Allow users to choose between safe/unsafe/both

[edsko]

The choice between safe and unsafe is not really something the tool can make on behalf of the user, though in the absence of any configuration, safe should be the default. There are also examples where we want to make two bindings (one safe and one unsafe) to the same C function; for example, see cryptohash (where the choice between the two is based on input size, though this is of course not directly relevant to hs-bindgen).

[edsko]

One option here might be to follow the Vulkan bindings, and generate two modules .Safe and .Unsafe, so that programmers can just import the module they want. (Somewhat related: #75).

[phadej]

One option here might be to follow the Vulkan bindings, and generate two modules .Safe and .Unsafe

That will be terrible for interfaces with structs.

[edsko]

Yes, this will certainly not be a good option in all cases.