Use KDE http mirror, add sha1

Note, it's outdated (latest is v4.7.1). I haven't tried updating for fear of repercussions with other formulae.