I guess this is semi-on-topic.
This is exactly what cabal-install and GHCup do. It’s not a hack or a “we don’t know better”.
Curl is the de-facto standard when it comes to fetching things. It works behind complicated proxy configs and whatnot. Why would you try to re-discover all that knowledge from scratch?
Now, you could say: well, just use the libcurl bindings. Programmatically that’s indeed nicer, but now you run into distribution issues:
- if you link dynamically to libcurl, the end user system might not have the required library (or SONAME)
- if you link statically, now you’re suddenly in charge of following CVEs across the whole curl stack (enjoy) and there might still be some portability issues (e.g. where to find certificates etc. is complicated and might now differ, because the system where you statically linked curl is not the same as the system where it’s run)
So yeah: shelling out to curl is in fact a smart thing to do.