Homebrew-cask: little-flocker hash mismatch

[jwm]

The cask for Little Flocker fails to install due to a hash mismatch:

[jwm@hobbes:s001 ~> brew cask install --force little-flocker
==> Caveats
You must reboot for the installation of little-flocker to take effect.

==> Satisfying dependencies
complete
==> Downloading https://www.littleflocker.com/downloads/LittleFlocker-1.6.4.dmg
######################################################################## 100.0%
==> Verifying checksum for Cask little-flocker
==> Note: running "brew update" may fix sha256 checksum errors
Error: sha256 mismatch
Expected: 39296b3e4418370ba9e0c4a1fa621179ff1c1d75316b38d9464e3a5c517e6240
Actual: 0d23fdecd16cefdaee09a73f3edb7594f3bd2d3585550818fa90426d49053ae3
File: /Users/jwm/Library/Caches/Homebrew/Cask/little-flocker--1.6.4.dmg
To retry an incomplete download, remove the file above.

Downloading its .dmg manually yields the "incorrect" hash, but the .pkg code signature is correct.

[jwm@hobbes:s001 ~> wget https://www.littleflocker.com/downloads/LittleFlocker-1.6.4.dmg
--2017-03-27 14:01:26--  https://www.littleflocker.com/downloads/LittleFlocker-1.6.4.dmg
Resolving www.littleflocker.com... 2400:cb00:2048:1::6819:2316, 2400:cb00:2048:1::6819:2216, 104.25.34.22, ...
Connecting to www.littleflocker.com|2400:cb00:2048:1::6819:2316|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 7871615 (7.5M) [application/x-apple-diskimage]
Saving to: ‘LittleFlocker-1.6.4.dmg’

LittleFlocker-1.6.4.dmg           100%[==========================================================>]   7.51M  12.1MB/s    in 0.6s

2017-03-27 14:01:27 (12.1 MB/s) - ‘LittleFlocker-1.6.4.dmg’ saved [7871615/7871615]
[jwm@hobbes:s001 ~> shasum -a 256 LittleFlocker-1.6.4.dmg
0d23fdecd16cefdaee09a73f3edb7594f3bd2d3585550818fa90426d49053ae3  LittleFlocker-1.6.4.dmg

Maybe the PR updating Little Flocker to 1.6.4 (#31322) used the wrong hash? I contacted [email protected]. He declined to provide .dmg hashes and advised that the code signature on the package was the best way to verify authenticity.

[gobinathm]

Submitted a PR to correct this problem #31390

@jwm you can run the following to command to check the hash

$ shasum -a 256 ~/Desktop/LittleFlocker-1.6.4.dmg
0d23fdecd16cefdaee09a73f3edb7594f3bd2d3585550818fa90426d49053ae3  /Users/gobinathm/Desktop/LittleFlocker-1.6.4.dmg

Incase you want this to be installed before my PR is merged, you can utilize the below command to do so.

brew cask install https://raw.githubusercontent.com/gobinathm/homebrew-cask/cask-repair_update-little-flocker/Casks/little-flocker.rb

[Miladiir]

Hey guys,
this is somewhat unrelated, but littleflocker.com has been down for like 4 days now. I am still on 1.6.0 and cannot update the installation.
Do any of you guys still have the dmg downloaded locally? If so, do you mind sharing it?

Jonathan seems to have performed a hit and run after being hired by Apple, or they required him to seize supporting and offering Little Flocker. 🤷‍♂️

[levanid]

I had the same request as @Miladiir
Could you please share the latest DMG with me too
https://www.littleflocker.com/downloads/LittleFlocker-1.6.4.dmg is unavailable due to LittleFlocker being acquired by F-secure

[Miladiir]

Like levanid says, Little Flocker was acquired. Licences are still honored. Download of the "new" product will probably available soon: https://campaigns.f-secure.com/xfence/

[Thireus]

Hi guys, does anyone have the latest LittleFlocker-1.6.4.dmg and can share it or host it somewhere please?

[vitorgalvao]

Pinging @miccal in case he has one.

[vitorgalvao]

Also asked on twitter (but that shouldn’t get your hopes up much, that account has less than 150 followers).

[Thireus]

Thanks @vitorgalvao, got it and re-uploaded it:

https://thireus.com/LITTLEFLOCKER/LittleFlocker-1.6.4.dmg

codesign -dv LittleFlocker-1.6.4.dmg:

Identifier=com.zdziarski.LittleFlocker
Format=disk image
CodeDirectory v=20200 size=315 flags=0x0(none) hashes=1+6 location=embedded
Signature size=8911
Timestamp=26 mars 2017 à 21:17:32
Info.plist=not bound
TeamIdentifier=ZDK8E23U52
Sealed Resources=none
Internal requirements count=1 size=188

codesign --verify --strict --verbose LittleFlocker-1.6.4.dmg:

LittleFlocker-1.6.4.dmg: valid on disk
LittleFlocker-1.6.4.dmg: satisfies its Designated Requirement

SHA256: 0d23fdecd16cefdaee09a73f3edb7594f3bd2d3585550818fa90426d49053ae3

https://www.virustotal.com/en/file/0d23fdecd16cefdaee09a73f3edb7594f3bd2d3585550818fa90426d49053ae3/analysis/

[miccal]

I did not have the dmg, thanks @Thireus.

[rdrop]

Thank you @Thireus!

Thoughts on this (from your virustotal.com link):

Antivirus --> Result --> Update
Symantec --> OSX.Malcol --> 20170808

SHA256 Update March 27
+ sha256 '0d23fdecd16cefdaee09a73f3edb7594f3bd2d3585550818fa90426d49053ae3'

SHA256 Update March 26
+ sha256 '39296b3e4418370ba9e0c4a1fa621179ff1c1d75316b38d9464e3a5c517e6240'

Path                 : $HOME/Downloads/LittleFlocker-1.6.4.dmg
SHA-256              : 0d23fdecd16cefdaee09a73f3edb7594f3bd2d3585550818fa90426d49053ae3
SHA-1                : b191ccf7d58d77c68cef8ee24f9974ec382d891c
Download Timestamp   : 2017/08/08 12:23:16 -0700
Type                 : Disk Image
Code-signed          : Yes
Rule                 : $RULE
Signing Chain:
     1. SHA-256             : 6d88e0a62f2b2f7839d45eb72f7d9db9c0eb27d75e76e2b5bcae852369e78b1d
        SHA-1               : 4ca1ca03aaea186ac8332d1a9994628a5e36d59e
        Common Name         : Developer ID Application: Jonathan Zdziarski (ZDK8E23U52)
        Organization        : Jonathan Zdziarski
        Organizational Unit : ZDK8E23U52
        Valid From          : 2016/09/02 13:45:57 -0700
        Valid Until         : 2021/09/03 13:45:57 -0700

     2. SHA-256             : 7afc9d01a62f03a2de9637936d4afe68090d2de18d03f29c88cfb0b1ba63587f
        SHA-1               : 3b166c3b7dc4b751c9fe2afab9135641e388e186
        Common Name         : Developer ID Certification Authority
        Organization        : Apple Inc.
        Organizational Unit : Apple Certification Authority
        Valid From          : 2012/02/01 14:12:15 -0800
        Valid Until         : 2027/02/01 14:12:15 -0800

     3. SHA-256             : b0b1730ecbc7ff4505142c49f1295e6eda6bcaed7e2c68c5be91b5a11001f024
        SHA-1               : 611e5b662c593a08ff58d14ae22452d198df6c60
        Common Name         : Apple Root CA
        Organization        : Apple Inc.
        Organizational Unit : Apple Certification Authority
        Valid From          : 2006/04/25 14:40:36 -0700
        Valid Until         : 2035/02/09 13:40:36 -0800