I expect for a piece of software to be fully installable given the data provided in the release tarball.

In this case, though, network access in required in order to fetch additional resources.

Is there a reason these can't ship with the release tarball?

[hololeap]

Hi. Another Gentoo-Haskell developer here, and also an Elm novice... The problem we are running into is that Gentoo's build system (portage) does not allow network access by default during compile time. There is a specific phase in the installation process that is allowed to download needed files, but after that network access is blocked off for security purposes.

Frankly, it's pretty unusual to have a package try to make network connections during the compile phase, and this is doubly true for a Haskell package that is using TH to make network calls.

I understand the need to have a fresh list of Elm packages, but doing this during compile time is causing us issues. Would it be possible for you to change this so it updates the list of packages after compilation, perhaps on first run?

Another option would be to make the current set of Elm packages available in a tarball so the "fetch" phase could grab them before compilation.

We would be happy to work with you to find a reasonable solution, but currently we have to make users disable the network sandbox for this package.

I need the list of published packages to verify your dependencies, so I tried to                                      
fetch:                                                                                                                
                                                                                                                                                                                                                                            
    https://package.elm-lang.org/all-packages                                                                                                                                                                                               
                                                                                                                      
But my HTTP library is giving me the following error message:                                                                                                                                                                               
                                                                                                                      
    ConnectionFailure Network.Socket.getAddrInfo (called with preferred socket type/protocol: AddrInfo {addrFlags = [AI_ADDRCONFIG], addrFamily = AF_UNSPEC, addrSocketType = Stream, addrProtocol = 0, addrAddress = 0.0.0.0:0, addrCanonNa
me = Nothing}, host name: Just "package.elm-lang.org", service name: Just "443"): does not exist (Temporary failure in name resolution)                                                                                                     
                                                                                                                                                                                                                                            
Are you somewhere with a slow internet connection? Or no internet? Does the link                                                                                                                                                            
I am trying to fetch work in your browser? Maybe the site is down? Does your                                          
internet connection have a firewall that blocks certain domains? It is usually                                                                                                                                                              
something like that!