Fix index-sha256 bit rot (#2390)

* Fix `index-sha256` bit rot

If an new package is deployed to `hackage.haskell.org`, to use it before it is captured by the `hackage.nix` update add the following to the project arguments:

```nix
  index-state="2025-06-16T00:00:00Z";  # Use current time here
  # This hash in not valid, the error message will give the correct hash
  index-sha256="sha256-NS28jJYko/tNUKVhncntu/mV8tsQmTA52T000000000=";
```

This change PR fixes some "bit rot" issues:
 * A warning about `--index-state` argument being out of range is now an error.
 * The sha256 might now be in base16 or base32.

* Add comment

* Doc change to trigger hydra CI

* Fix cross compilation shells

* Use hackage.nix/index-state.nix

* Support for older hackage.nix versions

Author: hamishmack

docs/reference/library.md

@@ -273,8 +273,8 @@ needed for `importAndFilterProject`.
 |----------------------|------|---------------------|
 | `name`               | String | Optional name for better error messages. |
 | `src`                | Path   | Location of the cabal project files. |
-| `compiler-nix-name`  | String | The name of the ghc compiler to use eg. "ghc884" |
-| `index-state`        | Timestamp | Optional hackage index-state, eg. "2019-10-10T00:00:00Z". |
+| `compiler-nix-name`  | String | The name of the ghc compiler to use eg. "ghc9122" |
+| `index-state`        | Timestamp | Optional hackage index-state, eg. "2025-01-10T00:00:00Z". |
 | `index-sha256`       | Sha256 | Optional hash of the truncated hackage index-state. |
 | `plan-sha256`        | Sha256 | Optional hash of the plan-to-nix output (makes the plan-to-nix step a fixed output derivation). |
 | `cabalProject`       | String | Optional cabal project file contents (defaults to readFile "${src}/cabal.project"). |

lib/call-cabal-project-to-nix.nix

@@ -678,7 +678,9 @@ let
           # Setting the desired `index-state` here in case it is not
           # in the cabal.project file. This will further restrict the
           # packages used by the solver (cached-index-state >= index-state-max).
-          pkgs.lib.optionalString (index-state != null) "--index-state=${index-state}"
+          # Cabal treats `--index-state` > the last known package as an error,
+          # so we only include this if it is < cached-index-state.
+          pkgs.lib.optionalString (index-state != null && index-state < cached-index-state) "--index-state=${index-state}"
         } \
         -w ${
           # We are using `-w` rather than `--with-ghc` here to override

mk-local-hackage-repo/default.nix

@@ -17,7 +17,7 @@
 pkgs:
 { name, index }:
 
-pkgs.buildPackages.runCommand "hackage-repo-${name}" { preferLocalBuild = true; } ''
+pkgs.pkgsBuildBuild.runCommand "hackage-repo-${name}" { preferLocalBuild = true; } ''
 mkdir -p $out
 export expires="4000-01-01T00:00:00Z"
 
@@ -29,7 +29,7 @@ ${
   # of the index derivation (when the `extra-hackages` feature is used the index
   # may not have an outputHash).
   pkgs.lib.optionalString (index ? outputHash) ''
-    if [[ "${index.outputHash}" != "$index_sha256" ]]; then
+    if [[ "$(${pkgs.pkgsBuildBuild.nix}/bin/nix-hash --type sha256 --to-base16 ${index.outputHash})" != "$index_sha256" ]]; then
       echo "ERROR See https://github.com/input-output-hk/haskell.nix/issues/884"
       exit 1
     fi