Specify remote repository target with cabal upload

[ezyang]

If you have multiple remote repositories, it might be convenient to call out specifically which one you want to upload to. Right now, we always take the "last" repository listed.

This is not urgent because you can always upload the tarball by hand.

[ezyang]

Something that makes this a little more urgent is that the web UI for uploading Haddock documentation is a bit inconvenient: after manually making the local documentation, you have to gunzip it before uploading via the web UI.

[ezyang]

Also, a simpler but still useful thing to fix, would be for upload to tell you WHERE you're uploading the tarball to.

[mitchellwrosen]

@ezyang Would you mind explaining how to upload a tarball by hand? Or point me at some relevant documentation? Thanks!

Edit: Oh, I see there's an "Upload" button in the hackage UI itself. Is that what you were referring to?

[nomeata]

I am also bit by this. In fact, I didn’t even realize that cabal upload broke because I have a repository configured in ~/.cabal/config.

This is actually a security issue: If I tell someone to add my repository to their config (which I have…), I could get the password the server there.

So when asking for the password, cabal really should tell the user for which server it wants the password!

[gbaz]

I believe cabal enforces digest auth, which means that the password is not recoverable from such an attack. We should improve the situation anyway. Perhaps even a setting for default upload repo distinct from the main package repo setting?

[peti]

This feature is very much needed, IMHO. cabal update takes the name of the repository as an argument, too, and so should upload.

[ezyang]

@mitchellwrosen yes