Bug#878759: (pas d'objet)

[emmanuel@libera.cc]

Indeed checksum verifycation does not work when vagrant box add refers 
to a cloud based box.

Looking at:
 
https://www.vagrantup.com/docs/cli/box.html#options-for-direct-box-files

it seems the checksum should be embedded in the box metadata.

We probably need to improve the build process here.

In the meantime, you can donwload the box the boxes via wget, and add 
them locally as a workaround, ie:

$ wget 
https://vagrantcloud.com/debian/boxes/stretch64/versions/9.2.0/providers/virtualbox.box

$ vagrant box add --name debian/stretch64  --provider virtualbox 
--checksum 
3625435cbc6ace0a033f64e9495de65286d92d6560dfefe9239a3f9ab02f98a1 
--checksum-type sha256 virtualbox.box

==> box: Box file was not detected as metadata. Adding it directly...
==> box: Adding box 'debian/stretch64' (v0) for provider: virtualbox
    box: Unpacking necessary files from: 
file:///home/manu/Projects/vagrenvs/stable/virtualbox.box
    box: Calculating and comparing box checksum...
The checksum of the downloaded box did not match the expected
value. Please verify that you have the proper URL setup and that
you're downloading the proper file.

Expected: 
3625435cbc6ace0a033f64e9495de65286d92d6560dfefe9239a3f9ab02f98a1
Received: 
3625435cbc6ace0a033f64e9495de65286d92d6560dfefe9239a3f9ab02f98a0

here the box is compared against the expected checksum and fails in case 
of mismatch.