Automic VaultAutomic Vault

brew

hpack mit Homebrew, apt, Nix installieren

Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für hpack in AI-Agent-Workflows.

Installation

Weitere Installationsbefehle

macOS

Homebrewverifiziert · 100%
brew install hpack

local Homebrew formula metadata

Überblick

Paketzusammenfassung

Modern format for Haskell packages

Befehle und Aliase

  • hpack

Verlauf

Projektgeschichte und Nutzung

hpack is a Haskell packaging tool and package-description format built around `package.yaml`. It generates Cabal files while trying to reduce repetition and make common package metadata less verbose.

Projektgeschichte

Simon Hengel's hpack appeared on Hackage in April 2015 with version 0.1.0. The project README describes it as a modern alternative to the Cabal package format, guided by three principles: infer obvious information, give users control when needed, and avoid repeating metadata.

hpack developed alongside Cabal rather than replacing it. The executable reads `package.yaml` and renders a `.cabal` file, while its changelog tracks years of Cabal compatibility work: SPDX license handling, generated module behavior, internal libraries, `build-tool-depends`, Cabal version inference, and support for newer GHC and Cabal releases.

Adoptionsgeschichte

The README documents native `package.yaml` support in Stack and cabal2nix, while Hackage lists reverse dependencies including stack, pantry, cabal2nix, stack2cabal, stack-lib, and stackage2nix. That places hpack in the machinery around Haskell project templates, Stackage snapshots, and Nix conversion.

Homebrew, Hackage, Stackage, and Linux distribution packaging make hpack available both as a Haskell library/program and as a standalone CLI. Its adoption is tied to `package.yaml` becoming a common Haskell project file, especially in Stack-oriented projects.

Wie es verwendet wird

Users write package metadata in `package.yaml`. Stack can consume that file directly, cabal2nix supports it natively, and other workflows can run `hpack` to generate the `.cabal` file before building.

hpack also supports practical package-authoring features such as defaults files, globbing, verbatim Cabal fields, generated module controls, common fields, conditionals, executables, tests, benchmarks, and dependency syntax intended to keep package descriptions maintainable.

Warum Paket-Nerds sich dafür interessieren

hpack is important because it sits at the contested boundary between package metadata as a human-maintained source file and package metadata as generated build-tool input. Package nerds care about that boundary: generated `.cabal` files can reduce repetition, but they also introduce questions about source-of-truth, reproducibility, diffs, and downstream tooling.

Its long changelog is also a miniature history of Haskell packaging pressure points, from SPDX licenses and Cabal version syntax to generated modules and compatibility with Stack, Stackage, Nix, and newer Cabal releases.

Zeitleiste

  • 2015: Hackage records hpack 0.1.0 uploaded by Simon Hengel.
  • 0.18.0: The changelog adds command-line input-file handling and executable shorthand.
  • 0.29.0: The changelog adds Cabal 2.1/2.2-related rendering and SPDX license handling.
  • 0.36.0: The changelog changes `Paths_` module inference for package specs using spec-version 0.36.0 or later.
  • 2026: Hackage records hpack 0.39.6, adding top-level `codeberg` support.

Related projects

  • Cabal is the package format and build-tool ecosystem that hpack generates into.
  • Stack has built-in support for hpack's `package.yaml` workflow.
  • cabal2nix supports `package.yaml` natively, connecting hpack to Nix packaging workflows.
  • Stackage-related tools such as pantry, stack2cabal, stack-lib, and stackage2nix appear in Hackage reverse-dependency metadata.

Sicherheitslage

Risikostufe: grün

narrow executable package without higher-risk signals.

Risikoklassifikator

grün Risiko · niedrig Konfidenz · appliance

Warum

  • narrow executable package without higher-risk signals

Signale

  • metadata:no-higher-risk-signals

Installationsverhalten

  • In den Formelmetadaten ist kein Homebrew-Post-install-Hook erfasst.
  • Homebrew-Bottle-Metadaten sind für 6 Plattformziele verfügbar.
  • Installiert mit 1 Laufzeitabhängigkeiten.
  • Build-Metadaten listen 2 Build-Abhängigkeiten.

Empfohlene Prüfung

Prüfe vor unbeaufsichtigter Agent-Nutzung, ob das Tool Klartext-Credentials liest, Remote-Zustand schreibt, Artefakte veröffentlicht oder Plugins ausführt.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix
package.yaml

Executables

Installierte Executables

BefehlArtSichtbarkeitHinweis
hpackcliglobales Executable

Aktualität

Version und Aktualität

Diese Signale trennen das Alter der Seitengenerierung, Aktivität des Paketmanagers und Upstream-Release-Vergleich. Versionsrückstand wird nur gemeldet, wenn eine Evidenz-URL und vergleichbare Versionen vorhanden sind.

Seite generiert2026-07-25
Manager-Version0.39.6
Manager aktualisiert2026-07-22
lokale DatenOK
Upstreamnot checked
neueste erkannte Versionnicht erkannt

https://github.com/sol/hpack

Installationsmetadaten

Paketmetadaten

Paketschlüsselbrew:hpack
Version0.39.6
PaketmanagerHomebrew
Paketmanager-Seitehttps://formulae.brew.sh/formula/hpack
Homepagehttps://github.com/sol/hpack
Repositoryhttps://github.com/sol/hpack
Upstream-Dokumentationhttps://github.com/sol/hpack#readme
LizenzMIT
Quellarchivhttps://hackage.haskell.org/package/hpack-0.39.6/hpack-0.39.6.tar.gz
Zuletzt aktualisiert2026-07-22T03:24:33Z
Pulseupdated
Abhängigkeitengmp
Build-Abhängigkeitencabal-install, ghc
Von macOS bereitgestellte Bibliothekenlibffi
Bottleverfügbar (auf arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnicht definiert
Dienstkeiner deklariert

Registry-Fakten

Details aus der Quelldatenbank

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namehpack
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

Source-Datenbank-Treffer

Andere Paketmanager-Einträge

Treffer stammen aus externen Paketmanager-Indizes und bleiben von lokalen Automic-Vault-Paketlinks getrennt.

Debian apt95%

hpack 0.36.1-1+b1

alternative format for Haskell packages

https://github.com/sol/hpack#readme

sudo apt install hpack
  • Section: haskell
  • Architecture: amd64
  • Source Package: haskell-hpack
  • 6 Abhängigkeiten
  • normalized package name match
  • Abgeglichen nach: Hpack
Debian stable package indexes · deb.debian.org · Debian stable package indexes: hpack from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
Nix95%

hpack

nix profile install nixpkgs#hpack
  • normalized package name match
  • Abgeglichen nach: Hpack
nixpkgs package indexes · raw.githubusercontent.com · nixpkgs package indexes: hpack from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix
Ubuntu apt95%

hpack 0.35.2-1

alternative format for Haskell packages

https://github.com/sol/hpack#readme

sudo apt install hpack
  • Section: universe/haskell
  • Architecture: amd64
  • Source Package: haskell-hpack
  • 5 Abhängigkeiten
  • normalized package name match
  • Abgeglichen nach: Hpack
Ubuntu 24.04 LTS package indexes · archive.ubuntu.com · Ubuntu 24.04 LTS package indexes: hpack from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz

Quellspur

Aus Repository-Daten generiert

Diese Seite wird von av-web aus dem privaten Paket-SQLite-Artefakt bereitgestellt, das scripts/generate-pkg-sqlite.py erstellt.

Verwendete Quellen

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated configuration and credential file locations
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment