cabal-install dependency confusion

# `cabal-install` dependency confusion

For **cabal-install < 3.4.0.0** and where multiple repositories are
configured, the resolver picks the highest available version across
all repositories. Where a package is only defined in a private
repository, this behaviour leads to a [*dependency confusion*][blog]
supply chain vulnerability. If the private package name becomes
known, a malicious actor can claim the name in the public repository
and publish a malicious version at a higher version number.

Default `cabal-install` configurations that only use the
`hackage.haskell.org` repository are not affected. Configurations
that use curated private repositories **exclusively** are also not
affected.

[blog]: https://frasertweedale.github.io/blog-fp/posts/2021-02-12-haskell-dependency-confusion.html

## Mitigations

*cabal-install* version **3.4.0.0** and higher provide an `override`
option in the repository configuration. It marks the associated
repository as canonical for all packages defined in that repository.
No other repositories will be considered. For example:

```
-- For packages in repo.example.com,
-- only versions in repo.example.com are considered
active-repositories:
, hackage.haskell.org
, repo.example.com:override
```

Users and organisations using private repositories that contain
private packages in addition to public repositories **MUST** use the
`override` option to prevent dependency confusion attacks.

Alternatively, projects and organisations can run a private instance
of *hackage-server* and carefully curate and review its contents.
Using that instance exclusively defeats supply chain attacks
including *dependency confusion*. For *cabal-install < 3.4* and
where using multiple repositories, this is the only effective
mitigation against dependency confusion attacks.