https://bugzilla.suse.com/show_bug.cgi?id=1173509 https://bugzilla.suse.com/show_bug.cgi?id=1173509#c1 --- Comment #1 from Steffen Winterfeldt --- Created attachment 839202 --> https://bugzilla.suse.com/attachment.cgi?id=839202&action=edit zypper lr - normal URL -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1173509 https://bugzilla.suse.com/show_bug.cgi?id=1173509#c3 --- Comment #3 from Steffen Winterfeldt --- Created attachment 839204 --> https://bugzilla.suse.com/attachment.cgi?id=839204&action=edit zypper lr - $releasever URL -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1173509 https://bugzilla.suse.com/show_bug.cgi?id=1173509#c5 --- Comment #5 from Steffen Winterfeldt --- Created attachment 839228 --> https://bugzilla.suse.com/attachment.cgi?id=839228&action=edit yast logs - zypp not (always?) expanding $releasever To me it looks like libzypp is at least not always expanding $relasever in URLs. See these logs - grep for 'doGetDoesFileExist' for example. ZYPP_REPO_RELEASEVER is set correctly (and the package installation actually works): 1:vm4879:/proc/4395 # perl -pe 'tr/\x00/\n/' environ | grep ZYPP ZYPP_REPO_RELEASEVER=15.2 Maybe I don't understand how this $releasever handling is expected to work. Michael, could you have a look, please? -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1173509 https://bugzilla.suse.com/show_bug.cgi?id=1173509#c6 Michael Andres changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(ma@suse.com) | --- Comment #6 from Michael Andres --- (In reply to Steffen Winterfeldt from comment #0)

Using $releasever in the installation repo URL avoids the duplicate main repo but the main repo gets an unusual name like http-download.opensuse.org-da2f0184.

I guess this is something for YAST (yast-pkg-bindings). Looks like they don't handle rawURLs (those which need repo vars replacement) correctly in all places. Commonly this is hidden inside a zypp::RepoInfo class. It expects rawURLs to be passed in and always hands out replaced URLs. To get the raw URLs out again, you must explicitly request it. Form the log it appears to me, that the Ruby code passes the rawUrl down to yast-pkg-bindings:

[Ruby] modules/InstURL.rb:152 Using install URL: http://download.opensuse.org/distribution/leap/$releasever/repo/oss/

Sometimes, like in

[Pkg] Source_Create.cc(ScanProductsWithCallBacks):61 Scanning products in http://download.opensuse.org/distribution/leap/15.2/repo/oss/ yast-pkg-bindings use a var-expanded URL.

But in other locations they seem to use the rawURL directly and pass it down to libzypp for downloading, probing and parsing. Those zypp functions expect valid URLs and you see them failing as an unexpanded URL is passed down to the zypp Mediabackend:

[Pkg] Source_Create.cc(ScanProductsWithCallBacks):61 Scanning products in http://download.opensuse.org/distribution/leap/$releasever/rep... or [Pkg] Source_Create.cc(createManagedSource):199 Probing source type: 'http://download.opensuse.org/distribution/leap/$releasever/repo/os...

Regarding the -da2f0184: AFAICS yast-pkg-bindings Source_Create.cc(createManagedSource) expects a repo alias to be passed (as arg or in the URL). If none is present, a 'stupid' alias is created. I guess the errors due to using unexpanded URLs leads to no alias being detected and passed to createManagedSource. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1173509 Arvin Schnell changed: What |Removed |Added ---------------------------------------------------------------------------- Status|CONFIRMED |IN_PROGRESS -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1173509 https://bugzilla.suse.com/show_bug.cgi?id=1173509#c12 --- Comment #12 from Swamp Workflow Management --- SUSE-RU-2021:0235-1: An update that has four recommended fixes and contains two features can now be installed. Category: recommended (moderate) Bug References: 1173509,1176275,1176276,1178688 CVE References: JIRA References: SLE-14807,SLE-15184 Sources used: SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): yast2-4.2.91-3.21.2, yast2-pkg-bindings-4.2.15-3.12.2, yast2-update-4.2.20-3.4.2 SUSE Linux Enterprise Installer 15-SP2 (src): yast2-4.2.91-3.21.2, yast2-pkg-bindings-4.2.15-3.12.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.