Not sure how to reproduce this, but it seems that sometimes hackage-security gets stuck in a state of having an invalid hash commercialhaskell/stack#3771 . It seems like it's downloading it, but the only way to get it to work is to delete the existing files.