Repository: nvm
Issue: NVM uses packages which failed checksum, with warning only. It should fail to install, instead.
Labels: bugs,installing node: checksums,pull request wanted

- Operating system and version:
Mac OS/X High Sierra

- `nvm debug` output:
<details>
<!-- do not delete the following blank line -->

```sh
nvm --version: v0.33.11
$TERM_PROGRAM: Apple_Terminal
$SHELL: /bin/bash
$SHLVL: 1
$HOME: /Users/doug
$NVM_DIR: '$HOME/.nvm'
$PATH: $NVM_DIR/versions/node/v10.4.0/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/Applications/VMware Fusion.app/Contents/Public
$PREFIX: ''
$NPM_CONFIG_PREFIX: ''
$NVM_NODEJS_ORG_MIRROR: ''
$NVM_IOJS_ORG_MIRROR: ''
shell version: 'GNU bash, version 3.2.57(1)-release (x86_64-apple-darwin17)'
uname -a: 'Darwin 17.6.0 Darwin Kernel Version 17.6.0: Tue May 8 15:22:16 PDT 2018; root:xnu-4570.61.1~1/RELEASE_X86_64 x86_64'
OS version: Mac 10.13.5 17F77
curl: /usr/bin/curl, curl 7.54.0 (x86_64-apple-darwin17.0) libcurl/7.54.0 LibreSSL/2.0.20 zlib/1.2.11 nghttp2/1.24.0
wget: /usr/local/bin/wget, GNU Wget 1.19.4 built on darwin17.3.0.
git: /usr/bin/git, git version 2.15.2 (Apple Git-101.1)
grep: /usr/bin/grep, grep (BSD grep) 2.5.1-FreeBSD
awk: /usr/bin/awk, awk version 20070501
sed: illegal option -- -
usage: sed script [-Ealn] [-i extension] [file ...]
       sed [-Ealn] [-i extension] [-e script] ... [-f script_file] ... [file ...]
sed: /usr/bin/sed, 
cut: illegal option -- -
usage: cut -b list [-n] [file ...]
       cut -c list [file ...]
       cut -f list [-s] [-d delim] [file ...]
cut: /usr/bin/cut, 
basename: illegal option -- -
usage: basename string [suffix]
       basename [-a] [-s suffix] string [...]
basename: /usr/bin/basename, 
rm: illegal option -- -
usage: rm [-f | -i] [-dPRrvW] file ...
       unlink file
rm: /bin/rm, 
mkdir: illegal option -- -
usage: mkdir [-pv] [-m mode] directory ...
mkdir: /bin/mkdir, 
xargs: illegal option -- -
usage: xargs [-0opt] [-E eofstr] [-I replstr [-R replacements]] [-J replstr]
             [-L number] [-n number [-x]] [-P maxprocs] [-s size]
             [utility [argument ...]]
xargs: /usr/bin/xargs, 
nvm current: v10.4.0
which node: $NVM_DIR/versions/node/v10.4.0/bin/node
which iojs: 
which npm: $NVM_DIR/versions/node/v10.4.0/bin/npm
npm config get prefix: $NVM_DIR/versions/node/v10.4.0
npm root -g: $NVM_DIR/versions/node/v10.4.0/lib/node_modules
```
</details>

- `nvm ls` output:
<details>
<!-- do not delete the following blank line -->

```sh
         v8.2.1
         v8.9.3
->      v10.4.0
default -> 8.2.1 (-> v8.2.1)
node -> stable (-> v10.4.0) (default)
stable -> 10.4 (-> v10.4.0) (default)
iojs -> N/A (default)
lts/* -> lts/carbon (-> N/A)
lts/argon -> v4.9.1 (-> N/A)
lts/boron -> v6.14.3 (-> N/A)
lts/carbon -> v8.11.3 (-> N/A)
```
</details>

- How did you install `nvm`? (e.g. install script in readme, Homebrew):
From script on main site.

- What steps did you perform?
I had `v8.9.3` "used" and wanted to switch to an later version. I typed in `nvm use v10.4.0`. Nvm told me it was not installed so I ran the install command: `nvm install v10.4.0`.

- What happened?
I had an outdated version of `shasum` sitting in my `/usr/local/bin` folder, which was giving me wrong checksums. When I attempted to install node, the checksum test failed, but it downloaded the package anyway, and installed it. Here is the output:

```
$ nvm install v10.4.0
Downloading and installing node v10.4.0...
Local cache found: $NVM_DIR/.cache/bin/node-v10.4.0-darwin-x64/node-v10.4.0-darwin-x64.tar.gz
Computing checksum with sha256sum
Checksums do not match: 'ae191912605f3ebc9d17ef58d1e6b976b1ce6e8d' found, '82b27983c990a6860e8d729e0b15acf9643ffca0eff282a926268849dfd2c3d2' expected.
Checksum check failed!
Removing the broken local cache...
Downloading https://nodejs.org/dist/v10.4.0/node-v10.4.0-darwin-x64.tar.gz...
######################################################################## 100.0%
Computing checksum with sha256sum
Checksums do not match: 'ae191912605f3ebc9d17ef58d1e6b976b1ce6e8d' found, '82b27983c990a6860e8d729e0b15acf9643ffca0eff282a926268849dfd2c3d2' expected.
Now using node v10.4.0 (npm v6.1.0)
```

- What did you expect to happen?
I expected `nvm` to fail the installation with an error, and refuse to `use` the version which failed the checksum.

- Is there anything in any of your profile files (`.bashrc`, `.bash_profile`, `.zshrc`, etc) that modifies the `PATH`?
No.