[tcl-tk] SHA256 mismatch for itk tarball

[denilsonsa]

Output of brew config

HOMEBREW_VERSION: 4.4.13
ORIGIN: https://github.com/Homebrew/brew
HEAD: 6ea9df68df4868ce12ea7c51c85b57dce514f2e8
Last commit: 7 days ago
Branch: stable
Core tap JSON: 30 Dec 11:05 UTC
Core cask tap JSON: 30 Dec 11:05 UTC
HOMEBREW_PREFIX: /Users/foobar/.homebrew
HOMEBREW_REPOSITORY: /Users/foobar/.homebrew
HOMEBREW_CELLAR: /Users/foobar/.homebrew/Cellar
HOMEBREW_CASK_OPTS: []
HOMEBREW_DISPLAY: /private/tmp/com.apple.launchd.9clnk8wllC/org.xquartz:0
HOMEBREW_EDITOR: vim
HOMEBREW_MAKE_JOBS: 12
Homebrew Ruby: 3.3.6 => /Users/foobar/.homebrew/Library/Homebrew/vendor/portable-ruby/3.3.6/bin/ruby
CPU: dodeca-core 64-bit arm_lobos
Clang: 16.0.0 build 1600
Git: 2.39.5 => /Applications/Xcode.app/Contents/Developer/usr/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 15.2-arm64
CLT: 16.2.0.0.1.1733547573
Xcode: 16.2
Rosetta 2: false

Output of brew doctor

(not relevant)

Description of issue

When trying to build tcl-tk, it fails with this message:

==> Downloading from https://codeload.github.com/tcltk/itk/tar.gz/refs/tags/itk-4-2-3
Error: SHA256 mismatch
Expected: 3eea66dfc57259d85ad741a01786b70ae4b3ae9774d27e24f7d0917c7451e94b
  Actual: bc5ed347212fce403e04d3161cd429319af98da47effd3e32e20d2f04293b036

I can see the tag itk-4-2-3 is from one year ago. I know GitHub once tried changing some setting and that caused all the hashes to change, but they seem to have reverted it. They even announced their plans on the future stability of hashes.

I can also see this SHA256 hash was introduced in the beginning of November by @cho-m.

Was the hash wrong in that commit? Or did the tarball change from GitHub?

Someone who is more familiar with tcl-tk and itk should take a look at this.

[p-linnane]

No, at some point that hash was correct. Our CI would have failed the build had there been a mismatch. I don't really have any advice other than to ask upstream, or maybe @cho-m will weigh in.

[cho-m]

Agree with above.

Gentoo has archived a copy of original tarball (e.g. https://distfiles.gentoo.org/distfiles/58/itk-4-2-3.tar.gz) if anyone wants to look into diff further.

[p-linnane]

Diffing the tarballs:

╰─ diffoscope itk-4-2-3.tar.gz itk-itk-4-2-3.tar.gz
--- itk-4-2-3.tar.gz
+++ itk-itk-4-2-3.tar.gz
│   --- itk-4-2-3.tar
├── +++ itk-itk-4-2-3.tar
│┄ Format-specific differences are supported for tape archives (.tar) but no file-specific differences were detected; falling back to a binary diff. file(1) reports: POSIX tar archive
│ @@ -26,18 +26,18 @@
│  00000190: 0000 0000 0000 0000 0000 0000 0000 0000  ................
│  000001a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
│  000001b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
│  000001c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
│  000001d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
│  000001e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
│  000001f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
│ -00000200: 3532 2063 6f6d 6d65 6e74 3d61 3439 3463  52 comment=a494c
│ -00000210: 3262 3833 3763 3436 3237 3837 3861 6537  2b837c4627878ae7
│ -00000220: 6362 3634 6132 3464 3237 3234 3466 6439  cb64a24d27244fd9
│ -00000230: 3665 300a 0000 0000 0000 0000 0000 0000  6e0.............
│ +00000200: 3532 2063 6f6d 6d65 6e74 3d32 3132 6566  52 comment=212ef
│ +00000210: 3366 6631 6566 6632 3036 6661 3339 6337  3ff1eff206fa39c7
│ +00000220: 3033 6464 3938 3534 3466 3963 3763 6337  03dd98544f9c7cc7
│ +00000230: 3239 630a 0000 0000 0000 0000 0000 0000  29c.............
│  00000240: 0000 0000 0000 0000 0000 0000 0000 0000  ................
│  00000250: 0000 0000 0000 0000 0000 0000 0000 0000  ................
│  00000260: 0000 0000 0000 0000 0000 0000 0000 0000  ................
│  00000270: 0000 0000 0000 0000 0000 0000 0000 0000  ................
│  00000280: 0000 0000 0000 0000 0000 0000 0000 0000  ................
│  00000290: 0000 0000 0000 0000 0000 0000 0000 0000  ................
│  000002a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................

No changes to the contents after being unarchived though.

[cho-m]

That should be commit tar was generated from:

• tcltk/itk@a494c2b
• tcltk/itk@212ef3f

[denilsonsa]

• tcltk/itk@a494c2b: This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository., author uses a gmail.com address
• tcltk/itk@212ef3f: main and tip-626 branches, itk-4-2-3 tag, author uses a users.sourceforge.net address.

That's the only difference when looking at both commits. I assume at some point they must have rewritten the git history to change the author e-mail address. It would be nice if someone could confirm if this is the case.

[stephensmith9]

Any updates on this? Getting exact same error as @denilsonsa.

[SMillerDev]

It seems nobody asked upstream what the cause was, so it'll stay that way until someone does.

[cfabre]

Hi all,

I had the same hash verification failure.

Runing "brew uninstall tcl-tk" and then "brew update && brew upgrade" kind of did the trick for me.

Best,

Christian.

[ghubjules]

It didn't do the trick, you just removed tcl-tk allowing you to proceed with the upgrade.

Unfortunately, I need tcl-tk because it's a dependency of both python and qmk, 2 packages I use regularly.

[cfabre]

You are right. Sorry for the confusion.
I was confused because "gitk" was still working after the removal.
But "gitk" uses a v8 version of TCL-TK. Not the broken v9 you get if you install it directly from homebrew.