SHA256 Mismatch on Homebrew Install about snapcast HOT 7 CLOSED

I'm having the same issue on MacOS

from snapcast.

Yes, looks like the snapcast.rb is using the wrong checksum. This issue must be fixed in the homebrew project, you should file an issue at homebrew or make a PR.

from snapcast.

I've opened an issue with the homebrew-core repo. I'll make a PR as well.

Homebrew/homebrew-core#177612

from snapcast.

Since the checksum is checked in CI it appears that the release was at some point using that checksum.
The git manual says re-tagging is "the insane thing" to do, so it would be good to check if it's that or the release has been compromised.

from snapcast.

@SMillerDev That's fair. Homebrew is pulling from https://github.com/badaix/snapcast/archive/refs/tags/v0.28.0.tar.gz . @badaix do you think this was just an oversight somewhere or something more malicious?

from snapcast.

Sorry, this was my fault, as far as I remember I found a bug in context of Snapdroid, which pulls tagged versions of Snapcast in the CI build, I fixed the bug and moved the tag.
I wasn't aware that other third parties are triggering on tags. Very important insight, I will not do this in future, but rather make another dot release instead for fixes.

from snapcast.

Thanks for checking into this! There's definitely a lot of moving pieces between all this stuff. Should I close the homebrew-core issue and wait for a dot release? Or is there something we still need to do with them?

from snapcast.