[ERROR] Could not update repository "default": OpamDownload.Download_fail

[WellDoneYouWin]

<><> Windows Developer Mode <><><><><><><><><><><><><><><><><><><><><><><><>  🐫
opam does not require Developer Mode to be enabled on Windows, but it is
recommended, in particular because it enables support for symlinks without
requiring opam to be run elevated (which we do not recommend doing).

More information on enabling Developer Mode may be obtained from
https://learn.microsoft.com/en-gb/windows/apps/get-started/enable-your-device-for-development

<><> Unix support infrastructure ><><><><><><><><><><><><><><><><><><><><><>  🐫

opam and the OCaml ecosystem in general require various Unix tools in order to operate correctly. At present, this requires the installation of Cygwin to provide these tools.

How should opam obtain Unix tools?
> 1. Automatically create an internal Cygwin installation that will be managed by opam (recommended)
  2. Use an existing Cygwin/MSYS2 installation
  3. Abort initialisation

[1/2/3] 1
[WARNING] Cygwin setup failed to download - using embedded copy instead
Checking for available remotes: rsync and local, git.
  - you won't be able to use mercurial repositories unless you install the hg command on your system.
  - you won't be able to use darcs repositories unless you install the darcs command on your system.


<><> Fetching repository information ><><><><><><><><><><><><><><><><><><><>  🐫
[ERROR] Could not update repository "default": OpamDownload.Download_fail(_, "curl failed: \"C:\\\\WINDOWS\\\\system32\\\\curl.exe --write-out %{http_code}\\\\n --retry 3
        --retry-delay 2 --user-agent opam/2.5.0 -L -o C:\\\\Users\\\\imerf\\\\AppData\\\\Local\\\\Temp\\\\opam-26256-00c1b0\\\\index.tar.gz.part --
        https://opam.ocaml.org/index.tar.gz\" exited with code 35")
[ERROR] Initial download of repository failed.

This message keeps appearing while I'm trying to follow the instructions in order to install Ocaml and I don't know what to do. May you help me ?

[dbuenzli]

C:\Users\imerf\AppData\Local\Temp\opam-26256-00c1b0\index.tar.gz.part --
[https://opam.ocaml.org/index.tar.gz](https://opam.ocaml.org/index.tar.gz%5C)" exited with code 35")

From the man page of curl:

  35     SSL connect error. The SSL handshaking failed.

So your machine has got some network connectivity problems. (outdated system certificates or no network access)

[WellDoneYouWin]

C:\Users\imerf\AppData\Local\Temp\opam-26256-00c1b0\index.tar.gz.part --
https://opam.ocaml.org/index.tar.gz" exited with code 35")

From the man page of curl:

  35     SSL connect error. The SSL handshaking failed.

So your machine has got some network connectivity problems. (outdated system certificates or no network access)

That means that I have to do what? Because I tried with another computer but with the same account and it was still the same.

[kit-ty-kate]

Is your version of Windows fully up-to-date? https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/certificate-trust seems to indicate that the root certificates are automatically updated but maybe your version of windows doesn't do that automatically

[dbuenzli]

According to this page curl may be built to lookup the native store, but otherwise you need to specify --ca-native. Do we know the provenance of these curl.exe and how they are built on windows ?

Alternatively you can download the mozilla certificate store from https://curl.se/docs/caextract.html and save it as C:\WINDOWS\system32\curl-ca-bundle.crt. curl.exe will pick it up, but it's likely better to use your system store which will be kept up-to-date by your system.

[kit-ty-kate]

Do we know the provenance of these curl.exe and how they are built on windows ?

Microsoft has been shipping curl.exe as part of Windows since 2018 (see https://devblogs.microsoft.com/commandline/tar-and-curl-come-to-windows/). As to how they built it, i'm not sure, they don't seem to provide the build recipe anywhere.

[dbuenzli]

I guess we can safely assume they built it to lookup their store by default.

[dra27]

Just for info, because you kinda have to know that the system is called Schannel on Windows (!!):

C:\Users\DRA>curl --version
curl 8.16.0 (Windows) libcurl/8.16.0 Schannel zlib/1.3.1 WinIDN
Release-Date: 2025-09-10
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS HSTS HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM SPNEGO SSL SSPI threadsafe Unicode UnixSockets

The presence of Schannel indicates that Windows SSL support is compiled in, which uses the Windows certificate stores (it's covered here)

[dra27]

What do you get from either cmd or powershell from running:

curl.exe --verbose --no-progress-meter --write-out "%{http_code}\n" --retry 3 --retry-delay 2 --user-agent opam/2.5.0 -L -o index.tar.gz -- https://opam.ocaml.org/index.tar.gz

(feel free to paste it here). Assuming that command doesn't download the file, what do you get if you remove the --write-out "%{http_code}\n" part and run the command?