Re: Errors downloading packages from Hackage in CI job on Github

I can describe some of the problems at hand. I'm gonna leave some blanks
because I'm not an expert on Cabal or Hackage. Maybe somebody else can fill
them in.

# 1. https://hackage.haskell.org/mirrors.json lists two mirrors. Neither of
them work.

## 1.A. Some infrastructure change has recently caused
hackage.fpcomplete.com (which is an AWS S3 bucket behind the scenes) to
start returning 403s.

I'm asking my contacts if that's expected. It may just be time to retire
that mirror.

## 1.B. dream.io changed their URL schema.

The new path should be https://s3.us-east-005.dream.io, e.g.
https://s3.us-east-005.dream.io/hackage-mirror/package/StateVar-1.2.2.tar.gz
.

This has been fixed in the DNS TXT entry for _mirrors.hackage.haskell.org,
but hasn't been fixed in hackage.haskell.org/mirrors.json.

Updating mirrors.json may require new signatures...? I've asked my contacts
about that one, as well.

## 1.C. Even if the dream.io URL was correct, it looks like that mirror
isn't being updated.

The timestamp should be in the future, but it's from October 2025. So I
think this mirror is doubly unusable.

I'm not sure who is able to administrate this mirror. But... you guessed
it... I've asked around. Probably somebody on this list can also answer.

# 2. cabal only lists the status of the last mirror attempted.

For whatever reason, your invocation is failing to find what it's looking
for in Hackage. It tries fpcomplete, which fails. It tries dream.io, which
fails. The last one is the error you get.

I don't know why your invocation is not succeeding with Hackage, itself.
Maybe there's some extra verbosity you could throw at it.

- - -

And now, solutions!

# Solution 1: Override cabal's repository config.[1]

repository dreamhost  url:
https://s3.us-east-005.dream.io/hackage-mirror  secure: True
root-keys: <read these from hackage.haskell.org/root.json[2]>
key-threshold: 3

-- Yes, the HF has a mirror[3].

repository haskell-foundation  url:
https://hackage-mirror.haskell.foundation  secure: True  root-keys:
<same as above>  key-threshold: 3


I think you can put that in a cabal.project somehow? Maybe it has to go in
a config file[4].

# Solution 2: Stop using mirrors

...Ok, I lied. That's not a solution. Or is it? I don't know if it's
possible or not.

-Bryan

- - -


[1]:
https://cabal.readthedocs.io/en/stable/config.html#repository-specification
[2]: I'm not sure *which* values from root.json are the ones you're
supposed to put here.
[3]: I set up the HF mirror when I managed the adoption of FPComplete
infrastructure. Their mirror was rolled up in the Stackage machinery. In
fact, I never actually shut down the FPCo mirror. I've been the one
updating it the last couple years... right up until the 403s started. :)
[4]:
https://cabal.readthedocs.io/en/stable/config.html#configuration-file-discovery

On Thu, 13 Aug 2026 at 10:45, Tom Ellis <
[email protected]> wrote:

> On Wed, Aug 12, 2026 at 11:16:18PM -0700, Ivan Perez wrote:
> > Unexpected response 404for
> >
> http://objects-us-east-1.dream.io/hackage-mirror/package/StateVar-1.2.2.tar.gz
> >
> > Error: Process completed with exit code 1.
>
> > Is this a problem of Github or Hackage?
>
> Looks like a problem accessing that specific Hackage mirror.
> _______________________________________________
> Haskell-Cafe mailing list -- [email protected]
> To (un)subscribe, modify options or view archives go to:
> Only members subscribed via the mailman list are allowed to post.
>

_______________________________________________
Haskell-Cafe mailing list -- [email protected]
To (un)subscribe, modify options or view archives go to:
Only members subscribed via the mailman list are allowed to post.