Repository: spack/spack

Issue:
Installation issue: shadow sha256 checksum mismatch

### Steps to reproduce the issue

<!-- Fill in the exact spec you are trying to build and the relevant part of the error message -->
```console
$ spack install shadow

==> Installing shadow-4.8.1-gf62lgu35zsdj2u5v6345lqk4u7bckuz
==> No binary for shadow-4.8.1-gf62lgu35zsdj2u5v6345lqk4u7bckuz found: installing from source
==> Fetching https://github.com/shadow-maint/shadow/releases/download/4.8.1/shadow-4.8.1.tar.gz
######################################################################## 100.0%
==> Error: ChecksumError: sha256 checksum failed for /tmp/osolberg/spack-stage/spack-stage-shadow-4.8.1-gf62lgu35zsdj2u5v6345lqk4u7bckuz/shadow-4.8.1.tar.gz
    Expected d55490c859b686a0ca83901cef70d926823c90118a2659a402df92cc8069c845 but got 3ee3081fbbcbcfea5c8916419e46bc724807bab271072104f23e7a29e9668f3a

/locus/home/osolberg/spack/spacktree-20210425/spack/lib/spack/spack/package.py:1373, in do_fetch:
       1370        self.stage.fetch(mirror_only, err_msg=err_msg)
       1371        self._fetch_time = time.time() - start_time
       1372
  >>   1373        if checksum and self.version in self.versions:
       1374            self.stage.check()
       1375
       1376        self.stage.cache_local()


==> Warning: Skipping build of singularity-3.7.2-fxenezfsuqghizanl4f2ex44y6ri4jud since shadow-4.8.1-gf62lgu35zsdj2u5v6345lqk4u7bckuz failed
==> Error: Terminating after first install failure: ChecksumError: sha256 checksum failed for /tmp/osolberg/spack-stage/spack-stage-shadow-4.8.1-gf62lgu35zsdj2u5v6345lqk4u7bckuz/shadow-4.8.1.tar.gz
    Expected d55490c859b686a0ca83901cef70d926823c90118a2659a402df92cc8069c845 but got 3ee3081fbbcbcfea5c8916419e46bc724807bab271072104f23e7a29e9668f3a

```

### Information on your system

* **Spack:** 0.16.1
* **Python:** 3.8.1
* **Platform:** linux-ubuntu14.04-broadwell
* **Concretizer:** original

### Additional information

I guess I created this package so that makes me the default maintainer? 

I forget what is the preferred way to figure out whether it is okay to update the checksum?  @hartzell You [mentioned earlier](https://github.com/spack/spack/issues/12297#issuecomment-529144276): 

> Every once in a while GitHub decides to change something about how they produce the tarballs and the end result is that the checksums no longer match. You'll see big swaths of commits where someone updates many, many package signatures....

### General information

<!-- These boxes can be checked by replacing [ ] with [x] or by clicking them after submitting the issue. -->
- [X] I have run `spack debug report` and reported the version of Spack/Python/Platform
- [X] I have run `spack maintainers <name-of-the-package>` and @mentioned any maintainers
- [X] I have uploaded the build log and environment files
- [X] I have searched the issues of this repo and believe this is not a duplicate



Discussion:
The GitHub  ["release asset" page for shadow](https://github.com/shadow-maint/shadow/releases/tag/4.8.1) has: 
* `shadow-4.8.1.tar.gz` 
  * URL is: https://github.com/shadow-maint/shadow/releases/download/4.8.1/shadow-4.8.1.tar.gz
  * sha256 is: `3ee3081fbbcbcfea5c8916419e46bc724807bab271072104f23e7a29e9668f3a` (does not match)
* `Source Code (tar.gz)`
  * URL is:  https://github.com/shadow-maint/shadow/archive/refs/tags/4.8.1.tar.gz
  * sha256 is: `d55490c859b686a0ca83901cef70d926823c90118a2659a402df92cc8069c845` (does match)

So I guess it's okay to update the package recipe to `3ee3081fbbcbcfea5c8916419e46bc724807bab271072104f23e7a29e9668f3a`.  But I am wondering, why has Spack seemingly changed the URL and package it's pulling from?  @adamjstewart advice?
> But I am wondering, why has Spack seemingly changed the URL and package it's pulling from?

I don't think it has. I would guess that the wrong checksum was added (e.g. the last update to the Spack `shadow` package created the checksum using the second link you mention in https://github.com/spack/spack/issues/23263#issuecomment-827824260 when in fact Spack is pulling from the first link you mentioned).

Would you be able to create a pull request for this?

Resolving patch:
diff --git a/var/spack/repos/builtin/packages/shadow/package.py b/var/spack/repos/builtin/packages/shadow/package.py
--- a/var/spack/repos/builtin/packages/shadow/package.py
+++ b/var/spack/repos/builtin/packages/shadow/package.py
@@ -14,6 +14,6 @@ class Shadow(AutotoolsPackage):
     url      = "https://github.com/shadow-maint/shadow/releases/download/4.7/shadow-4.7.tar.gz"
     git      = "https://github.com/shadow-maint/shadow.git"
 
-    version('4.8.1', sha256='d55490c859b686a0ca83901cef70d926823c90118a2659a402df92cc8069c845')
+    version('4.8.1', sha256='3ee3081fbbcbcfea5c8916419e46bc724807bab271072104f23e7a29e9668f3a')
     version('4.7',   sha256='5135b0ca2a361a218fab59e63d9c1720d2a8fc1faa520c819a654b638017286f')
     version('4.6',   sha256='4668f99bd087399c4a586084dc3b046b75f560720d83e92fd23bf7a89dda4d31')


Test patch: