Audit dependencies

[hasufell]

haskell-CI/haskell-ci#655 has sparked my motivation to remove all packages from the respective maintainer from the GHCup deptree.

So let's analyze first and get an overview.

Related: #1089

@jasagredo

[hasufell]

Affected dependencies (and their maintainers):

• aeson
  • AdamBergmark
  • BasVanDijk
  • BryanOSullivan
  • HerbertValerioRiedel
  • phadej
  • lyxia
• cabal-install-parsers
  • phadej
• cabal-plan
  • HerbertValerioRiedel
  • phadej
• cryptohash-sha256
  • AustinSeipp
  • HerbertValerioRiedel
  • phadej
• optics
  • AdamGundry
  • AndresLoeh
  • phadej
  • arybczak
• regex-posix
  • AndreasAbel
  • HerbertValerioRiedel
  • phadej
  • topos

---

I think the following dependencies could be swapped out:

• optics: migrate back to lens (but we use label optics)

The following dependencies will have to be forked or inlined:

• cabal-install-parsers
• cabal-plan (could even be dropped)

Unsure about the following dependencies:

• aeson: we actually need this because yaml uses aeson instances
• regex-posix: I don't know about any alternative off-hand
• cryptohash-sha256: there must be an alternative, but I haven't looked hard enough yet

[Kleidukos]

I wouldn't fret too much about optics, its maintenance is quite trustworthy.

cryptohash-sha256 is not easily replaceable because it's a pure Haskell implementation. If you need trustworthy maintenance, sel is guaranteed to have responsible and responsive maintainers.

[hasufell]

cryptohash-sha256 is not easily replaceable because it's a pure Haskell implementation

I found two:

• https://hackage.haskell.org/package/SHA
• https://hackage.haskell.org/package/hashing

They both seem to be Haskell.

[Kleidukos]

SHA's last commit was 6 years ago, hashing's last commit was from 2 years ago. None of them have CI.

[hasufell]

SHA's last commit was 6 years ago, hashing's last commit was from 2 years ago. None of them have CI.

SHA was developed by Galois. I don't know how much maintenance does a SHA256 algorithm really need.