Repository navigation
mirrors.json lists two mirrors, both dead #1530
Description
https://hackage.haskell.org/mirrors.json (version 13, expires 2027-06-01T23:59:59Z) lists two mirrors:
Neither works as of 2026-10-15:
$ curl -sS -o /dev/null -w '%{http_code}\n' http://hackage.fpcomplete.com/root.json
curl: (6) Could not resolve host: hackage.fpcomplete.com
$ curl -sS -o /dev/null -w '%{http_code}\n' http://objects-us-east-1.dream.io/hackage-mirror/root.json
403
$ curl -sS http://objects-us-east-1.dream.io/hackage-mirror/timestamp.json
Forbidden
$ curl -sS -o /dev/null -w '%{http_code}\n' http://objects-us-east-1.dream.io/hackage-mirror/01-index.tar.gz
403
The hackage.fpcomplete.com hostname no longer resolves in DNS. The dream.io bucket returns 403 for every file.
So hackage-security clients (cabal-install, stack) have no working fallback if hackage.haskell.org is unavailable. These URLs have been carried over unchanged through several re-signings (see #834, versions 7 and 9).
Suggested fix: re-sign mirrors.json with the dead entries removed, and add live mirrors if there are any. An empty mirror list is also valid. The next re-signing before the 2027-06-01 expiry would be a natural time to do this, if not sooner.
Related: #834
Activity
gbaz commentedon Oct 16, 2026
This is tracked at haskell-infra/hackage-root-keys#28
Note that the situation is not so dire as it seems because current clients do not use mirrors.json but instead pull from an associated txt record on the dns of hackage, which has been updated more recently to accurate mirrors. Fixing mirrors.json at the next re-signing is still worthwhile, and it is good to track it.
ulysses4ever commentedon Oct 16, 2026
i'm using a docker image with GHC 9.10.3 (project requirement) on
muslfrom benz0li. The cabal there is 3.12. I had to manually nuke mirrors.json because it keeps hitting objects-us-east-1.dream.io. I'd appreciate it if this could be fixed without me needing to upgrade the docker image/GHC version/work around it like I do now.tonymorris commentedon Oct 18, 2026
@gbaz
Just to clarify, are you saying that more recent versions of cabal do not use mirrors.json?
juhp commentedon Nov 7, 2026
It doesn't cover the sunset fpcomplete though.