Nvm: NVM uses packages which failed checksum, with warning only. It should fail to install, instead.

[dooglio]

• Operating system and version:
  Mac OS/X High Sierra

• nvm debug output:
  

  
  

nvm --version: v0.33.11
$TERM_PROGRAM: Apple_Terminal
$SHELL: /bin/bash
$SHLVL: 1
$HOME: /Users/doug
$NVM_DIR: '$HOME/.nvm'
$PATH: $NVM_DIR/versions/node/v10.4.0/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/Applications/VMware Fusion.app/Contents/Public
$PREFIX: ''
$NPM_CONFIG_PREFIX: ''
$NVM_NODEJS_ORG_MIRROR: ''
$NVM_IOJS_ORG_MIRROR: ''
shell version: 'GNU bash, version 3.2.57(1)-release (x86_64-apple-darwin17)'
uname -a: 'Darwin 17.6.0 Darwin Kernel Version 17.6.0: Tue May 8 15:22:16 PDT 2018; root:xnu-4570.61.1~1/RELEASE_X86_64 x86_64'
OS version: Mac 10.13.5 17F77
curl: /usr/bin/curl, curl 7.54.0 (x86_64-apple-darwin17.0) libcurl/7.54.0 LibreSSL/2.0.20 zlib/1.2.11 nghttp2/1.24.0
wget: /usr/local/bin/wget, GNU Wget 1.19.4 built on darwin17.3.0.
git: /usr/bin/git, git version 2.15.2 (Apple Git-101.1)
grep: /usr/bin/grep, grep (BSD grep) 2.5.1-FreeBSD
awk: /usr/bin/awk, awk version 20070501
sed: illegal option -- -
usage: sed script [-Ealn] [-i extension] [file ...]
       sed [-Ealn] [-i extension] [-e script] ... [-f script_file] ... [file ...]
sed: /usr/bin/sed, 
cut: illegal option -- -
usage: cut -b list [-n] [file ...]
       cut -c list [file ...]
       cut -f list [-s] [-d delim] [file ...]
cut: /usr/bin/cut, 
basename: illegal option -- -
usage: basename string [suffix]
       basename [-a] [-s suffix] string [...]
basename: /usr/bin/basename, 
rm: illegal option -- -
usage: rm [-f | -i] [-dPRrvW] file ...
       unlink file
rm: /bin/rm, 
mkdir: illegal option -- -
usage: mkdir [-pv] [-m mode] directory ...
mkdir: /bin/mkdir, 
xargs: illegal option -- -
usage: xargs [-0opt] [-E eofstr] [-I replstr [-R replacements]] [-J replstr]
             [-L number] [-n number [-x]] [-P maxprocs] [-s size]
             [utility [argument ...]]
xargs: /usr/bin/xargs, 
nvm current: v10.4.0
which node: $NVM_DIR/versions/node/v10.4.0/bin/node
which iojs: 
which npm: $NVM_DIR/versions/node/v10.4.0/bin/npm
npm config get prefix: $NVM_DIR/versions/node/v10.4.0
npm root -g: $NVM_DIR/versions/node/v10.4.0/lib/node_modules

• nvm ls output:
  
  
  

         v8.2.1
         v8.9.3
->      v10.4.0
default -> 8.2.1 (-> v8.2.1)
node -> stable (-> v10.4.0) (default)
stable -> 10.4 (-> v10.4.0) (default)
iojs -> N/A (default)
lts/* -> lts/carbon (-> N/A)
lts/argon -> v4.9.1 (-> N/A)
lts/boron -> v6.14.3 (-> N/A)
lts/carbon -> v8.11.3 (-> N/A)

• How did you install nvm? (e.g. install script in readme, Homebrew):
  From script on main site.

• What steps did you perform?
  I had v8.9.3 "used" and wanted to switch to an later version. I typed in nvm use v10.4.0. Nvm told me it was not installed so I ran the install command: nvm install v10.4.0.

• What happened?
  I had an outdated version of shasum sitting in my /usr/local/bin folder, which was giving me wrong checksums. When I attempted to install node, the checksum test failed, but it downloaded the package anyway, and installed it. Here is the output:

$ nvm install v10.4.0
Downloading and installing node v10.4.0...
Local cache found: $NVM_DIR/.cache/bin/node-v10.4.0-darwin-x64/node-v10.4.0-darwin-x64.tar.gz
Computing checksum with sha256sum
Checksums do not match: 'ae191912605f3ebc9d17ef58d1e6b976b1ce6e8d' found, '82b27983c990a6860e8d729e0b15acf9643ffca0eff282a926268849dfd2c3d2' expected.
Checksum check failed!
Removing the broken local cache...
Downloading https://nodejs.org/dist/v10.4.0/node-v10.4.0-darwin-x64.tar.gz...
######################################################################## 100.0%
Computing checksum with sha256sum
Checksums do not match: 'ae191912605f3ebc9d17ef58d1e6b976b1ce6e8d' found, '82b27983c990a6860e8d729e0b15acf9643ffca0eff282a926268849dfd2c3d2' expected.
Now using node v10.4.0 (npm v6.1.0)

• What did you expect to happen?
  I expected nvm to fail the installation with an error, and refuse to use the version which failed the checksum.

• Is there anything in any of your profile files (.bashrc, .bash_profile, .zshrc, etc) that modifies the PATH?
  No.

[ljharb]

Thanks - this definitely seems like a bug in the fallback logic.

[dooglio]

Just to add more clues--it's when I had the brew package vim installed. It brings in perl as a dependency, and that package installs shasum in /usr/local/bin.

The interesting thing:

$ /usr/bin/shasum --version
5.84

whereas:

$ /usr/local/bin/shasum --version 
6.01

Clearly, the package signing is happening with the builtin version of shasum, not the brew version. The later version fails the checksum.

[ljharb]

Indeed, nvm is assuming the builtin version of shasum. However, I don't understand why any implementation of shasum would be using a different algorithm :-/

[dooglio]

This puzzles me as well. Do you think it could have to do with a newline at the end of input?

[ljharb]

I suppose that's possible - if the file has one, perhaps one of the versions trims it before summing - and if not, perhaps one of them appends it before summing.

[dooglio]

Want me to leave this open? Is this still being investigated?

[ljharb]

Yes, I'd prefer to leave it open indefinitely until we can fix it. Is it still happening for you?

[dooglio]

I haven't experienced it in many months, but then again, I use the shasum util from Mac Brew.