Repository: spack/spack

Issue:
Installation issue: gromacs
### Steps to reproduce the issue

```console
$ spack install gromacs@2018.8
... 
==> Error: ChecksumError: sha256 checksum failed for /tmp/wachaandras/spack-stage/spack-stage-gromacs-2018.8-wo2lu6rdjzxevcype5dfruyeafvwbcsk/gromacs-2018.8.tar.gz
    Expected 3776923415df4bc78869d7f387c834141fdcda930b2e75be979dc59ecfa6ebec but got 776923415df4bc78869d7f387c834141fdcda930b2e75be979dc59ecfa6ebecf

/opt/spack/lib/spack/spack/package.py:1083, in do_fetch:
       1080        self.stage.fetch(mirror_only)
       1081        self._fetch_time = time.time() - start_time
       1082
  >>   1083        if checksum and self.version in self.versions:
       1084            self.stage.check()
       1085
       1086        self.stage.cache_local()

```

### Platform and user environment

Please report your OS here:
```commandline
$ uname -a 
Linux guinier.guinier 5.3.11-arch1-1 #1 SMP PREEMPT Tue, 12 Nov 2019 22:19:48 +0000 x86_64 GNU/Linux
$ lsb_release -d
Description:	Arch Linux
``` 

### Additional information

It seems that the sha256sum in the package.py file is incorrect:
In package.py:
'3776923415df4bc78869d7f387c834141fdcda930b2e75be979dc59ecfa6ebec'

Manually computed from the tarball downloaded directly from gromacs.org:
'776923415df4bc78869d7f387c834141fdcda930b2e75be979dc59ecfa6ebecf'

Fixing the package.py file should solve the problem.


Discussion:
I'm seeing the same error. Can you contact the gromacs developers and ask them about the checksum change, just to make sure they weren't hacked? Don't want another repeat of: https://github.com/Homebrew/homebrew-cask/issues/33536
For me it seems that this is only a copy-paste error: if you remove the first character ('3') of the checksum in package.py and add 'f' at the end, you get the upstream one. I don't know how difficult would it be for an attacker to make such a convincing fake. I'll contact the developers nevertheless.

Maintainers of the package, @junghans and @marvinbernhardt , could you please comment on this?
I have no idea, but:
```
$ spack checksum gromacs 2018.8
==> Found 1 version of gromacs:
  
  2018.8  http://ftp.gromacs.org/gromacs/gromacs-2018.8.tar.gz

==> How many would you like to checksum? (default is 1, q to abort) 
==> Downloading...
==> Fetching http://ftp.gromacs.org/gromacs/gromacs-2018.8.tar.gz
################################################################################################################################ 100.0%
==> Checksummed 1 version of gromacs:

    version('2018.8', sha256='776923415df4bc78869d7f387c834141fdcda930b2e75be979dc59ecfa6ebecf')

```

So it seems the there are a typo in the checksum.

The md5sum is 12fe6c41c1ed76ed8227c6d37c465ff4 which agrees with http://manual.gromacs.org/documentation/2018.8/download.html

Resolving patch:
diff --git a/var/spack/repos/builtin/packages/gromacs/package.py b/var/spack/repos/builtin/packages/gromacs/package.py
--- a/var/spack/repos/builtin/packages/gromacs/package.py
+++ b/var/spack/repos/builtin/packages/gromacs/package.py
@@ -30,7 +30,7 @@ class Gromacs(CMakePackage):
     version('2019.2', sha256='bcbf5cc071926bc67baa5be6fb04f0986a2b107e1573e15fadcb7d7fc4fb9f7e')
     version('2019.1', sha256='b2c37ed2fcd0e64c4efcabdc8ee581143986527192e6e647a197c76d9c4583ec')
     version('2019', sha256='c5b281a5f0b5b4eeb1f4c7d4dc72f96985b566561ca28acc9c7c16f6ee110d0b')
-    version('2018.8', sha256='3776923415df4bc78869d7f387c834141fdcda930b2e75be979dc59ecfa6ebec')
+    version('2018.8', sha256='776923415df4bc78869d7f387c834141fdcda930b2e75be979dc59ecfa6ebecf')
     version('2018.5', sha256='32261df6f7ec4149fc0508f9af416953d056e281590359838c1ed6644ba097b8')
     version('2018.4', sha256='6f2ee458c730994a8549d6b4f601ecfc9432731462f8bd4ffa35d330d9aaa891')
     version('2018.3', sha256='4423a49224972969c52af7b1f151579cea6ab52148d8d7cbae28c183520aa291')


Test patch: