See this stack issue: https://github.com/commercialhaskell/stack/issues/3572 Assuming it's from a relatively recent version of stack, this is likely a bug in hackage-security.