Why is my uninstall / reinstall failing for the Wireshark cask on Homebrew?

Question

Something must have gotten borked when I was trying to install the Wireshark Cask using Homebrew, and now it will not uninstall or reinstall the program to try and fix it. I am using a Mac running MacOS 12.6.3 Monterrey.

This is the output I receive from Terminal when trying to reinstall the cask:

[username]% ~ %brew reinstall --cask wireshark
==> Downloading https://raw.githubusercontent.com/Homebrew/homebrew-cask/55aa5fe4201426f12464fcae94ebdb6d2303f4c6/Cas
Already downloaded: /Users/[username]/Library/Caches/Homebrew/downloads/8375bbec59fe8490d1a24ab77b3165378f89da8037e1cfc5740524af10db7e66--wireshark.rb
==> Downloading https://2.na.dl.wireshark.org/osx/Wireshark%204.0.7%20Arm%2064.dmg
Already downloaded: /Users/[username]/Library/Caches/Homebrew/downloads/63f9d1988808d4cba46a2f29ffb65b066414802b6368cea4122317942d55d4c8--Wireshark 4.0.7 Arm 64.dmg
==> Uninstalling Cask wireshark
Error: Failure while executing; `/usr/bin/sudo -E -- /usr/sbin/installer -pkg /opt/homebrew/Caskroom/wireshark/4.0.7/Uninstall\ ChmodBPF.pkg -target /` exited with 1. Here's the output:
installer: Package name is Uninstall ChmodBPF
installer: Installing at base path /
installer: The install failed. (The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance. An error occurred while running scripts from the package “Uninstall ChmodBPF.pkg”.)

I have tried everything I can think of including updating brew, upgrading brew, and updating Xcode. Nothing seems to fix the error.

Answer 1

1. Locate the wireshark .pkg files and uninstall them manually.

Use "shift+command+G" to the location, which shoule be like /usr/local/Caskroom/wireshark/4.0.10 and there are four .pkg files in it:

• Add Wireshark to the system path.pkg
• Remove Wireshark from the system path.pkg
• Install ChmodBPF.pkg
• Uninstall ChmodBPF.pkg

note: Don't just run the "Remove" and "Uninstall" .pkgs otherwise errors will occured. Run "Add" then "Remove", and "Install" then "Uninstall".

2. Find and modify the .rb file to ignore the problem tasks

Run

brew uninstall --cask wireshark --debug --verbose

the output should be like following:

==> Uninstalling Cask wireshark
/usr/local/Homebrew/Library/Homebrew/brew.rb (Cask::CaskLoader::FromPathLoader): loading /usr/local/Caskroom/wireshark/.metadata/4.0.10/20231009043133.568/Casks/wireshark.rb
==> Uninstalling Cask wireshark
==> Uninstalling artifacts
==> 46 artifacts defined

The /usr/local/Caskroom/wireshark/.metadata/4.0.10/20231009043133.568/Casks/wireshark.rb is the real .rb file we want. Edit it by any method you prefer.

Find the paragraph within the uninstallation steps:

uninstall_preflight do
    system_command "/usr/sbin/installer",
                   args: [
                     "-pkg", "#{staged_path}/Uninstall ChmodBPF.pkg",
                     "-target", "/"
                   ],
                   sudo: true
    system_command "/usr/sbin/installer",
                   args: [
                     "-pkg", "#{staged_path}/Remove Wireshark from the system path.pkg",
                     "-target", "/"
                   ],
                   sudo: true
  end

Comment the steps which trigger the pkg:

uninstall_preflight do
    # system_command "/usr/sbin/installer",
    #                args: [
    #                  "-pkg", "#{staged_path}/Uninstall ChmodBPF.pkg",
    #                  "-target", "/"
    #                ],
    #                sudo: true
    # system_command "/usr/sbin/installer",
    #                args: [
    #                  "-pkg", "#{staged_path}/Remove Wireshark from the system path.pkg",
    #                  "-target", "/"
    #                ],
    #                sudo: true
  end

Note: There are another two .rb files: /usr/local/Homebrew/Library/Taps/homebrew/homebrew-cask/Casks/w/wireshark.rb and ~/Library/Caches/Homebrew/downloads/4e1d566a28659de840e41ada2b49116e1b15032b7abb525d08f13cd4e268cab0--wireshark.rb (random filename)

These three .rb files are totally same. But I'm not sure which .rb will be verify by homebrew, so I suggest you modify these two files too. Keep the contents of the three files consistent.

3. Deal with homebrew's file checksum

Run

brew uninstall --cask wireshark

the output may warn you the .rb file checksum mismatch.

Copy the “Expected” SHA256 and find it in file:

~/Library/Caches/Homebrew/api/cask.jws.json

Replace the "Expected" SHA256 with the "Actual" in the json.

Homebrew has another mechanism to check the cask.jws.json file, so we need to stop homebrew's integrity verify function in current session:

export HOMEBREW_NO_INSTALL_FROM_API=1

And you should be able to uninstall wireshark by brew uninstall command now

4 Post uninstallation

Reopen you terminal to stop skipping integrity verifing for cask.jws.json

Restore the .rb files manually, or remove the download folder version

rm ~/Library/Caches/Homebrew/downloads/4e1d566a28659de840e41ada2b49116e1b15032b7abb525d08f13cd4e268cab0--wireshark.rb