Missing extra-deps not always detected

[mboes]

Consider:

stack.yaml:

packages:
- .
resolver: nightly-2015-06-12
extra-deps:
- rematch-0.2.0.0

b.cabal:

name:                b
version:             0.1.0.0
build-type:          Simple
cabal-version:       >=1.10

library
  build-depends:       base, rematch >= 0.2
  default-language:    Haskell2010

The compilation succeeds, as it should. However, try removing the extra-deps: field entirely. The compilation will still succeed after the first one succeeded. That's the bug: it should not succeed in that case. Because if building from a fresh state it will not succeed.

IOW, this is a case of the outcome of stack build depending on hidden internal stack state, when the outcome should depend exclusively on the content of stack.yaml and the source files.

[snoyberg]

We have to be careful here. For example, we purposely do allow packages in the global database like Win32 to be included in the build even though they aren't in the snapshot. Perhaps the correct behavior is to only allow un-whitelisted packages from the global database (which we don't have control of). Thoughts?

[snoyberg]

@mboes Confirmed?