homebrew - force install even with SHA1 mismatch

Question

I'm installing something through homebrew but one of it's dependencies is failing to install, saying that the downloaded artifact has a different SHA1 checksum than what homebrew expects. The culprit is suite-sparse v4.2.1 and from checking the homebrew issue tracker, it seems the owner of this package has a tendency to make changes without bumping versions.

I have a ticket in with the homebrew experts to double check this package and vet the new SHA1. In the meantime..

Is it possible to force homebrew to install a package even if the SHA1 is incorrect?

I don't mind doing a little manual installing, so long as the package remains homebrew friendly and a future brew update will update to the latest version without issues.

Answer 1

I don't mind doing a little manual installing

In that case, clone the homebrew repo; update the suite-sparse sha1 (i.e. to get it, use the shasum binary -- you should already have this; if you do not, go ahead and install it).

Once you've saved the formula with the updated sha1 value, you don't even have to push it back up to github; you can just install it in place.

% brew install suite-sparse.rb

Alternatively, you can do:

% brew install whatever --ignore-dependencies

Answer 2

I had a problem like this when installing gcc48 / gcc49 or any version of gcc through brew. The problem was with libmpc08:

Error: SHA1 mismatch
Expected: 5ef03ca7aee134fe7dfecb6c9d048799f0810278
Actual: 5900fdfc7894c52ce7a3ab7ea6ebd29af22f0b70
Archive: /Library/Caches/Homebrew/libmpc08-0.8.1.tar.gz
To retry an incomplete download, remove the file above.

I solved the problem by editing the expected sha1 entry in the brew formula with the command brew edit [formula]

I downloaded the libmpc08 file directly from the server specified by brew and used mv to copy it into /Library/Caches/Homebrew/ with the filename expected by brew. The same error occurred with the SHA1 mismatch but the download appeared to be correct as I had downloaded it and checked the contents.

Using brew edit libmpc08 brings up the formula in native text editor. I found the line:

sha1 '5ef03ca7aee134fe7dfecb6c9d048799f0810278'

and changed it to

sha1 '5900fdfc7894c52ce7a3ab7ea6ebd29af22f0b70'

Saved and ran brew install gcc49 installation went ahead perfectly.

Answer 3

Warning: Only use this in cases you know what you are doing and trust the source of the formula AND the downloaded binary. If you randomly come across the SHA mismatch error when installing software via brew, do not proceed and report it here or in the respective formula repository. You might also be able to install an older version if available instead.

Assuming brew install <formula> failed with SHA mismatch:

1. brew edit <formula> - should open editor
2. comment out any sha... lines by prefixing with #
3. save file
4. brew install <formula>