Elm built with current Haskell versions (e.g. via nixpkgs) seems to have a tls issue with the package list website:
I need the list of published packages before I can start initializing projects,
so I tried to fetch:
https://package.elm-lang.org/all-packages
But my HTTP library is giving me the following error message:
InternalException (HandshakeFailed (Error_Protocol "peer does not support Extended Main Secret" HandshakeFailure))
Are you somewhere with a slow internet connection? Or no internet? Does the link
I am trying to fetch work in your browser? Maybe the site is down? Does your
internet connection have a firewall that blocks certain domains? It is usually
something like that!
It works fine with the binary release from github.
I believe it may be due to this setting, which defaults to “RequireEMS” nowadays: Network.TLS
Welcome to the Elm community! There are some possible causes and solutions:
Outdated TLS Version or Cipher Support
The server might require a newer TLS version than your system supports. Try updating your system’s OpenSSL or TLS library.
Server-Side Configuration Issues
If the registry (https://package.elm-lang.org/all-packages) is down or misconfigured, you might need to wait or check official channels for updates.
Network Issues (Firewall or Proxy)
If you’re behind a strict firewall or proxy, it might be blocking the secure connection. Try accessing the URL directly in a browser to see if it loads.
Slow or Unreliable Internet Connection
A weak connection might disrupt the handshake. Try using a different network.
That means it was introduced between nixpkgs commits b024ced1aa and dda3dcd3fe. I can try to bisect further, but the ghc 9.6.6 → 9.8.4 and tls 1.8.0 → 2.1.1 updates in there are certainly my first guesses.
Security: BREAKING CHANGE: TLS 1.2 servers require EMS(extended main secret) by default. supportedExtendedMasterSec is renamed to supportedExtendedMainSecret.
My guess is that the elm compiler code uses some higher-level library than tls to make its connection to package.elm-lang.org, and that higher-level library may well not expose these low-level TLS protocol details.
So there may not be an easy way to patch this in the compiler – assuming that’s even a desirable thing! After all, we don’t really want to build a version of the compiler that’s vulnerable to some sort of attack against its communication with the package server. (I am definitely not a TLS expert!)
Just bumped into this after updating nix! It seems like this has been an issue for at least a year, even if it’s only starting to affect nix users now. What do folks see as the most likely path forward in resolving this? Are there admins for the elm package server who are active and reachable who might be willing to update? Or should this be tackled on the nixpkgs side of thing?
I believe it would also be possible to pin an older version of ghc in nixpkgs, but it does seem like supporting the TLS extension on the server would be the better option.
I think we will need to apply patch downstream in nixpkgs because this won’t be accepted upstream anytime soon. Which we could do. There is now even an issue you can subscribe to
$ elm init
Hello! Elm projects always start with an elm.json file. I can create them!
Now you may be wondering, what will be in this file? How do I add Elm files to
my project? How do I see it in the browser? How will my code grow? Do I need
more directories? What about tests? Etc.
Check out <https://elm-lang.org/0.19.1/init> for all the answers!
Knowing all that, would you like me to create an elm.json file now? [Y/n]: y
-- PROBLEM LOADING PACKAGE LIST ------------------------------------------------
I need the list of published packages before I can start initializing projects,
so I tried to fetch:
https://package.elm-lang.org/all-packages
But my HTTP library is giving me the following error message:
InternalException (HandshakeFailed (Error_Protocol "peer does not support Extended Main Secret" HandshakeFailure))
Are you somewhere with a slow internet connection? Or no internet? Does the link
I am trying to fetch work in your browser? Maybe the site is down? Does your
internet connection have a firewall that blocks certain domains? It is usually
something like that!
Internet is working, I tried both elm package from stable and unstable.
To clarify what was discussed on github under the issue.
I understand you’re using classic nix setup with channels. And you follow unstable channel. So do I. Now this poses few questions:
When will the fix be available in the nixos-unstable channel?
How can I use fixed version of elm to unblock myself.
1. When will the fix be available in the nixos-unstable channel?
The process of releasing is a bit more involved than it might seem from outside for various reasons among which is that expectation is that channels should be backed by binary caches which are relatively large and take long time to build. I don’t know what exact process is at the moment and when next staging phase will go though to unstable channel. But I did search on duckduckgo:
There are many ways. For instance you can just take code from the PR and define your own overlay - you can find a lot of information on internet on how to do that.
Or you can for instance add another version of nixpks independent of channel into your setup. using fetchFromGithub and use elm (and only elm) from this pkg set in your setup.
Or you can even just clone the current master of nixpkgs and use nix-env to install the package from the expressions in the master.
Hello
I think I’ll remove the package from my configuration and use a per-project configuration with nix-shell from which I can use packages directly from github.
I had started to do this for other languages, and I think it’s best to keep a minimum of packages installed via /etc/nixos/configuration.nix
You might also want to look in nix flakes which make this per project definition a bit simpler in some ways, though arguably more complicated in others. So it’s a trade-off.
Yes I know Flakes, I just need to take the time to learn about. Looks very interesting indeed.
That said I found having a light /etc/nixos/configuration.nix with essential packages (web browser, terminal emulator, window manager, etc…) and per project default.nix for additional package gave me a fairly easy-to-use solution. with direnv it’s almost transparent.
My main concern is not to overcomplicate my general configuration in order to facilitate updates and upgrades.
it is in the end a matter of preference and your own choice. What ever you do in defaul.nix, shell.nix or flake.nix specific to project is the same you can do globally for systemPackages. Obviously systemPackages are global, project specific things can be versioned together with project (source). Use what you want to use and don’t be afraid to experiment.
Yes, in the end, I’m experimenting with so many languages and technologies that this solution seemed the best to me. Elm remained in the global configuration because it’s a language I often use, especially when I first started using Nixos. But it’s better to define this in each project.
Thank you so much for fixing this!