Repository: spack/spack

Issue:
ChecksumError: kallisto
### Steps to reproduce the issue

```console
$ spack install kallisto
```

### Platform and user environment

Please report your OS here:
```commandline
$ uname -a 
Linux host.domain.com 3.10.0-957.1.3.el7.x86_64 #1 SMP Thu Nov 29 14:49:43 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

$ cat /etc/*release*
CentOS Linux release 7.6.1810 (Core) 
``` 

### Issue

This is a simple case of a bad checksum.    I [see this is not uncommon](https://github.com/spack/spack/issues/10091) but being new to this project, not sure about best practices to resolve it.  Ideally, we could fix this recipe, and also update to a the latest version ([releases](https://github.com/pachterlab/kallisto/releases)).

https://github.com/spack/spack/blob/caf94253e09ff9cc2c54342ed85e361d102f5414/var/spack/repos/builtin/packages/kallisto/package.py#L16

### Error message
```
==> Installing kallisto
==> Searching for binary cache of kallisto
==> Warning: No Spack mirrors are currently configured
==> No binary for kallisto found: installing from source

==> Fetching https://github.com/pachterlab/kallisto/archive/v0.43.1.tar.gz

######################################################################## 100.0%
==> Error: ChecksumError: md5 checksum failed for /bifx/apps/spack/spack-20181214/var/spack/stage/kallisto-0.43.1-jti3i7caxiequtwksiiazuiyg76jytcc/v0.43.1.tar.gz
    Expected 54fc9b70ca44e4633f02c962cbc59737 but got 071e6bfb62be06fd76552298d4cf8144

/bifx/apps/spack/spack-20181214/lib/spack/spack/package.py:920, in do_fetch:
        917        self.stage.fetch(mirror_only)
        918        self._fetch_time = time.time() - start_time
        919
  >>    920        if checksum and self.version in self.versions:
        921            self.stage.check()
        922
        923        self.stage.cache_local()
```


Discussion:
> being new to this project, not sure about best practices to resolve it.

Usually, I ask people to contact the developers and inquire about the checksum change. If the developers say they pushed a bug fix without a version number change, then it's fine to fix the checksum and submit a PR. If the developers aren't aware of any change, things [could be more serious](https://github.com/Homebrew/homebrew-cask/issues/33536). 
The package URL is a GitHub `archive` URL, the contents of the archive tarballs are generated on the fly, and the checksums for those sometimes change when GitHub changes "things" (metadata-ish) even when there have been no changes to the repo.

I know that Spack's had periods of dealing with this, and googling *github archive checksum changes* will lead to many discussions of the phenomena, e.g. [this homebrew thread](https://github.com/Homebrew/homebrew-core/issues/18044).

The change might be caused by something *pachterlab* changed, it could be nefarious, or it could be a GitHub-side change.  Have we seen an outbreak of checksum changes?
I've inquired via https://github.com/pachterlab/kallisto/issues/195  but could be some time before it gets attention.  In the meantime, would it be reasonable to update the recipe for the latest version?


Resolving patch:
diff --git a/var/spack/repos/builtin/packages/kallisto/package.py b/var/spack/repos/builtin/packages/kallisto/package.py
--- a/var/spack/repos/builtin/packages/kallisto/package.py
+++ b/var/spack/repos/builtin/packages/kallisto/package.py
@@ -13,7 +13,7 @@ class Kallisto(CMakePackage):
     homepage = "http://pachterlab.github.io/kallisto"
     url      = "https://github.com/pachterlab/kallisto/archive/v0.43.1.tar.gz"
 
-    version('0.43.1', '54fc9b70ca44e4633f02c962cbc59737')
+    version('0.43.1', '071e6bfb62be06fd76552298d4cf8144')
 
     depends_on('zlib')
     depends_on('hdf5')


Test patch: