Errors downloading packages from Hackage in CI job on Github
Hi, My Github actions have been failing all day with messages like: Unexpected response 404for http://objects-us-east-1.dream.io/hackage-mirror/package/StateVar-1.2.2.tar.... Error: Process completed with exit code 1. It's not always the same package. If I keep insisting, they may eventually succeed, but it can take dozens of attempts over several hours. Is this a problem of Github or Hackage? Thanks, Ivan
Github, and it happens with pretty much any site and has been getting steadily worse over the past year or so. I'm pretty sure they're throttling the free tier pretty severely at this point. On Thu, Aug 13, 2026 at 2:17 AM Ivan Perez <ivanperezdominguez@gmail.com> wrote:
Hi,
My Github actions have been failing all day with messages like:
Unexpected response 404for
http://objects-us-east-1.dream.io/hackage-mirror/package/StateVar-1.2.2.tar....
Error: Process completed with exit code 1.
It's not always the same package. If I keep insisting, they may eventually succeed, but it can take dozens of attempts over several hours.
Is this a problem of Github or Hackage?
Thanks,
Ivan
_______________________________________________ Haskell-Cafe mailing list -- haskell-cafe@haskell.org To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
-- brandon s allbery kf8nh allbery.b@gmail.com
On Wed, Aug 12, 2026 at 11:16:18PM -0700, Ivan Perez wrote:
Unexpected response 404for http://objects-us-east-1.dream.io/hackage-mirror/package/StateVar-1.2.2.tar....
Error: Process completed with exit code 1.
Is this a problem of Github or Hackage?
Looks like a problem accessing that specific Hackage mirror.
It keeps happening. Is there's a way to select a different hackage mirror? Ivan On Thu, 13 Aug 2026 at 00:45, Tom Ellis < tom-lists-haskell-cafe-2026@jaguarpaw.co.uk> wrote:
On Wed, Aug 12, 2026 at 11:16:18PM -0700, Ivan Perez wrote:
Unexpected response 404for
http://objects-us-east-1.dream.io/hackage-mirror/package/StateVar-1.2.2.tar....
Error: Process completed with exit code 1.
Is this a problem of Github or Hackage?
Looks like a problem accessing that specific Hackage mirror. _______________________________________________ Haskell-Cafe mailing list -- haskell-cafe@haskell.org To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
I can describe some of the problems at hand. I'm gonna leave some blanks because I'm not an expert on Cabal or Hackage. Maybe somebody else can fill them in. # 1. https://hackage.haskell.org/mirrors.json lists two mirrors. Neither of them work. ## 1.A. Some infrastructure change has recently caused hackage.fpcomplete.com (which is an AWS S3 bucket behind the scenes) to start returning 403s. I'm asking my contacts if that's expected. It may just be time to retire that mirror. ## 1.B. dream.io changed their URL schema. The new path should be https://s3.us-east-005.dream.io, e.g. https://s3.us-east-005.dream.io/hackage-mirror/package/StateVar-1.2.2.tar.gz . This has been fixed in the DNS TXT entry for _mirrors.hackage.haskell.org, but hasn't been fixed in hackage.haskell.org/mirrors.json. Updating mirrors.json may require new signatures...? I've asked my contacts about that one, as well. ## 1.C. Even if the dream.io URL was correct, it looks like that mirror isn't being updated. The timestamp should be in the future, but it's from October 2025. So I think this mirror is doubly unusable. I'm not sure who is able to administrate this mirror. But... you guessed it... I've asked around. Probably somebody on this list can also answer. # 2. cabal only lists the status of the last mirror attempted. For whatever reason, your invocation is failing to find what it's looking for in Hackage. It tries fpcomplete, which fails. It tries dream.io, which fails. The last one is the error you get. I don't know why your invocation is not succeeding with Hackage, itself. Maybe there's some extra verbosity you could throw at it. - - - And now, solutions! # Solution 1: Override cabal's repository config.[1] repository dreamhost url: https://s3.us-east-005.dream.io/hackage-mirror secure: True root-keys: <read these from hackage.haskell.org/root.json[2]> key-threshold: 3 -- Yes, the HF has a mirror[3]. repository haskell-foundation url: https://hackage-mirror.haskell.foundation secure: True root-keys: <same as above> key-threshold: 3 I think you can put that in a cabal.project somehow? Maybe it has to go in a config file[4]. # Solution 2: Stop using mirrors ...Ok, I lied. That's not a solution. Or is it? I don't know if it's possible or not. -Bryan - - - [1]: https://cabal.readthedocs.io/en/stable/config.html#repository-specification [2]: I'm not sure *which* values from root.json are the ones you're supposed to put here. [3]: I set up the HF mirror when I managed the adoption of FPComplete infrastructure. Their mirror was rolled up in the Stackage machinery. In fact, I never actually shut down the FPCo mirror. I've been the one updating it the last couple years... right up until the 403s started. :) [4]: https://cabal.readthedocs.io/en/stable/config.html#configuration-file-discov... On Thu, 13 Aug 2026 at 10:45, Tom Ellis < tom-lists-haskell-cafe-2026@jaguarpaw.co.uk> wrote:
On Wed, Aug 12, 2026 at 11:16:18PM -0700, Ivan Perez wrote:
Unexpected response 404for
http://objects-us-east-1.dream.io/hackage-mirror/package/StateVar-1.2.2.tar....
Error: Process completed with exit code 1.
Is this a problem of Github or Hackage?
Looks like a problem accessing that specific Hackage mirror. _______________________________________________ Haskell-Cafe mailing list -- haskell-cafe@haskell.org To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
P.S. I forgot to actually validate the Cabal config snippets I included. They may need to be tweaked. On Fri, 14 Aug 2026 at 16:45, Bryan Richter <bryan@haskell.foundation> wrote:
I can describe some of the problems at hand. I'm gonna leave some blanks because I'm not an expert on Cabal or Hackage. Maybe somebody else can fill them in.
# 1. https://hackage.haskell.org/mirrors.json lists two mirrors. Neither of them work.
## 1.A. Some infrastructure change has recently caused hackage.fpcomplete.com (which is an AWS S3 bucket behind the scenes) to start returning 403s.
I'm asking my contacts if that's expected. It may just be time to retire that mirror.
## 1.B. dream.io changed their URL schema.
The new path should be https://s3.us-east-005.dream.io, e.g. https://s3.us-east-005.dream.io/hackage-mirror/package/StateVar-1.2.2.tar.gz .
This has been fixed in the DNS TXT entry for _mirrors.hackage.haskell.org, but hasn't been fixed in hackage.haskell.org/mirrors.json.
Updating mirrors.json may require new signatures...? I've asked my contacts about that one, as well.
## 1.C. Even if the dream.io URL was correct, it looks like that mirror isn't being updated.
The timestamp should be in the future, but it's from October 2025. So I think this mirror is doubly unusable.
I'm not sure who is able to administrate this mirror. But... you guessed it... I've asked around. Probably somebody on this list can also answer.
# 2. cabal only lists the status of the last mirror attempted.
For whatever reason, your invocation is failing to find what it's looking for in Hackage. It tries fpcomplete, which fails. It tries dream.io, which fails. The last one is the error you get.
I don't know why your invocation is not succeeding with Hackage, itself. Maybe there's some extra verbosity you could throw at it.
- - -
And now, solutions!
# Solution 1: Override cabal's repository config.[1]
repository dreamhost url: https://s3.us-east-005.dream.io/hackage-mirror secure: True root-keys: <read these from hackage.haskell.org/root.json[2] <http://hackage.haskell.org/root.json%5B2%5D>> key-threshold: 3
-- Yes, the HF has a mirror[3].
repository haskell-foundation url: https://hackage-mirror.haskell.foundation secure: True root-keys: <same as above> key-threshold: 3
I think you can put that in a cabal.project somehow? Maybe it has to go in a config file[4].
# Solution 2: Stop using mirrors
...Ok, I lied. That's not a solution. Or is it? I don't know if it's possible or not.
-Bryan
- - -
[1]: https://cabal.readthedocs.io/en/stable/config.html#repository-specification [2]: I'm not sure *which* values from root.json are the ones you're supposed to put here. [3]: I set up the HF mirror when I managed the adoption of FPComplete infrastructure. Their mirror was rolled up in the Stackage machinery. In fact, I never actually shut down the FPCo mirror. I've been the one updating it the last couple years... right up until the 403s started. :) [4]: https://cabal.readthedocs.io/en/stable/config.html#configuration-file-discov...
On Thu, 13 Aug 2026 at 10:45, Tom Ellis < tom-lists-haskell-cafe-2026@jaguarpaw.co.uk> wrote:
On Wed, Aug 12, 2026 at 11:16:18PM -0700, Ivan Perez wrote:
Unexpected response 404for
http://objects-us-east-1.dream.io/hackage-mirror/package/StateVar-1.2.2.tar....
Error: Process completed with exit code 1.
Is this a problem of Github or Hackage?
Looks like a problem accessing that specific Hackage mirror. _______________________________________________ Haskell-Cafe mailing list -- haskell-cafe@haskell.org To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
I'm using https://github.com/haskell-actions/setup to set up Haskell. I doubt I'm the only person affected by this. Is that something that could / should be adjusted there so that it helps everyone? Ivan On Fri, 14 Aug 2026 at 06:49, Bryan Richter via Haskell-Cafe < haskell-cafe@haskell.org> wrote:
P.S. I forgot to actually validate the Cabal config snippets I included. They may need to be tweaked.
On Fri, 14 Aug 2026 at 16:45, Bryan Richter <bryan@haskell.foundation> wrote:
I can describe some of the problems at hand. I'm gonna leave some blanks because I'm not an expert on Cabal or Hackage. Maybe somebody else can fill them in.
# 1. https://hackage.haskell.org/mirrors.json lists two mirrors. Neither of them work.
## 1.A. Some infrastructure change has recently caused hackage.fpcomplete.com (which is an AWS S3 bucket behind the scenes) to start returning 403s.
I'm asking my contacts if that's expected. It may just be time to retire that mirror.
## 1.B. dream.io changed their URL schema.
The new path should be https://s3.us-east-005.dream.io, e.g. https://s3.us-east-005.dream.io/hackage-mirror/package/StateVar-1.2.2.tar.gz .
This has been fixed in the DNS TXT entry for _mirrors.hackage.haskell.org, but hasn't been fixed in hackage.haskell.org/mirrors.json.
Updating mirrors.json may require new signatures...? I've asked my contacts about that one, as well.
## 1.C. Even if the dream.io URL was correct, it looks like that mirror isn't being updated.
The timestamp should be in the future, but it's from October 2025. So I think this mirror is doubly unusable.
I'm not sure who is able to administrate this mirror. But... you guessed it... I've asked around. Probably somebody on this list can also answer.
# 2. cabal only lists the status of the last mirror attempted.
For whatever reason, your invocation is failing to find what it's looking for in Hackage. It tries fpcomplete, which fails. It tries dream.io, which fails. The last one is the error you get.
I don't know why your invocation is not succeeding with Hackage, itself. Maybe there's some extra verbosity you could throw at it.
- - -
And now, solutions!
# Solution 1: Override cabal's repository config.[1]
repository dreamhost url: https://s3.us-east-005.dream.io/hackage-mirror secure: True root-keys: <read these from hackage.haskell.org/root.json[2] <http://hackage.haskell.org/root.json%5B2%5D>> key-threshold: 3
-- Yes, the HF has a mirror[3].
repository haskell-foundation url: https://hackage-mirror.haskell.foundation secure: True root-keys: <same as above> key-threshold: 3
I think you can put that in a cabal.project somehow? Maybe it has to go in a config file[4].
# Solution 2: Stop using mirrors
...Ok, I lied. That's not a solution. Or is it? I don't know if it's possible or not.
-Bryan
- - -
[1]: https://cabal.readthedocs.io/en/stable/config.html#repository-specification [2]: I'm not sure *which* values from root.json are the ones you're supposed to put here. [3]: I set up the HF mirror when I managed the adoption of FPComplete infrastructure. Their mirror was rolled up in the Stackage machinery. In fact, I never actually shut down the FPCo mirror. I've been the one updating it the last couple years... right up until the 403s started. :) [4]: https://cabal.readthedocs.io/en/stable/config.html#configuration-file-discov...
On Thu, 13 Aug 2026 at 10:45, Tom Ellis < tom-lists-haskell-cafe-2026@jaguarpaw.co.uk> wrote:
On Wed, Aug 12, 2026 at 11:16:18PM -0700, Ivan Perez wrote:
Unexpected response 404for
http://objects-us-east-1.dream.io/hackage-mirror/package/StateVar-1.2.2.tar....
Error: Process completed with exit code 1.
Is this a problem of Github or Hackage?
Looks like a problem accessing that specific Hackage mirror. _______________________________________________ Haskell-Cafe mailing list -- haskell-cafe@haskell.org To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
_______________________________________________ Haskell-Cafe mailing list -- haskell-cafe@haskell.org To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
On Fri, Aug 14, 2026 at 08:28:44AM -0700, Ivan Perez wrote:
I'm using https://github.com/haskell-actions/setup to set up Haskell.
I doubt I'm the only person affected by this.
Is that something that could / should be adjusted there so that it helps everyone?
I think regardless of the cause or solution, if you're seeing it in haskell-actions/setup then you should file an issue there: https://github.com/haskell-actions/setup/issues/new
Thanks and done. For anyone who is interested: https://github.com/haskell-actions/setup/issues/150 Ivan On Fri, 14 Aug 2026 at 08:51, Tom Ellis < tom-lists-haskell-cafe-2026@jaguarpaw.co.uk> wrote:
On Fri, Aug 14, 2026 at 08:28:44AM -0700, Ivan Perez wrote:
I'm using https://github.com/haskell-actions/setup to set up Haskell.
I doubt I'm the only person affected by this.
Is that something that could / should be adjusted there so that it helps everyone?
I think regardless of the cause or solution, if you're seeing it in haskell-actions/setup then you should file an issue there:
https://github.com/haskell-actions/setup/issues/new _______________________________________________ Haskell-Cafe mailing list -- haskell-cafe@haskell.org To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
I know you said stop using mirrors. I just made the CI job prints its $HOME/.cabal/config and this was in it: repository hackage.haskell.org url: http://hackage.haskell.org/ -- secure: True -- root-keys: -- key-threshold: 3 I don't see any evidence that Cabal is configured to use mirrors. Could this redirection be happening on the Hackage side? Ivan On Fri, 14 Aug 2026 at 09:06, Ivan Perez <ivanperezdominguez@gmail.com> wrote:
Thanks and done.
For anyone who is interested: https://github.com/haskell-actions/setup/issues/150
Ivan
On Fri, 14 Aug 2026 at 08:51, Tom Ellis < tom-lists-haskell-cafe-2026@jaguarpaw.co.uk> wrote:
On Fri, Aug 14, 2026 at 08:28:44AM -0700, Ivan Perez wrote:
I'm using https://github.com/haskell-actions/setup to set up Haskell.
I doubt I'm the only person affected by this.
Is that something that could / should be adjusted there so that it helps everyone?
I think regardless of the cause or solution, if you're seeing it in haskell-actions/setup then you should file an issue there:
https://github.com/haskell-actions/setup/issues/new _______________________________________________ Haskell-Cafe mailing list -- haskell-cafe@haskell.org To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
On Fri, Aug 14, 2026 at 03:54:53PM -0700, Ivan Perez wrote:
I don't see any evidence that Cabal is configured to use mirrors. Could this redirection be happening on the Hackage side?
It's possible the *configuration* of mirrors comes from the Hackage side, via: https://hackage.haskell.org/mirrors.json But I think if that were the sole issue we would have more problems, as people would be reporting failed package downloads during normal interactive invocations of `cabal`. Tom
Right, there's no evidence of use of mirrors because afaik it cannot be configured. And normal verbosity doesn't print anything about it. But it is, in fact, something cabal uses. I know this information doesn't help. :( Last week I had to fix the generation of all-cabal-hashes, which was failing because it relied on the fpco mirror. Next week I'll continue pushing for fixing the mirror situation, itself. Until the mirror situation gets resolved, the only thing I can think of for you to try is to figure out why Hackage can't serve you directly. Maybe fork the Haskell setup action and add some extra verbosity? Are you on private runners? Is there network weirdness? Is the CDN treating you as a threat? This mailing list is not as active as Discourse.. maybe post there to try to find others with the same problem? la 15.8.2026 klo 10.12 Ivan Perez <ivanperezdominguez@gmail.com> kirjoitti:
I know you said stop using mirrors.
I just made the CI job prints its $HOME/.cabal/config and this was in it:
repository hackage.haskell.org url: http://hackage.haskell.org/ -- secure: True -- root-keys: -- key-threshold: 3
I don't see any evidence that Cabal is configured to use mirrors. Could this redirection be happening on the Hackage side?
Ivan
On Fri, 14 Aug 2026 at 09:06, Ivan Perez <ivanperezdominguez@gmail.com> wrote:
Thanks and done.
For anyone who is interested: https://github.com/haskell-actions/setup/issues/150
Ivan
On Fri, 14 Aug 2026 at 08:51, Tom Ellis < tom-lists-haskell-cafe-2026@jaguarpaw.co.uk> wrote:
On Fri, Aug 14, 2026 at 08:28:44AM -0700, Ivan Perez wrote:
I'm using https://github.com/haskell-actions/setup to set up Haskell.
I doubt I'm the only person affected by this.
Is that something that could / should be adjusted there so that it helps everyone?
I think regardless of the cause or solution, if you're seeing it in haskell-actions/setup then you should file an issue there:
https://github.com/haskell-actions/setup/issues/new _______________________________________________ Haskell-Cafe mailing list -- haskell-cafe@haskell.org To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
_______________________________________________ Haskell-Cafe mailing list -- haskell-cafe@haskell.org To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
I've found a strange pattern: it happens only with older versions of Cabal and with v1-install. Has anything happened on Cabal's side wrt how mirrors are handled that could explain this? Is there anything on the Hackage side that detects the version of Cabal and chooses to prioritize newer versions? Maybe I'm seeing causation where there's barely correlation. Ivan On Sat, 15 Aug 2026 at 04:56, Bryan Richter <bryan@haskell.foundation> wrote:
Right, there's no evidence of use of mirrors because afaik it cannot be configured. And normal verbosity doesn't print anything about it. But it is, in fact, something cabal uses.
I know this information doesn't help. :(
Last week I had to fix the generation of all-cabal-hashes, which was failing because it relied on the fpco mirror. Next week I'll continue pushing for fixing the mirror situation, itself.
Until the mirror situation gets resolved, the only thing I can think of for you to try is to figure out why Hackage can't serve you directly. Maybe fork the Haskell setup action and add some extra verbosity? Are you on private runners? Is there network weirdness? Is the CDN treating you as a threat?
This mailing list is not as active as Discourse.. maybe post there to try to find others with the same problem?
la 15.8.2026 klo 10.12 Ivan Perez <ivanperezdominguez@gmail.com> kirjoitti:
I know you said stop using mirrors.
I just made the CI job prints its $HOME/.cabal/config and this was in it:
repository hackage.haskell.org url: http://hackage.haskell.org/ -- secure: True -- root-keys: -- key-threshold: 3
I don't see any evidence that Cabal is configured to use mirrors. Could this redirection be happening on the Hackage side?
Ivan
On Fri, 14 Aug 2026 at 09:06, Ivan Perez <ivanperezdominguez@gmail.com> wrote:
Thanks and done.
For anyone who is interested: https://github.com/haskell-actions/setup/issues/150
Ivan
On Fri, 14 Aug 2026 at 08:51, Tom Ellis < tom-lists-haskell-cafe-2026@jaguarpaw.co.uk> wrote:
On Fri, Aug 14, 2026 at 08:28:44AM -0700, Ivan Perez wrote:
I'm using https://github.com/haskell-actions/setup to set up Haskell.
I doubt I'm the only person affected by this.
Is that something that could / should be adjusted there so that it helps everyone?
I think regardless of the cause or solution, if you're seeing it in haskell-actions/setup then you should file an issue there:
https://github.com/haskell-actions/setup/issues/new _______________________________________________ Haskell-Cafe mailing list -- haskell-cafe@haskell.org To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
_______________________________________________ Haskell-Cafe mailing list -- haskell-cafe@haskell.org To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
Hi Ivan, How old is the old? Try setting `secure: False` or reducing `key-threshold` in `.cabal/config`, does it change anything? When was the last time you executed `cabal update`? I think I have a recollection of a similar issue. Basically, Cabal executable bakes in a set of root keys (three of them at least, I think). It will update them automatically when doing `cabal update`. But if you don’t do `cabal update` often enough (“often” is a strong word, doing it once a few years would be enough) or you install a very old Cabal on a new machine, all keys will be eventually rotated out and Cabal won’t be able to establish a secure connection to Hackage. The other mirrors probably stopped rotating root keys some time ago, so your Cabal executable is still able to establish connection with them. Best regards, Andrew
On 16 Aug 2026, at 01:24, Ivan Perez <ivanperezdominguez@gmail.com> wrote:
I've found a strange pattern: it happens only with older versions of Cabal and with v1-install.
Has anything happened on Cabal's side wrt how mirrors are handled that could explain this?
Is there anything on the Hackage side that detects the version of Cabal and chooses to prioritize newer versions?
Maybe I'm seeing causation where there's barely correlation.
Ivan
On Sat, 15 Aug 2026 at 04:56, Bryan Richter <bryan@haskell.foundation> wrote:
Right, there's no evidence of use of mirrors because afaik it cannot be configured. And normal verbosity doesn't print anything about it. But it is, in fact, something cabal uses.
I know this information doesn't help. :(
Last week I had to fix the generation of all-cabal-hashes, which was failing because it relied on the fpco mirror. Next week I'll continue pushing for fixing the mirror situation, itself.
Until the mirror situation gets resolved, the only thing I can think of for you to try is to figure out why Hackage can't serve you directly. Maybe fork the Haskell setup action and add some extra verbosity? Are you on private runners? Is there network weirdness? Is the CDN treating you as a threat?
This mailing list is not as active as Discourse.. maybe post there to try to find others with the same problem?
la 15.8.2026 klo 10.12 Ivan Perez <ivanperezdominguez@gmail.com <mailto:ivanperezdominguez@gmail.com>> kirjoitti:
I know you said stop using mirrors.
I just made the CI job prints its $HOME/.cabal/config and this was in it:
repository hackage.haskell.org <http://hackage.haskell.org/> url: http://hackage.haskell.org/ -- secure: True -- root-keys: -- key-threshold: 3
I don't see any evidence that Cabal is configured to use mirrors. Could this redirection be happening on the Hackage side?
Ivan
On Fri, 14 Aug 2026 at 09:06, Ivan Perez <ivanperezdominguez@gmail.com <mailto:ivanperezdominguez@gmail.com>> wrote:
Thanks and done.
For anyone who is interested: https://github.com/haskell-actions/setup/issues/150
Ivan
On Fri, 14 Aug 2026 at 08:51, Tom Ellis <tom-lists-haskell-cafe-2026@jaguarpaw.co.uk <mailto:tom-lists-haskell-cafe-2026@jaguarpaw.co.uk>> wrote:
On Fri, Aug 14, 2026 at 08:28:44AM -0700, Ivan Perez wrote:
I'm using https://github.com/haskell-actions/setup to set up Haskell.
I doubt I'm the only person affected by this.
Is that something that could / should be adjusted there so that it helps everyone?
I think regardless of the cause or solution, if you're seeing it in haskell-actions/setup then you should file an issue there:
https://github.com/haskell-actions/setup/issues/new _______________________________________________ Haskell-Cafe mailing list -- haskell-cafe@haskell.org <mailto:haskell-cafe@haskell.org> To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
Haskell-Cafe mailing list -- haskell-cafe@haskell.org <mailto:haskell-cafe@haskell.org> To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
Haskell-Cafe mailing list -- haskell-cafe@haskell.org To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
Yep. Did it. I'd seen that in Docker but never in Github CI actions. Funny thing is that, in docker, it didn't manifest as a 404 when trying to install packages. Thanks for your help. Ivan On Sun, 16 Aug 2026 at 04:39, Andrew Lelechenko <andrew.lelechenko@gmail.com> wrote:
Hi Ivan,
How old is the old? Try setting `secure: False` or reducing `key-threshold` in `.cabal/config`, does it change anything? When was the last time you executed `cabal update`?
I think I have a recollection of a similar issue. Basically, Cabal executable bakes in a set of root keys (three of them at least, I think). It will update them automatically when doing `cabal update`. But if you don’t do `cabal update` often enough (“often” is a strong word, doing it once a few years would be enough) or you install a very old Cabal on a new machine, all keys will be eventually rotated out and Cabal won’t be able to establish a secure connection to Hackage.
The other mirrors probably stopped rotating root keys some time ago, so your Cabal executable is still able to establish connection with them.
Best regards, Andrew
On 16 Aug 2026, at 01:24, Ivan Perez <ivanperezdominguez@gmail.com> wrote:
I've found a strange pattern: it happens only with older versions of Cabal and with v1-install.
Has anything happened on Cabal's side wrt how mirrors are handled that could explain this?
Is there anything on the Hackage side that detects the version of Cabal and chooses to prioritize newer versions?
Maybe I'm seeing causation where there's barely correlation.
Ivan
On Sat, 15 Aug 2026 at 04:56, Bryan Richter <bryan@haskell.foundation> wrote:
Right, there's no evidence of use of mirrors because afaik it cannot be configured. And normal verbosity doesn't print anything about it. But it is, in fact, something cabal uses.
I know this information doesn't help. :(
Last week I had to fix the generation of all-cabal-hashes, which was failing because it relied on the fpco mirror. Next week I'll continue pushing for fixing the mirror situation, itself.
Until the mirror situation gets resolved, the only thing I can think of for you to try is to figure out why Hackage can't serve you directly. Maybe fork the Haskell setup action and add some extra verbosity? Are you on private runners? Is there network weirdness? Is the CDN treating you as a threat?
This mailing list is not as active as Discourse.. maybe post there to try to find others with the same problem?
la 15.8.2026 klo 10.12 Ivan Perez <ivanperezdominguez@gmail.com> kirjoitti:
I know you said stop using mirrors.
I just made the CI job prints its $HOME/.cabal/config and this was in it:
repository hackage.haskell.org url: http://hackage.haskell.org/ -- secure: True -- root-keys: -- key-threshold: 3
I don't see any evidence that Cabal is configured to use mirrors. Could this redirection be happening on the Hackage side?
Ivan
On Fri, 14 Aug 2026 at 09:06, Ivan Perez <ivanperezdominguez@gmail.com> wrote:
Thanks and done.
For anyone who is interested: https://github.com/haskell-actions/setup/issues/150
Ivan
On Fri, 14 Aug 2026 at 08:51, Tom Ellis < tom-lists-haskell-cafe-2026@jaguarpaw.co.uk> wrote:
On Fri, Aug 14, 2026 at 08:28:44AM -0700, Ivan Perez wrote:
I'm using https://github.com/haskell-actions/setup to set up Haskell.
I doubt I'm the only person affected by this.
Is that something that could / should be adjusted there so that it helps everyone?
I think regardless of the cause or solution, if you're seeing it in haskell-actions/setup then you should file an issue there:
https://github.com/haskell-actions/setup/issues/new _______________________________________________ Haskell-Cafe mailing list -- haskell-cafe@haskell.org To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
_______________________________________________ Haskell-Cafe mailing list -- haskell-cafe@haskell.org To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
_______________________________________________ Haskell-Cafe mailing list -- haskell-cafe@haskell.org To (un)subscribe, modify options or view archives go to: Only members subscribed via the mailman list are allowed to post.
participants (5)
-
Andrew Lelechenko -
Brandon Allbery -
Bryan Richter -
Ivan Perez -
Tom Ellis