Change dhall freeze to refreeze imports

[Gabriella439]

Fixes: #630

dhall freeze will now ignore the hash on existing imports and attempt to
refreeze them

[Profpatsch]

Uuh, I don’t think that is a good idea. My intuition tells me an action like freeze should be “locally idempotent” by default, and require an option like freeze --update to query for existing frozen dependencies (comparable to stateful package managers never updating pinned packages without explicit user consent).

If I add some import to my code and run dhall freeze, I’d expect it to not touch my existing frozen imports and only freeze the unfrozen ones.

[Gabriella439]

@Profpatsch: How about updating them if import resolution fails (i.e. the semantic integrity check is for the wrong version)?

[Gabriella439]

I added support so that dhall refreeze will only update a semantic integrity check if the check fails to resolve

[Profpatsch]

Hm, it might be good if the tool also prints a warning if the hashsums don’t match. This would point to an issue with upstream (e.g. because the link points to a moving target).

On second thought, I can’t imagine a situation in which mismatching hashes don’t point to a problem. So it might be best to collect the list and print an error like this:

The upstream of these imports has changed from their local integrity checks:
<list of import URLs with their line numbers>

<something about using unchanging URLs here>

Once you are sure the links are correct, run `dhall refreeze --force` and I will update all existing integrity checks.

[Gabriella439]

@Profpatsch: I support the idea of listing the hash mismatches as it refreezes them.

I'm not as sure that we need the user to supply a --force flag to confirm the change, for two reasons:

• It's not clear when the user would want to preserve broken hashes
• I presume the user is using version control so that they can roll back changes if they make a mistake