cabal says "does not match server, will redownload: file length mismatch" but does not redownload

[Mikolaj]

Describe the bug
This happens in real life when one uses head.hackage (https://gitlab.haskell.org/ghc/head.hackage/-/issues/103) and a package is updated on head.hackage without its version string nor revision changing. The result is that the user obtains an old version of this package and only a warning is shown, so the user may not be aware. Note that running cabal update does not help. Nor does wiping out the head.hackage configuration in cabal.project.local (in this repro contained in the config file instead) and creating an updated one helps. Only wiping out ~/.cabal/packages/head.hackage.ghc.haskell.org fixes the problem, for a time.

To Reproduce
Steps to reproduce the behavior:

Unpack this archive, which contains a snapshot of a real-life cabal installation, then do (the old GHC version is needed for the repro, because an old variant of the package is used, which is the very bug --- the package should be much newer)

redownloadRepro5
cabal --config-file ./config install ghc-typelits-natnormalise -w ghc-9.4.8

It should warn a lot, install fine and then, when you repeat the last command it should not warn about "file length mismatch", because it was supposed to redownload. But it didn't, so you will see

~/r/redownloadRepro$ cabal --config-file ./config install ghc-typelits-natnormalise -w ghc-9.4.8
Resolving dependencies...
Warning: Fetched tarball
./head.hackage.ghc.haskell.org/ghc-typelits-natnormalise/0.7.9/ghc-typelits-natnormalise-0.7.9.tar.gz
does not match server, will redownload: file length mismatch
Warning: installdir is not defined. Set it in your cabal config file or use
--installdir=<path>. Using default installdir: "/home/mikolaj/.cabal/bin"
...

Note the vain promise repeated again: "does not match server, will redownload"

Expected behavior

I should redownload and then the user should get the new version of the package and the warning should not be shown any more.

System information

• Ancient Ubuntu
• cabal-install 3.12.0.0-prerelease

Additional context
I'm quite ignorant about the hackage protocol, but it seems head.hackage is abusing it and hence the problem. However, if it can be fixed on the cabal side, no reason not to.