ffaf1

@ulysses4ever I wait for your feedback before putting a `merge me` label. If there is more I can do to make this granular I am ready to do it (or...

> Before we settle on depth: we should have a field study what different VCS have Sadly, most projects have switched to git. `darcs` has `--lazy`, I don't believe Mercurial...

> I don't think you want to abstract this detail. For git give depth, darcs give lazy, etc. I suspect fat/shallow is abstractable (“give me just enough to build this...

`cabal check` mimics Hackage's requirements; when Hackage will change its upload policy, `cabal check` will for sure warn about missing upper bound too.

Thanks for bringing this to our attention. Let me check how the whole process is set up, I will get back to you as soon as I have a proposal.

A way to introduce this could be by adding a `PackageDistSuspiciousWarn`: https://github.com/haskell/cabal/blob/af258612f5ddbaf0cb5805f896db6b001c35ce19/Cabal/src/Distribution/PackageDescription/Check.hs#L108-L110 If there is some consensus, I could check how this warning would impact people using `stack` and eventually...

On `hackage-server`, they are used here: https://github.com/haskell/hackage-server/blob/ae4f14e9d6c66bc0bcd6cd274eea280e0ea5ae25/src/Distribution/Server/Packages/Unpack.hs#L289-L296

Also notice how we already check for upper bounds in `setup-depends` https://github.com/haskell/cabal/blob/207d4ee08b929ae71ae2c746fe6da660bc129f05/Cabal/src/Distribution/PackageDescription/Check.hs#L2124-L2131 with `PackageDistInexcusable`.

Related: #5317 (opened in 2018).

I agree with “simple things first”. With the new and improved™ structured errors, a third party tool (e.g. ``stack``) can decide to ignore specific checks easily and reliably, so this...