Bad checksum for itk in tcl-tk formula

[twogee]

brew gist-logs <formula> link OR brew config AND brew doctor output

HOMEBREW_VERSION: 4.4.14-16-gddbb497
ORIGIN: https://github.com/Homebrew/brew.git
HEAD: ddbb497f5ad895e4d400a303bde9c149e9ea7b72
Last commit: 2 hours ago
Branch: master
Core tap HEAD: 34b732b38991b8b2f26b592d87287ebc77937f19
Core tap last commit: 1 year, 11 months ago
Core tap JSON: 01 Jan 14:25 UTC
Core cask tap HEAD: b69d2bf867caa0e715e347d16402a6d59c744167
Core cask tap last commit: 1 year, 11 months ago
Core cask tap JSON: 01 Jan 14:25 UTC
HOMEBREW_PREFIX: /usr/local
HOMEBREW_CASK_OPTS: []
HOMEBREW_DISPLAY: /private/tmp/com.apple.launchd.HIyOaRtKJ7/org.xquartz:0
HOMEBREW_MAKE_JOBS: 4
HOMEBREW_SORBET_RUNTIME: set
Homebrew Ruby: 3.3.6 => /usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby/3.3.6/bin/ruby
CPU: quad-core 64-bit broadwell
Clang: 14.0.0 build 1400
Git: 2.37.1 => /Applications/Xcode.app/Contents/Developer/usr/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 12.7.6-x86_64
CLT: 14.2.0.0.1.1668646533
Xcode: 14.2

Verification

• My brew doctor output says Your system is ready to brew. and am still able to reproduce my issue.
• I ran brew update and am still able to reproduce my issue.
• I have resolved all warnings from brew doctor and that did not fix my problem.
• I searched for recent similar issues at https://github.com/Homebrew/homebrew-core/issues?q=is%3Aissue and found no duplicates.

What were you trying to do (and why)?

brew upgrade tcl-tk

What happened (include all command output)?

==> Upgrading 1 outdated package:
tcl-tk 9.0.0_1 -> 9.0.1
==> Fetching tcl-tk
==> Downloading https://raw.githubusercontent.com/Homebrew/homebrew-core/652a59fabf8f6aea2597349843b687b201e37d79/Formula/t/tcl-tk.rb
Already downloaded: /Users/twogee/Library/Caches/Homebrew/downloads/31dad0bcc0a4025e2a881389607b77b73d816cc04239e3dc21e8e6210e53406a--tcl-tk.rb
==> Downloading https://github.com/andreas-kupries/critcl/archive/refs/tags/3.3.1.tar.gz
==> Downloading from https://codeload.github.com/andreas-kupries/critcl/tar.gz/refs/tags/3.3.1
-#O=- # # #
==> Downloading https://downloads.sourceforge.net/project/tcllib/tcllib/2.0/tcllib-2.0.tar.xz
==> Downloading from https://deac-riga.dl.sourceforge.net/project/tcllib/tcllib/2.0/tcllib-2.0.tar.xz?viasf=1
############################################################################################################################################################## 100.0%
==> Downloading https://core.tcl-lang.org/tcltls/tarball/e03e54ee87/tcltls-e03e54ee87.tar.gz
############################################################################################################################################################## 100.0%
==> Downloading https://downloads.sourceforge.net/project/tcl/Tcl/9.0.1/tk9.0.1-src.tar.gz
Already downloaded: /Users/twogee/Library/Caches/Homebrew/downloads/912791d74912f0b9c0666014efeae1d728bded063099b78f645f7ade9ff90661--tk9.0.1-src.tar.gz
==> Downloading https://github.com/tcltk/itk/archive/refs/tags/itk-4-2-3.tar.gz
==> Downloading from https://codeload.github.com/tcltk/itk/tar.gz/refs/tags/itk-4-2-3
##O=# #
Error: SHA256 mismatch
Expected: 3eea66dfc57259d85ad741a01786b70ae4b3ae9774d27e24f7d0917c7451e94b
Actual: bc5ed347212fce403e04d3161cd429319af98da47effd3e32e20d2f04293b036
File: /Users/twogee/Library/Caches/Homebrew/downloads/017231b9c6449bf2675eb6b543e5d03d1e44fc98b707a9dbd0f64502e1b0064e--itk-itk-4-2-3.tar.gz
To retry an incomplete download, remove the file above.

What did you expect to happen?

I expected the upgrade to complete without a hitch.

Step-by-step reproduction instructions (by running brew commands)

brew cleanup
brew upgrade tcl-tk

[SMillerDev]

See https://github.com/orgs/Homebrew/discussions/5835

[twogee]

Well, I suppose a new release (9.0.1_1) might correct the issue?

[SMillerDev]

Did they make a new release? Because Homebrew can't just trust that a replaced release is good, we need to be sure it was intentional and not a compromised repo.
The git manual says re-tagging is "the insane thing" to do, so we generally assume it's a security incident upstream.

[miladfathi021]

How can i fix this?

Error: SHA256 mismatch
Expected: 3eea66dfc57259d85ad741a01786b70ae4b3ae9774d27e24f7d0917c7451e94b
Actual: bc5ed347212fce403e04d3161cd429319af98da47effd3e32e20d2f04293b036
File: /Users/x/Library/Caches/Homebrew/downloads/017231b9c6449bf2675eb6b543e5d03d1e44fc98b707a9dbd0f64502e1b0064e--itk-itk-4-2-3.tar.gz
To retry an incomplete download, remove the file above.

[daeho-ro]

I have opened a PR for this and waiting for a response from the upstream.

• tcl-tk: itk checksum update #203973