mbedtls formula uses outdated SHA256 hash

[angryzor]

Output of brew config

HOMEBREW_VERSION: 4.5.13-42-gbcdb1d3
ORIGIN: https://github.com/Homebrew/brew
HEAD: bcdb1d3af6666c6c75f0bcf6b6d0750828cc19dc
Last commit: 74 minutes ago
Branch: main
Core tap HEAD: 9fd68fefe6c266e8dd269835e56230a9fb6225ef
Core tap last commit: 29 minutes ago
Core tap JSON: 31 Jul 14:51 UTC
Core cask tap JSON: 31 Jul 14:51 UTC
HOMEBREW_PREFIX: /usr/local
HOMEBREW_CASK_OPTS: []
HOMEBREW_DISPLAY: /private/tmp/com.apple.launchd.VPSH2SQ01W/org.xquartz:0
HOMEBREW_MAKE_JOBS: 8
HOMEBREW_SORBET_RUNTIME: set
Homebrew Ruby: 3.4.5 => /usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby/3.4.5/bin/ruby
CPU: octa-core 64-bit skylake
Clang: 14.0.0 build 1400
Git: 2.50.1 => /usr/local/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 12.7.6-x86_64
CLT: 14.2.0.0.1.1668646533
Xcode: N/A

Output of brew doctor

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Unbrewed header files were found in /usr/local/include.
If you didn't put them there on purpose they could cause problems when
building Homebrew formulae and may need to be deleted.

Unexpected header files:
  /usr/local/include/node/*

Warning: You are using macOS 12.
We (and Apple) do not provide support for this old version.

This is a Tier 3 configuration:
  https://docs.brew.sh/Support-Tiers#tier-3
You can report Tier 3 unrelated issues to Homebrew/* repositories!
Read the above document instead before opening any issues or PRs.


Warning: Homebrew's "sbin" was not found in your PATH but you have installed
formulae that put executables in /usr/local/sbin.
Consider setting your PATH for example like so:
  fish_add_path /usr/local/sbin

Description of issue

My macOS is version 12 and for that reason I cannot get the output out of brew doctor that is required for me to be allowed to post a real issue, but I am 100% certain that my issue is not caused by my outdated OS.

The project mbedtls just a few hours ago released a new tarball with a different hash for version 3.6.4:

• https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.4
• See mbedTLS 3.6.4, required pre-generated psa_crypto_driver_wrappers.h and psa_crypto_driver_wrappers_no_static.c are missing. Mbed-TLS/mbedtls#10332

This causes the mbedtls formula to reject the download:

==> Fetching downloads for: mbedtls
==> Downloading https://raw.githubusercontent.com/Homebrew/homebrew-core/9fd68fefe6c266e8dd269835e56230a9fb6225ef/Formula/m/mbedtls.rb
####################################################################################################################################################################################################################################### 100.0%
==> Fetching mbedtls
==> Downloading https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-3.6.4/mbedtls-3.6.4.tar.bz2
Already downloaded: /Users/<user>/Library/Caches/Homebrew/downloads/62716b684d8cbe23bd924da5349dd02ae14785788bd6ea4bbd99bf6f4e5f1308--mbedtls-3.6.4.tar.bz2
Error: mbedtls: SHA256 mismatch
Expected: ec35b18a6c593cf98c3e30db8b98ff93e8940a8c4e690e66b41dfc011d678110
  Actual: 6a7ed66b4aca38836f0eff8d8fba72992bf0c7326337608ef01de469fd8368bd
    File: /Users/<user>/Library/Caches/Homebrew/downloads/62716b684d8cbe23bd924da5349dd02ae14785788bd6ea4bbd99bf6f4e5f1308--mbedtls-3.6.4.tar.bz2
To retry an incomplete download, remove the file above.

I can't make a PR because this formula is managed by BrewTestBot

[SMillerDev]

The git manual says re-tagging is "the insane thing" to do. Are you sure this was a legit change of an existing tag?

[angryzor]

I agree though, that this is a weird way to solve an issue, especially considering this is a crypto package. It makes the change look suspicious.

[gilles-peskine-arm]

Mbed TLS maintainer here. We didn't change any tag. We only re-generated a tarball attached to the release announcement, with the same file contents.

While we provide tarballs, the way we create them is currently not reproducible (they're basically from git archive, so they have non-reproducible author names, timestamps, I'm not sure offhand about the file order, and compression). Furthermore, the way we distribute them is through GitHub release announcements, which do not have an audit trace (even repository administrators can't see the release history).

If you care at all about auditability, I would strongly recommend using the git tag instead. Getting a release from git requires more tooling (you need to run the pre-configure step yourself, whereas tarballs have ready-to-build .c files), but that's trivial by brew's standards (git, perl, python and a couple of python packages).

[p-linnane]

We try to avoid checking out tags unless absolutely necessary. It's much easier for us to just fetch a tarball.

I'm sympathetic to having a release issue. As you can see though, modifying anything existing will always cause issues. The moment you release something, it's consumed, and users will have expectations about it. It's better to simply create a new patch release or something with whatever was fixed, even if the underlying code is unchanged.

I'll open a PR to update the checksum in the formula since we have confirmation this is an intended change.

[p-linnane]

Homebrew/homebrew-core#231921

[p-linnane]

The original tarball has been restored, so no changes are needed to the formula now.