Checking 'VirtualBox-5.0.18.tar.bz2'... failed SHA256 Checking 'virtualbox-5.0.16-patches-01.tar.xz'... ok If the manifest is forced the tarball fails as corrupt. I have re-downloading the file 5 or 6 time in the last week.
It seems that the files on the mirrors are corrupted. After downloading the file directly from virtualbox.org the checks and the build succeeded
confirmed: ebuild virtualbox-5.0.18.ebuild fetch [..] http://mirror.netcologne.de/gentoo/distfiles/VirtualBox-5.0.18.tar.bz2 [..] HTTP request sent, awaiting response... 200 OK Length: 111237630 (106M) [application/octet-stream] Saving to: ‘/usr/portage/distfiles/VirtualBox-5.0.18.tar.bz2’ /usr/portage/distfiles/VirtualBox-5.0.18.tar.bz 100%[=======================================================================================================>] 106.08M 1.42MB/s in 82s 2016-04-24 18:49:16 (1.29 MB/s) - ‘/usr/portage/distfiles/VirtualBox-5.0.18.tar.bz2’ saved [111237630/111237630] !!! Fetched file: VirtualBox-5.0.18.tar.bz2 VERIFY FAILED! !!! Reason: Failed on SHA256 verification !!! Got: b10dd2f870673908c5807f2588f1a9823e5bf173394bbdc854426daedafdf5c2 !!! Expected: 18a2c4f2db686da1653e6b8132142669867fc25e574a994d7f595c69d7b46603
I don't know how this happened. Indeed, the tarball from download.virtualbox.org is not affected. So I have no idea how to fix this. CCing infra, as they might have a solution for this. This bug is different to the problems described in bug #577722 because it's not the Manifest file that is corrupt (it indeed is even correct as far as I have seen) but the source tarball on the mirrors. So please do not mark this bug as duplicate.
I can verify that downloading the file directly from virtualbox.org allows the installation to proceed to conclusion so it is the mirror system that has the corrupted file.
I've removed virtualbox-5.0.18 from the tree so this bug should be obsolete now.
