On Wed, Apr 2, 2014 at 12:22 PM, Herbert Valerio Riedel <hvr@gnu.org> wrote:

On 2014-04-01 at 22:43:47 +0200, Nikita Karetnikov wrote:
> Turns out cabal-install itself uses HTTP. (Try to grep for “hackage” in
> the source tree.) Is it due to the HTTP library, which doesn’t support
> HTTPS (4000.2.12 returns “user error (https not supported)”)?
>
> Is there any interest in changing the current state of things? And if
> so, what is the best way to do it? Would you like to switch to a
> different library?

The main problem is, that cabal-install tries to rely only on
HP packages; so for now HTTP is the only HTTP-library included
in the HP, maybe a good place to start would be

https://github.com/haskell/HTTP/issues/17

The big question we have to answer first is, how do we want to support SSL? Do we want to use an existing, well-tested, well scrutinized SSL implementation and FFI bind to it? If so, which one and why? If not, are we comfortable enough with writing a correct SSL implementation? That's very hard.