Are sha256 checksum disabled?

[eblot]

Output of brew config

HOMEBREW_VERSION: 4.3.21
ORIGIN: https://github.com/Homebrew/brew
HEAD: c5d09b411776547bdbc8e0435deaf690ca632413
Last commit: 4 days ago
Core tap JSON: 16 Sep 09:11 UTC
Core cask tap JSON: 16 Sep 09:11 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_DISPLAY: /private/tmp/com.apple.launchd.lRW9S305cx/org.xquartz:0
HOMEBREW_MAKE_JOBS: 10
HOMEBREW_NO_INSTALL_CLEANUP: set
Homebrew Ruby: 3.3.4 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.3.4_1/bin/ruby
CPU: 10-core 64-bit arm_firestorm_icestorm
Clang: 15.0.0 build 1500
Git: 2.46.1 => /opt/homebrew/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 14.6.1-arm64
CLT: 15.3.0.0.1.1708646388
Xcode: 15.4
Rosetta 2: false

Output of brew doctor

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Some installed kegs have no formulae!
This means they were either deleted or installed manually.
You should find replacements for the following formulae:
  python-mako
  urjtag
  python-markupsafe

Warning: You have unlinked kegs in your Cellar.
Leaving kegs unlinked can lead to build-trouble and cause formulae that depend on
those kegs to fail to run properly once built. Run `brew link` on these:
  pygments
  python-mako
  arm-none-eabi-gdb
  wireshark
  python-markupsafe

Warning: Homebrew's "sbin" was not found in your PATH but you have installed
formulae that put executables in /opt/homebrew/sbin.
Consider setting your PATH for example like so:
  echo 'export PATH="/opt/homebrew/sbin:$PATH"' >> ~/.zshrc

Description of issue

While upgrading a custom formula, I've noticed that brew no longer check for shasum match.
Whatever the shasum (missing or invalid), the formula is installed straight. brew install no longer complain about an invalid shasum or suggest the shasum when it is missing. Even weirder, --required-sha seems to do nothing, even when no shasum line is defined in the formula.

Am I missing something obvious / is brew shasum system has changed recently?
Thanks.

brew install --require-sha eblot/devtools/gtkwave
==> Fetching dependencies for eblot/devtools/gtkwave: jpeg-turbo
==> Fetching jpeg-turbo
==> Downloading https://ghcr.io/v2/homebrew/core/jpeg-turbo/manifests/3.0.4
Already downloaded: /Users/eblot/Library/Caches/Homebrew/downloads/2a3630ffd65db74be2c3c6104929548e1a0e8f2c82583e0732016f49b52b2c13--jpeg-turbo-3.0.4.bottle_manifest.json
==> Downloading https://ghcr.io/v2/homebrew/core/jpeg-turbo/blobs/sha256:e936777455b6cb66819a7db9f4396dfd4d0b8c7b0d700ea28213780b16c2dac1
Already downloaded: /Users/eblot/Library/Caches/Homebrew/downloads/0303c10155414d0d6ba271dcf62a3e7cf03716f02079e1ae948a9db6698c2b8e--jpeg-turbo--3.0.4.arm64_sonoma.bottle.tar.gz
==> Fetching eblot/devtools/gtkwave
==> Downloading https://gtkwave.sourceforge.net/gtkwave-gtk3-3.3.120.tar.gz
Already downloaded: /Users/eblot/Library/Caches/Homebrew/downloads/87571ecc782882ba9f8698e786aeecb6341fabe08d1312e0546ab883157df771--gtkwave-gtk3-3.3.120.tar.gz
==> Installing gtkwave from eblot/devtools
==> Installing dependencies for eblot/devtools/gtkwave: jpeg-turbo
==> Installing eblot/devtools/gtkwave dependency: jpeg-turbo
==> Downloading https://ghcr.io/v2/homebrew/core/jpeg-turbo/manifests/3.0.4
Already downloaded: /Users/eblot/Library/Caches/Homebrew/downloads/2a3630ffd65db74be2c3c6104929548e1a0e8f2c82583e0732016f49b52b2c13--jpeg-turbo-3.0.4.bottle_manifest.json
==> Pouring jpeg-turbo--3.0.4.arm64_sonoma.bottle.tar.gz
🍺  /opt/homebrew/Cellar/jpeg-turbo/3.0.4: 45 files, 3.4MB
==> Installing eblot/devtools/gtkwave
==> Patching
==> ./configure --disable-silent-rules --with-tcl=/opt/homebrew/opt/tcl-tk/lib --with-tk=/opt/homebrew/opt/tcl-tk/lib --enable-gtk3 --enable-judy
...

rg sha /opt/homebrew/Library/Taps/eblot/homebrew-devtools/Formula/gtkwave.rb
5:  # sha256 "5da94863fb2e5d88cc019e2bfdc676022398113894b585d864e11ca8341b24d7"

[SMillerDev]

--require-sha is described as: "Require all casks to have a checksum." and you're not installing a cask so that expectedly didn't do anything.

As for the "[...] no longer complain about an invalid shasum or suggest the shasum when it is missing". It's not missing a checksum though. When would you have expected to see an error in your output?

[eblot]

--require-sha: ok, I mis read its meaning, thanks.

If I'm not mistaken, up to now, when a sha256 was not defined in a Formula, brew would have emitted a line signalling that no sha256 were defined, and would have emitted a suggestion to add such a line, with the actual sha256 value. I do not remember the exact location in the installation process where such a suggestion would have been emitted, but I would bet it would have be where the sha256 is supposed to be validated, i.e. between the archive download completion and the attempt to un-archive it.

More importantly, when a sha256 was defined, if the locally computed sha256 did not match the one specified in the Formula, the installation process would immediately abort, which does not seem to be the case when I define such a line (maybe the syntax is wrong and I cannot spot the issue, but in this case I would have expected the aforementioned suggestion).

[carlocab]

Yup, can reproduce this. This is a brew bug. Can you file an issue at https://github.com/Homebrew/brew?

[eblot]

I wish I could, but the GutHub page won't let me submit the issue without a clean brew doctor output...

[carlocab]

That's fine; please do it anyway. We'll forgive you for checking the box that said you had a clean bill of health from brew doctor even if you don't. Thanks!

[eblot]

Ok, thanks :)
Homebrew/brew#18336