Homebrew: SHA1 Mismatch Even After Update

homebrew

  • Mac OS X 10.7.4 (Lion)
  • Homebrew 0.9.2

Fresh install of Homebrew. No program will install on its own—the expected hash signature never matches the actual one, for whatever reason.

The only answer I have found online is to do brew update beforehand. I did this, and deleted the previously-downloaded package, but it doesn’t seem to have any effect:

 $ brew update
 Already up-to-date.
 $ brew install sshfs
 ==> Installing sshfs dependency: autoconf
 ==> Downloading http://ftpmirror.gnu.org/autoconf/autoconf-2.69.tar.gz
 ######################################################################## 100.0%
 Error: SHA1 mismatch
 Expected: 562471cbcb0dd0fa42a76665acf0dbb68479b78a
 Actual: 304f244353d8b7694914ff42fa87f31608728aed
 Archive: /Library/Caches/Homebrew/autoconf-2.69.tar.gz
 (To retry an incomplete download, remove the file above.)

What’s going on?

Edit: If I download a package manually, and put it into /Library/Caches/Homebrew/ with the same filename that Homebrew expects, and then try to install, it works fine. But if I let Homebrew try to fetch the file itself, the download ends prematurely after only a few kilobytes which corrupts the file and causes the hashes not to match.

Best Answer

If you're certain the downloaded tarball for sshfs is good can try to force Homebrew to install it with:

brew install -f sshfs

More than likely though, if it still complains, is you've got a corrupt tarball download. You can remove /usr/local/Cellar/sshfs/2.4.0/sshfs_2_4_0, which is the cached tarball that Homebrew downloaded, and have Homebrew try downloading the package anew.

If it still complains about the hash value mismatch, you can edit the recipe and update the MD5 checksum for the file in the recipe and then install. The file to edit is /usr/local/Library/Formula/sshfs.rb. Looking at:

/Users/ian/code/tmp/brew [ian@Ian-Chesals-MacBook-Pro] [13:13]
> cat /usr/local/Library/Formula/sshfs.rb
require 'formula'

class Sshfs < Formula
  homepage 'http://fuse.sourceforge.net/sshfs.html'
  url 'https://github.com/fuse4x/sshfs/tarball/sshfs_2_4_0'
  md5 'c9ea547b9684ec4d85437393a2731322'
  version '2.4.0'

  depends_on :automake
  depends_on :libtool

  depends_on 'pkg-config' => :build
  depends_on 'fuse4x'
  depends_on 'glib'

  def install
    system "autoreconf", "--force", "--install"
    system "./configure", "--disable-debug", "--disable-dependency-tracking",
                          "--prefix=#{prefix}"
    system "make install"
  end

  def caveats; <<-EOS.undent
    Make sure to follow the directions given by `brew info fuse4x-kext`
    before trying to use a FUSE-based filesystem.
    EOS
  end
end

You can see that you need to download https://github.com/fuse4x/sshfs/tarball/sshfs_2_4_0 and recalculate the MD5 checksum for the file and then update the recipe. So:

/Users/ian/code/tmp/brew [ian@Ian-Cs-MacBook-Pro] [13:13]
> wget https://github.com/fuse4x/sshfs/tarball/sshfs_2_4_0
--2012-07-23 13:13:53--  https://github.com/fuse4x/sshfs/tarball/sshfs_2_4_0
Resolving github.com... 207.97.227.239
Connecting to github.com|207.97.227.239|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://nodeload.github.com/fuse4x/sshfs/tarball/sshfs_2_4_0 [following]
--2012-07-23 13:13:53--  https://nodeload.github.com/fuse4x/sshfs/tarball/sshfs_2_4_0
Resolving nodeload.github.com... 207.97.227.252
Connecting to nodeload.github.com|207.97.227.252|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 52812 (52K) [application/octet-stream]
Saving to: `sshfs_2_4_0'

100%[===========================================================================================>] 52,812       288K/s   in 0.2s    

2012-07-23 13:13:54 (288 KB/s) - `sshfs_2_4_0' saved [52812/52812]


/Users/ian/code/tmp/brew [ian@Ian-Cs-MacBook-Pro] [13:13]
> md5 sshfs_2_4_0 
MD5 (sshfs_2_4_0) = c9ea547b9684ec4d85437393a2731322

In my case the computed value for the download matches the value in the recipe. If it's different for your case it's likely your download is corrupt. You can go ahead and update the recipe if you think your download is not corrupt.

Note: I did a brew update before running the above so I can attest to the fact that I do have the latest recipe for sshfs and that the MD5 checksum for the tarball in the recipe is correct and matches what gets downloaded from github.

Caveat Utilitor if you do this.

Related Question