[Bug 1175968] New: YaST2 reports "Wrong Digest" for https://download.nvidia.com/opensuse/tumbleweed

newer
[Bug 1176031] (CVE-2020-24553)...

bugzilla_noreply＠suse.com

31 Aug 2020 31 Aug '20

14:35

http://bugzilla.opensuse.org/show_bug.cgi?id=1175968 Bug ID: 1175968 Summary: YaST2 reports "Wrong Digest" for https://download.nvidia.com/opensuse/tumbleweed Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: yast2-maintainers@suse.de Reporter: jchoksi@gmail.com QA Contact: jsrain@suse.com Found By: --- Blocker: --- Confirmed as happening to others as well: - https://old.reddit.com/r/openSUSE/comments/iiuc4g/anybody_else_getting_a_wro... - https://lists.opensuse.org/opensuse-factory/2020-08/msg00329.html In my case, when installing openSUSE Tumbleweed via autoyast, if I have an entry to setup the nvidia repository, e.g. <listentry t="map"> <alias>download.nvidia.com-tumbleweed</alias> https://download.nvidia.com/opensuse/tumbleweed <name>nVidia Graphics Drivers</name> <priority t="integer">90</priority> / </listentry> then during installation, I will get the following error: ---snip--- Wrong Digest The expected checksum of file /var/tmp/AP_0xp8UPnm/repodata/susedata.xml.gz is fa47ae8244fe7640f149d28964e604bf7e756da989d7e520f67216a96bb6cfb2, but the current checksum is 1f4dc420bfbf3d1b423cd7c4e1ca6aa25d7a13daff70c64e412f0ed449602406. The file has been changed by accident or by an attacker since the repository creator signed it. Using it is a big risk for the integrity and security of your system. Use it anyway? [] Do not show this message again [ YES ] [ NO ] ---snip--- -- You are receiving this mail because: You are on the CC list for the bug.

Attachments:

attachment.htm (text/html — 3.7 KB)

Show replies by thread

bugzilla_noreply＠suse.com

31 Aug 31 Aug

21:14

New subject: [Bug 1175968] YaST2 reports "Wrong Digest" for https://download.nvidia.com/opensuse/tumbleweed

http://bugzilla.opensuse.org/show_bug.cgi?id=1175968 http://bugzilla.opensuse.org/show_bug.cgi?id=1175968#c1 --- Comment #1 from Jinesh Choksi --- Output of trying to add the repo manually on another existing Tumbleweed repo: ---snip--- localhost:~ # zypper lr -P # | Alias | Name | Enabled | GPG Check | Refresh | Priority --+----------------------------------+---------------------------+---------+-----------+---------+--------- 1 | download.opensuse.org-non-oss | Main Repository (NON-OSS) | Yes | (r ) Yes | Yes | 99 2 | download.opensuse.org-oss | Main Repository (DEBUG) | Yes | (r ) Yes | Yes | 99 3 | download.opensuse.org-oss_1 | Main Repository (Sources) | Yes | (r ) Yes | Yes | 99 4 | download.opensuse.org-oss_2 | Main Repository (OSS) | Yes | (r ) Yes | Yes | 99 5 | download.opensuse.org-tumbleweed | Main Update Repository | Yes | (r ) Yes | Yes | 99 6 | openSUSE-20200824-0 | openSUSE-20200824-0 | Yes | (r ) Yes | Yes | 99 localhost:~ # zypper addrepo --refresh --check https://download.nvidia.com/opensuse/tumbleweed NVIDIA Adding repository 'NVIDIA' ................................................................................................................................................................[done] Repository 'NVIDIA' successfully added URI : https://download.nvidia.com/opensuse/tumbleweed Enabled : Yes GPG Check : Yes Autorefresh : Yes Priority : 99 (default priority) Repository priorities are without effect. All enabled repositories share the same priority. localhost:~ # zypper refresh Retrieving repository 'NVIDIA' metadata ------------------------------------------------------------------------------------------------------------------------------------------------------[\] New repository or package signing key received: Repository: NVIDIA Key Name: NVIDIA Corporation Key Fingerprint: 9B763D49 D8A5C892 FC178BAC F5113243 C66B6EAE Key Created: Thu 15 Jun 2006 17:13:18 BST Key Expires: (does not expire) Subkey: F016EEAA03224CDD 2006-06-15 [does not expire] Rpm Name: gpg-pubkey-c66b6eae-4491871e Do you want to reject the key, trust temporarily, or trust always? [r/t/a/?] (r): a Warning: Digest verification failed for file 'susedata.xml.gz' [/var/tmp/AP_0xlApxLV/repodata/susedata.xml.gz] expected fa47ae8244fe7640f149d28964e604bf7e756da989d7e520f67216a96bb6cfb2 but got 1f4dc420bfbf3d1b423cd7c4e1ca6aa25d7a13daff70c64e412f0ed449602406 Accepting packages with wrong checksums can lead to a corrupted system and in extreme cases even to a system compromise. However if you made certain that the file with checksum '1f4d..' is secure, correct and should be used within this operation, enter the first 4 characters of the checksum to unblock using this file on your own risk. Empty input will discard the file. Unblock or discard? [1f4d/...? shows all options] (discard): ---snip--- -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠suse.com

22:27

New subject: [Bug 1175968] YaST2 reports "Wrong Digest" for https://download.nvidia.com/opensuse/tumbleweed

http://bugzilla.opensuse.org/show_bug.cgi?id=1175968 http://bugzilla.opensuse.org/show_bug.cgi?id=1175968#c2 Christian Boltz changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |suse-beta@cboltz.de Assignee|yast2-maintainers@suse.de |sndirsch@suse.com --- Comment #2 from Christian Boltz --- Stefan, since you maintain the nvidia-gfx* packages, I assume you have contacts to nvidia. Can you please ask them to fix the repo? -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠suse.com

1 Sep 1 Sep

02:17

New subject: [Bug 1175968] YaST2 reports "Wrong Digest" for https://download.nvidia.com/opensuse/tumbleweed

http://bugzilla.opensuse.org/show_bug.cgi?id=1175968 http://bugzilla.opensuse.org/show_bug.cgi?id=1175968#c3 Stefan Dirsch changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P2 - High Status|NEW |CONFIRMED Component|Installation |X11 3rd Party Driver QA Contact|jsrain@suse.com |sndirsch@suse.com Severity|Normal |Major --- Comment #3 from Stefan Dirsch --- Indeed. Repos is currently broken. 15.1 and 15.2 repos as well. :-( -- You are receiving this mail because: You are on the CC list for the bug.