Why are cabal reinstalls "always dangerous"?

Question

When reinstalling a package using Cabal, one usually sees this warning:

Warning: Note that reinstalls are always dangerous. Continuing anyway...

What are some of the reasons behind this message?

Cowan

SICP, the canonical answer (especially the section on the pigeon-drop con). – Bodnar

Also the fact that you get this "warning", while it's doing/done the reinstall anyway. – Suzetta

And what's the point of telling me it's dangerous if you aren't going to give me an option to actually heed the warning and cancel it? – Orphanage

Answer 1

Currently, reinstalling a package means destructively overwriting an already installed package. If that old package has any reverse dependencies on the system, they'll no longer work.

To make this less likely, cabal-install checks the package databases it has access to when invoked for such reverse dependencies and lists them. In this situation, it requires --force-reinstalls to continue. But even if none reverse dependencies can be found, it does not mean there are none. It's possible there are additional package databases elsewhere on the system (for example, multiple user databases), or project directories that have been configured against the old version of the package that is to be overwritten. There's no way for cabal-install to be completely sure, that's why it warns that reinstalls are always dangerous.

Trigeminal

Are reinstalls always dangerous in a sandbox? – Appalachian

@SeanLeather Not quite as dangerous, so perhaps the output of cabal-install should be refined a bit. A reinstall in a sandbox can still break packages that use the sandbox (and sandboxes can be shared between several projects, although that's not all that common). But it can at least not break anything that isn't using the sandbox. – Trigeminal

So it's a matter scale then. The problem is still there; it's just that the damage is contained. And you can delete the sandbox if a problem occurs, whereas the global package database is more problematic. As for sharing a sandbox across packages, we are doing that. I'm not sure how common it is. – Appalachian