'brew cask install djview' causes sha2 mismatch

[jab]

brew cask install djview
==> Downloading https://downloads.sourceforge.net/sourceforge/djvu/djvulibre-3.5.22%2Bdjview-4.5-intel-3.zip
######################################################################## 100.0%
==> Note: running "brew update" may fix checksum errors
Error: SHA2 mismatch
Expected: eec2efee86136725ae0a7164f80e2cea428c647fe987e3b6843b81280c7c7664
Actual: 44333bdc0578acb013920be0810da549fbdaa0be988fd4ebaf9a109715fbfff2
Archive: /Library/Caches/Homebrew/djview-4.5.zip
To retry an incomplete download, remove the file above.

Will try to send a PR if no one beats me to it.

[jab]

(this is with a freshly brew-updated system)

[fanquake]

I've just downloaded the file and can confirm the cask SHA is correct. Is it possible you have a corrupted download?

[jab]

Not possible I think since if someone were MITMing the https connection curl would detect it and refuse to download the file (-k / --insecure is not being passed to curl).

~> rm /Library/Caches/Homebrew/djview-4.5.zip
remove /Library/Caches/Homebrew/djview-4.5.zip? y
/Library/Caches/Homebrew/djview-4.5.zip
~> brew cask install --verbose djview
==> Downloading https://downloads.sourceforge.net/sourceforge/djvu/djvulibre-3.5.22%2Bdjview-4.5-intel-3.zip
/usr/bin/curl -fLA Homebrew 0.9.5 (Ruby 2.0.0-481; Mac OS X 10.9.5) https://downloads.sourceforge.net/sourceforge/djvu/djvulibre-3.5.22%2Bdjview-4.5-intel-3.zip -C 0 -o /Library/Caches/Homebrew/djview-4.5.zip.incomplete
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0   444    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0   502    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100 45927  100 45927    0     0  31886      0  0:00:01  0:00:01 --:--:-- 31886
==> Note: running "brew update" may fix checksum errors
Error: SHA2 mismatch
Expected: eec2efee86136725ae0a7164f80e2cea428c647fe987e3b6843b81280c7c7664
Actual: 312b044c31aea57ac5a740b3ccc76f455a13ff4768c6b4c0e40582fbeee89a76
Archive: /Library/Caches/Homebrew/djview-4.5.zip
To retry an incomplete download, remove the file above.
Kernel.exit
~> brew update
Already up-to-date.

Any ideas?

[jab]

Can you post your output for brew cask install --verbose djview @fanquake?

[fanquake]

~ $ brew cask install --verbose djview
==> Downloading https://downloads.sourceforge.net/sourceforge/djvu/djvulibre-3.5.22%2Bdjview-4.5-intel-3.zip
/usr/bin/curl -fLA Homebrew 0.9.5 (Ruby 2.0.0-481; Mac OS X 10.9.5) https://downloads.sourceforge.net/sourceforge/djvu/djvulibre-3.5.22%2Bdjview-4.5-intel-3.zip -C 0 -o /Library/Caches/Homebrew/djview-4.5.zip.incomplete
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0   444    0     0    0     0      0      0 --:--:--  0:00:02 --:--:--     0
  0   411    0     0    0     0      0      0 --:--:--  0:00:02 --:--:--     0
100 9107k  100 9107k    0     0   623k      0  0:00:14  0:00:14 --:--:--  788k
==> Extracting nested container djvulibre-3.5.22+djview-4.5-intel.dmg
==> Symlinking App 'DjView.app' to '/Users/michaelford/Applications/DjView.app'
==> Generic artifacting Artifact 'DjView.app' to '/Users/michaelford/Applications/DjView.app'
🍺  djview staged at '/opt/homebrew-cask/Caskroom/djview/4.5' (161 files, 31M)
Kernel.exit

[jab]

Well that would be much more helpful if brew cask install --verbose output the checksum when it matches the expected one as well as when it doesn't.

[jab]

Could you run shasum -a 256 /Library/Caches/Homebrew/djview-4.5.zip and report what you get? I assume it matches the expected eec2efee86136725ae0a7164f80e2cea428c647fe987e3b6843b81280c7c7664 but might as well confirm.

[fanquake]

$ shasum -a 256 /Library/Caches/Homebrew/djview-4.5.zip
eec2efee86136725ae0a7164f80e2cea428c647fe987e3b6843b81280c7c7664  /Library/Caches/Homebrew/djview-4.5.zip

[jab]

Ok thanks. Any other ideas? Load balancer seeing you in Australia so you get served a correct copy of the file from somewhere near you, while I get served a stale or corrupted copy from a server near me?

[jab]

lolcask:

~> file /Library/Caches/Homebrew/djview-4.5.zip
/Library/Caches/Homebrew/djview-4.5.zip: HTML document, UTF-8 Unicode text, with very long lines

~> cat /Library/Caches/Homebrew/djview-4.5.zip | pup '#starting'
<div id="starting">
 <h1>
  <a href="/projects/djvu/">
   DjVuLibre
  </a>
 </h1>
 <p id="downloader">
  Your download will start shortly...
 </p>
 <script id="redirect-template" type="text/x-handlebars-template">
  Learn more: check out <a href="/projects/djvu/postdownload">screenshots, reviews, and more</a>. We'll take you there in a few moments.
 </script>
 <p id="problems">
  Problems with the download?  Please use this
  <a href="http://downloads.sourceforge.net/project/djvu/DjVuLibre_MacOS/3.5.22%2B4.5/djvulibre-3.5.22%2Bdjview-4.5-intel-3.zip?r=http%3A%2F%2Fdownloads.sourceforge.net%2Fproject%2Fdjvu%2FDjVuLibre_MacOS%2F3.5.22%252B4.5%2Fdjvulibre-3.5.22%252Bdjview-4.5-intel-3.zip&ts=1414987565&use_mirror=hivelocity" class="direct-download">
   direct link
  </a>
  , or try another
  <a href="/settings/mirror_choices?projectname=djvu&filename=DjVuLibre_MacOS/3.5.22%2B4.5/djvulibre-3.5.22%2Bdjview-4.5-intel-3.zip" title="A mirror is an exact copy of a download available in multiple locations around the world.  Select the one closest to your location." class="mirror" data-release-url="http://downloads.sourceforge.net/project/djvu/DjVuLibre_MacOS/3.5.22%2B4.5/djvulibre-3.5.22%2Bdjview-4.5-intel-3.zip?r=http%3A%2F%2Fdownloads.sourceforge.net%2Fproject%2Fdjvu%2FDjVuLibre_MacOS%2F3.5.22%252B4.5%2Fdjvulibre-3.5.22%252Bdjview-4.5-intel-3.zip&ts=1414987565&use_mirror=hivelocity" rel="nofollow">
   mirror
  </a>
  .
 </p>
</div>

[tapeinosyne]

Do you have a custom .curlrc?

[jab]

In fact I do!

# based on https://github.com/mathiasbynens/dotfiles/blob/master/.curlrc

user-agent = "Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0"

# When following a redirect, automatically set the previous URL as referer
referer = ";auto"

Moved that aside and now it worked. Good thinking!

Should cask be passing curl the -q option? From man curl:

       -q     If used as the first parameter on the command line, the curlrc config file will not be read and
              used. See the -K, --config for details on the default config file search path.

[tapeinosyne]

I doubt we should enforce “naked” curl: there are options which do not impede Cask's function, and ignoring them might suprise users.

However, we should document the fact that certain curl configurations can cause unexpected failures with Cask. Thanks for bringing the problem to our attention.