Re: Errors downloading packages from Hackage in CI job on Github

Yep. Did it.

I'd seen that in Docker but never in Github CI actions. Funny thing is
that, in docker, it didn't manifest as a 404 when trying to install
packages.

Thanks for your help.

Ivan



On Sun, 16 Aug 2026 at 04:39, Andrew Lelechenko <[email protected]>
wrote:

> Hi Ivan,
>
> How old is the old? Try setting `secure: False` or reducing
> `key-threshold` in `.cabal/config`, does it change anything? When was the
> last time you executed `cabal update`?
>
> I think I have a recollection of a similar issue. Basically, Cabal
> executable bakes in a set of root keys (three of them at least, I think).
> It will update them automatically when doing `cabal update`. But if you
> don’t do `cabal update` often enough (“often” is a strong word, doing it
> once a few years would be enough) or you install a very old Cabal on a new
> machine, all keys will be eventually rotated out and Cabal won’t be able to
> establish a secure connection to Hackage.
>
> The other mirrors probably stopped rotating root keys some time ago, so
> your Cabal executable is still able to establish connection with them.
>
> Best regards,
> Andrew
>
> On 16 Aug 2026, at 01:24, Ivan Perez <[email protected]> wrote:
>
> I've found a strange pattern: it happens only with older versions of Cabal
> and with v1-install.
>
> Has anything happened on Cabal's side wrt how mirrors are handled that
> could explain this?
>
> Is there anything on the Hackage side that detects the version of Cabal
> and chooses to prioritize newer versions?
>
> Maybe I'm seeing causation where there's barely correlation.
>
> Ivan
>
> On Sat, 15 Aug 2026 at 04:56, Bryan Richter <[email protected]>
> wrote:
>
>> Right, there's no evidence of use of mirrors because afaik it cannot be
>> configured. And normal verbosity doesn't print anything about it. But it
>> is, in fact, something cabal uses.
>>
>> I know this information doesn't help. :(
>>
>> Last week I had to fix the generation of all-cabal-hashes, which was
>> failing because it relied on the fpco mirror. Next week I'll continue
>> pushing for fixing the mirror situation, itself.
>>
>> Until the mirror situation gets resolved, the only thing I can think of
>> for you to try is to figure out why Hackage can't serve you directly. Maybe
>> fork the Haskell setup action and add some extra verbosity? Are you on
>> private runners? Is there network weirdness? Is the CDN treating you as a
>> threat?
>>
>> This mailing list is not as active as Discourse.. maybe post there to try
>> to find others with the same problem?
>>
>>
>>
>> la 15.8.2026 klo 10.12 Ivan Perez <[email protected]>
>> kirjoitti:
>>
>>> I know you said stop using mirrors.
>>>
>>> I just made the CI job prints its $HOME/.cabal/config and this was in it:
>>>
>>> repository hackage.haskell.org
>>> url: http://hackage.haskell.org/
>>> -- secure: True
>>> -- root-keys:
>>> -- key-threshold: 3
>>>
>>> I don't see any evidence that Cabal is configured to use mirrors. Could
>>> this redirection be happening on the Hackage side?
>>>
>>> Ivan
>>>
>>> On Fri, 14 Aug 2026 at 09:06, Ivan Perez <[email protected]>
>>> wrote:
>>>
>>>> Thanks and done.
>>>>
>>>> For anyone who is interested:
>>>> https://github.com/haskell-actions/setup/issues/150
>>>>
>>>> Ivan
>>>>
>>>> On Fri, 14 Aug 2026 at 08:51, Tom Ellis <
>>>> [email protected]> wrote:
>>>>
>>>>> On Fri, Aug 14, 2026 at 08:28:44AM -0700, Ivan Perez wrote:
>>>>> > I'm using https://github.com/haskell-actions/setup to set up
>>>>> Haskell.
>>>>> >
>>>>> > I doubt I'm the only person affected by this.
>>>>> >
>>>>> > Is that something that could / should be adjusted there so that it
>>>>> helps
>>>>> > everyone?
>>>>>
>>>>> I think regardless of the cause or solution, if you're seeing it in
>>>>> haskell-actions/setup then you should file an issue there:
>>>>>
>>>>> https://github.com/haskell-actions/setup/issues/new
>>>>> _______________________________________________
>>>>> Haskell-Cafe mailing list -- [email protected]
>>>>> To (un)subscribe, modify options or view archives go to:
>>>>> Only members subscribed via the mailman list are allowed to post.
>>>>>
>>>> _______________________________________________
>>> Haskell-Cafe mailing list -- [email protected]
>>> To (un)subscribe, modify options or view archives go to:
>>> Only members subscribed via the mailman list are allowed to post.
>>
>> _______________________________________________
> Haskell-Cafe mailing list -- [email protected]
> To (un)subscribe, modify options or view archives go to:
> Only members subscribed via the mailman list are allowed to post.
>
>
>

_______________________________________________
Haskell-Cafe mailing list -- [email protected]
To (un)subscribe, modify options or view archives go to:
Only members subscribed via the mailman list are allowed to post.