hermes-1.3.4.3 appears in 00-index, but tarball not available for download

[snoyberg]

This is currently breaking multiple mirroring scripts, which do sanity checks (which are rightfully failing). The tarball should either be made available, or the .cabal file removed from the 00-index tarball.

[hvr]

(related to #382 (comment))

[hvr]

FWIW, For facilities I'm building on top of a monotonically append-only index-log, removing .cabal files from the tarball without leaving a placeholder to retain the unique serial/event numbering (alas the timestamps can't be used for that) would be fatal.

However, I'm talking about the 01-index.tar file (where I think there's something like a tar-level deletion entry which can be appended). For the 00-index.tar file I see no problem in physically removing the .cabal entry.

[snoyberg]

Yeah, I was worried that the new tarball approach may have had something to do with this.

I'll write down for the record that this is now the second time I'm fixing up something that's broken that's "Hackage Security" related :(

[adamgundry]

@snoyberg I don't believe that this is related to the Hackage Security work.

A user uploaded the problematic package by mistake, and it contained code that was not supposed to be publicly distributed, so the tarball was removed from the server by the admins. Deletion is not yet properly supported (cf. #112, #382) so it's not as easy to remove the .cabal file. Unfortunately this also means that there are a few broken links where the server reports an internal error.

It would be good to implement support for deleting a package (version), removing the .cabal file completely from the 00-index.tar and by replacing it with a sentinel in the 01-index.tar, as @hvr suggests.