Root key update broke old `cabal-install`

[ffaf1]

After #23 was merged, breakage happened in old cabal-install.

See this comment or the relevant issue haskell/cabal#11111.

It would be nice to see what mitigation paths are there for users.

Additionally, is there a document where I can inform myself on how trust is (should be) handled at Hackage/client level?

[jmct]

Yes, the overall framework is described here: https://github.com/haskell/hackage-security/blob/master/README.md

The specific issue was described in my comment below the one you linked.

In short, it seems that there are many versions of cabal that have not had the patch that updated who the key-holders are from 2 years ago backported to them.

We are working on one mitigation, that would require no actions from the users. If that does not work, there may be user action required.

[gbaz]

additional key signature deployed.

[ffaf1]

Many, many thanks for having taken care of this at Hackage level, it would have been quite an effort to release a number of cabal-install versions.

For sure future backports will not be missed, thanks!

[jmct]

Looking further into this.

As far as I'm aware (and I'd like to be told otherwise if I missed something!), we only got reports of old cabals breaking in CI. In particular it was people building cabal.

Does this meant that the bootstrapping worked for those that already using and doing occasional cabal updates were successfully bootstrapping?

If so, that changes the issue slightly, and the appropriate mitigations could be a different shape.

[ffaf1]

I can confirm we did not get any report from non CI users.
This is of course reassuring, and means the process of bootstrapping→updating worked for most users.