MD5 and SHA-1 Deprecation

During early 2015 Homebrew started the process of deprecating SHA1 for package integrity verification. Since then every formulae under the Homebrew organisation has been moved onto SHA256 verification; this includes both source packages and our precompiled packages (bottles).

We have stopped supporting SHA1 and MD5 entirely. MD5 checksums were removed from core formulae in 2012 but until April 2015 if you tried to install a formula still using one Homebrew wouldn’t actively stop you.

We removed SHA1 support in November 2016, 21 months after we started warning people to move away from it for verification. This is enforced in the same way MD5 is, by blocking the installation of that individual formula until the checksum is migrated.

From March 20th 2016 we’ve stepped up the visibility of that notification & you’ll start seeing deprecation warnings when installing SHA1-validated formula. If you see these please consider reporting it to where the formula originated.

This means custom taps, local custom formulae, etc need to be migrated to use SHA256 before you can install them.