Upgrading monal-alpha fails due to SHA256 mismatch

[foss-]

Output of brew config

HOMEBREW_VERSION: 4.3.1
ORIGIN: https://github.com/Homebrew/brew
HEAD: e0bc557e7b991cb23583679e1cf1c8a92b793aeb
Last commit: 5 days ago
Core tap JSON: 25 May 12:31 UTC
Core cask tap JSON: 25 May 12:31 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_MAKE_JOBS: 12
Homebrew Ruby: 3.3.1 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.3.1/bin/ruby
CPU: dodeca-core 64-bit arm_lobos
Clang: 15.0.0 build 1500
Git: 2.39.3 => /Library/Developer/CommandLineTools/usr/bin/git
Curl: 8.6.0 => /usr/bin/curl
macOS: 14.5-arm64
CLT: 15.3.0.0.1.1708646388
Xcode: 15.4
Rosetta 2: false

Output of brew doctor

➜  ~ brew doctor
Your system is ready to brew.

Description of issue

Running into trouble trying to upgrade monal-alpha.

Reproduce

1. brew tap monal-im/homebrew-monal-alpha & brew install --cask monal-alpha as per https://github.com/monal-im/Monal
2. wait for next alpha build
3. brew update
4. brew upgrade --cask --verbose --greedy

Currently

This is tap + install:

~ brew tap monal-im/homebrew-monal-alpha --verbose
==> Tapping monal-im/monal-alpha
git clone https://github.com/monal-im/homebrew-monal-alpha /opt/homebrew/Library/Taps/monal-im/homebrew-monal-alpha --origin=origin --template= --config core.fsmonitor=false
Cloning into '/opt/homebrew/Library/Taps/monal-im/homebrew-monal-alpha'...
remote: Enumerating objects: 13873, done.
remote: Counting objects: 100% (3557/3557), done.
remote: Compressing objects: 100% (1781/1781), done.
remote: Total 13873 (delta 888), reused 3555 (delta 886), pack-reused 10316
Receiving objects: 100% (13873/13873), 1.52 MiB | 10.09 MiB/s, done.
Resolving deltas: 100% (3453/3453), done.
Tapped 1 cask (15 files, 1.9MB).
➜  ~ brew install --cask monal-alpha --verbose
==> Downloading https://formulae.brew.sh/api/cask.jws.json
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 1449k  100 1449k    0     0  7977k      0 --:--:-- --:--:-- --:--:-- 8008k
==> Downloading https://formulae.brew.sh/api/formula_tap_migrations.jws.json
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   974  100   974    0     0  21303      0 --:--:-- --:--:-- --:--:-- 21644
==> Downloading https://formulae.brew.sh/api/cask_tap_migrations.jws.json
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1012  100  1012    0     0  22130      0 --:--:-- --:--:-- --:--:-- 22488
==> Downloading https://downloads.monal-im.org/monal-im/alpha/macOS/Monal.alpha.tar
/usr/bin/env /opt/homebrew/Library/Homebrew/shims/shared/curl --disable --cookie /dev/null --globoff --show-error --user-agent Homebrew/4.3.1\ \(Macintosh\;\ arm64\ Mac\ OS\ X\ 14.5\)\ curl/8.6.0 --header Accept-Language:\ en --fail --retry 3 --remote-time --output /Users/username/Library/Caches/Homebrew/downloads/ce82a7b3dbc661562d8eb59c1a07a6442efdf4d34d65bca8cdb595a80c94cc65--Monal.alpha.tar.incomplete --location https://downloads.monal-im.org/monal-im/alpha/macOS/Monal.alpha.tar
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  106M  100  106M    0     0  8206k      0  0:00:13  0:00:13 --:--:--  9.9M
==> Verifying checksum for 'ce82a7b3dbc661562d8eb59c1a07a6442efdf4d34d65bca8cdb595a80c94cc65--Monal.alpha.tar'
==> Installing Cask monal-alpha
/usr/bin/env tar --extract --no-same-owner --file /Users/username/Library/Caches/Homebrew/downloads/ce82a7b3dbc661562d8eb59c1a07a6442efdf4d34d65bca8cdb595a80c94cc65--Monal.alpha.tar --directory /private/tmp/homebrew-unpack20240525-67640-9jc0fs
/usr/bin/env cp -pR /private/tmp/homebrew-unpack20240525-67640-9jc0fs/Monal.alpha.app/. /opt/homebrew/Caskroom/monal-alpha/1716597137/Monal.alpha.app
==> Moving App 'Monal.alpha.app' to '/Applications/Monal.alpha.app'
🍺  monal-alpha was successfully installed!

Metadata for this version:

cask "monal-alpha" do
	version "1716597137"

	sha256 "88bd5ceaae435e453552324e721a940d36cd885577ea7323a7c8157af7816ddd"


	url "https://downloads.monal-im.org/monal-im/alpha/macOS/Monal.alpha.tar"
	name "Monal.Alpha"
	homepage "https://github.com/tmolitor-stud-tu/monal.alpha"

	depends_on macos: ">= :big_sur"

	app "Monal.alpha.app"
end

➜  ~ brew update                              
==> Updating Homebrew...
Updated 1 tap (monal-im/monal-alpha).
==> Outdated Formulae
openssl@3                                                                                                               yt-dlp
==> Outdated Casks
monal-alpha

You have 2 outdated formulae and 1 outdated cask installed.
You can upgrade them with brew upgrade
or list them with brew outdated.

➜  ~ brew upgrade --cask --verbose --greedy
==> Upgrading 1 outdated package:
monal-im/monal-alpha/monal-alpha 1716597137 -> 1716644859
==> Upgrading monal-alpha
==> Downloading https://downloads.monal-im.org/monal-im/alpha/macOS/Monal.alpha.tar
Already downloaded: /Users/username/Library/Caches/Homebrew/downloads/ce82a7b3dbc661562d8eb59c1a07a6442efdf4d34d65bca8cdb595a80c94cc65--Monal.alpha.tar
==> Verifying checksum for 'ce82a7b3dbc661562d8eb59c1a07a6442efdf4d34d65bca8cdb595a80c94cc65--Monal.alpha.tar'
==> Purging files for version 1716644859 of Cask monal-alpha
Error: monal-im/monal-alpha/monal-alpha: SHA256 mismatch
Expected: 0b5f794556718349b03ca5bb3c8d336f904fc4d3db6bf58e195fed75f490847b
  Actual: 88bd5ceaae435e453552324e721a940d36cd885577ea7323a7c8157af7816ddd
    File: /Users/username/Library/Caches/Homebrew/downloads/ce82a7b3dbc661562d8eb59c1a07a6442efdf4d34d65bca8cdb595a80c94cc65--Monal.alpha.tar
To retry an incomplete download, remove the file above.

Expected hash is that of the previous version.

Metadata of new version

cask "monal-alpha" do
	version "1716644859"

	sha256 "0b5f794556718349b03ca5bb3c8d336f904fc4d3db6bf58e195fed75f490847b"


	url "https://downloads.monal-im.org/monal-im/alpha/macOS/Monal.alpha.tar"
	name "Monal.Alpha"
	homepage "https://github.com/tmolitor-stud-tu/monal.alpha"

	depends_on macos: ">= :big_sur"

	app "Monal.alpha.app"
end

Expected

Upgrade. Workaround:

• brew uninstall --cask monal-alpha
• brew untap monal-im/homebrew-monal-alpha
• sudo rm -rf brew --cache
• brew tap monal-im/homebrew-monal-alpha
• brew install --cask monal-alpha

Is there something that can be done to allow for easier upgrades?

Relevant casks

monal-alpha

[p-linnane]

That is not an official tap. You will need to reach out to the maintainer of the tap since we have no control over its contents.

[tmolitor-stud-tu]

I am the maintainer, I have control and I don't know how to fix this bug.

[tmolitor-stud-tu]

Since we did not change anything regarding that tap for several years now, but it started to break only recently, I believe this is a bug in homebrew, not in the tap itself.

[tmolitor-stud-tu]

Upon investigation I found out that homebrew apparently caches the OLD tar archive downloaded in the last install/upgrade.

When new metadata is available (having a new hash and new version number) it SAYS it's downloading the new tar archive, but somehow uses the old cached one --> the hashes of the OLD tar archive don't match the NEW metadata.

I've just implemented a workaround: monal-im/homebrew-monal-alpha@da23a3e

But I strongly believe that this should not be neccessary and homebrew should not somehow cache the old download in the first place.

Edit: the output logged when trying to upgrade suggests the same (Already downloaded):

➜  ~ brew upgrade --cask --verbose --greedy
==> Upgrading 1 outdated package:
monal-im/monal-alpha/monal-alpha 1716644859 -> 1716674298
==> Upgrading monal-alpha
==> Downloading https://downloads.monal-im.org/monal-im/alpha/macOS/Monal.alpha.tar
Already downloaded: /Users/username/Library/Caches/Homebrew/downloads/ce82a7b3dbc661562d8eb59c1a07a6442efdf4d34d65bca8cdb595a80c94cc65--Monal.alpha.tar
==> Verifying checksum for 'ce82a7b3dbc661562d8eb59c1a07a6442efdf4d34d65bca8cdb595a80c94cc65--Monal.alpha.tar'
==> Purging files for version 1716674298 of Cask monal-alpha
Error: monal-im/monal-alpha/monal-alpha: SHA256 mismatch
Expected: 954cc3316c89469d10fe2c48fc9acf3d793d5a5a6b4ec8a5015d0d479e6e9d6f
  Actual: 0b5f794556718349b03ca5bb3c8d336f904fc4d3db6bf58e195fed75f490847b
    File: /Users/username/Library/Caches/Homebrew/downloads/ce82a7b3dbc661562d8eb59c1a07a6442efdf4d34d65bca8cdb595a80c94cc65--Monal.alpha.tar
To retry an incomplete download, remove the file above

[SMillerDev]

But I strongly believe that this should not be neccessary and homebrew should not somehow cache the old download in the first place.

Why would it not cache what it downloads? That's pretty much the standard behaviour for things that download. The real problem here seems to be that the cask defines a version and checksum, but the download is unversioned. So any changes in the uploaded file will break the checksum.

To avoid this, brew style would tell you to use version :latest and sha256 :no_check

[tmolitor-stud-tu]

That's pretty much the standard behaviour for things that download.

No, the standard behaviour is to use HTTP HEAD requests to check if the ETAG header changed and if so download a new copy.
Nothing in the HTTP RFCs tells you that the resource of an URL isn't allowed to change. Using versioned URLs is just a dirty workaround for software not behaving properly (e.g. not checking the ETAG etc.).

More than that: the version in the metadata even changed, too, which is also a hint that a new download should be made rather than using the old cached one.

To avoid this, brew style would tell you to use version :latest and sha256 :no_check

No, I don't want to use sha256 :no_check, that one would make the download much more insecure because the checksum won't be checked anymore. (Yes, I know there is HTTPS, but MITMing the download server at large scale (e.g. bein near it network-wise) is much easier than MITMing the download server AND the git repo holding the metadata.)

Last but not least: homebrew did it right all the years up until now and I believe that bug got introduced when the caching logic was changed a few month back.

[p-linnane]

The bottom line is that you can either use a versioned URL, or not check the hash.

[tmolitor-stud-tu]

Well, that's not how HTTP or URLs are meant to work, but since there is a workaround (not a proper fix), I'm okay with that.

[p-linnane]

Feel free to submit a PR if you'd like to see the behavior changed. We'd review it.