<repo>/root.json does not have enough signatures signed with the appropriate keys (cabal-install < 3.10.2)

[marcosh]

Describe the bug

Since yesterday our CI started to fail with the following error message

<repo>/root.json does not have enough signatures signed with the appropriate keys

The CI is running on GitHub action inside a Docker Container.

Inside the container the main versions of relevant tools are:

• GHC 9.2.8
• cabal 3.8.1.0
• stack 2.11.1

The project is managed by stack but it looks like this error is cabal specific since if I run cabal build --verbose I get the following output

bluemoon@34eb6b430ada:/opt/build$ cabal build --verbose
this build was affected by the following (project) config files:
/opt/ghc/9.2.8/bin/ghc --print-global-package-db
Trying to locate mirrors via DNS for initial bootstrap of secure repository
'http://hackage.haskell.org/' ...
located 2 mirrors for http://hackage.haskell.org/ :
- http://hackage.fpcomplete.com/
- http://objects-us-east-1.dream.io/hackage-mirror/
Selected mirror http://hackage.haskell.org/
Downloading root
/usr/bin/curl 'http://hackage.haskell.org/root.json' --output /tmp/transportAdapterGet382-1 --location --write-out '%{http_code}' --user-agent 'cabal-install/3.8.1.0 (linux; x86_64)' --silent --show-error --dump-header /tmp/curl-headers382-2.txt
Exception <repo>/root.json does not have enough signatures signed with the
appropriate keys when using mirror http://hackage.haskell.org/
Selected mirror http://hackage.fpcomplete.com/
Downloading root
/usr/bin/curl 'http://hackage.fpcomplete.com/root.json' --output /tmp/transportAdapterGet382-4 --location --write-out '%{http_code}' --user-agent 'cabal-install/3.8.1.0 (linux; x86_64)' --silent --show-error --dump-header /tmp/curl-headers382-5.txt
Exception <repo>/root.json does not have enough signatures signed with the
appropriate keys when using mirror http://hackage.fpcomplete.com/
Selected mirror http://objects-us-east-1.dream.io/hackage-mirror/
Downloading root
/usr/bin/curl 'http://objects-us-east-1.dream.io/hackage-mirror/root.json' --output /tmp/transportAdapterGet382-7 --location --write-out '%{http_code}' --user-agent 'cabal-install/3.8.1.0 (linux; x86_64)' --silent --show-error --dump-header /tmp/curl-headers382-8.txt
<repo>/root.json does not have enough signatures signed with the appropriate keys

The directory ~/.cabal/packages/hackage.haskell.org is empty, and also ~/.stack and .stack-work are empty.

We didn't touch anything related to our infrastructure or how we build code, so it really looks it's not a problem with how we run things.

Any hint on how to solve this would be very welcome

[ffaf1]

See discussion in #11095.

[marcosh]

See discussion in #11095.

thanks for the pointer! I think I can close this, then

[ffaf1]

Wait! That is an already merged PR, this is an Issue.
It is right to have the discussion here (and pointers on mitigation, etc.) for better visibility.

Once this gets tackled, we can close the issue.

[andreasabel]

See:

• <repo>/root.json does not have enough signatures signed with the appropriate keys haskell-actions/setup#122

My resolution was that cabal < 3.10.2 has reached end-of-life and are no longer supported by haskell-actions/setup.
cabal update fails for these old versions on the github virtual environments, although I cannot reproduce this locally on my macOS 15.
The oldest version still working is 3.10.2.0.
Is there a connection to this vulnerability issue?: https://github.com/haskell/security-advisories/blob/main/advisories/hackage/cabal-install/HSEC-2023-0015.md

[andreasabel]

Almost forgot.... Horray issue 11111!! 🍰 🚀 🥳