https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c Ger J changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Java:packages: Bug -- |[security] Java:packages: |repository "signed with an |Bug -- repository "signed |unknown key" |with an unknown key" -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c2 Adrian Schröter changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW CC| |adrian@suse.com InfoProvider|adrian@suse.com | --- Comment #2 from Adrian Schröter 2011-11-02 13:24:29 UTC --- Some mvykocil has created a new key two times: # osc log -M Java:packages shows: .. ---------------------------------------------------------------------------- r24 | mvyskocil | 2011-09-29 09:22:28 | 86756a86f13b664fd5a9ca36a9782dc1 | None | extend public key expiry date ---------------------------------------------------------------------------- r23 | mvyskocil | 2011-09-29 09:22:25 | 0643e2c6b248883f7358a73ed59ed15b | None | create sign key ---------------------------------------------------------------------------- r22 | mvyskocil | 2011-09-29 09:22:25 | ad6ca37b06dac30a5f861a4b4045bed4 | None | create sign key ... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c4 --- Comment #4 from Adrian Schröter 2011-11-04 08:20:52 UTC --- osc signkey Java:packages | gpg2 --list-packets show this key. So it is not an attack but the want key by project owner. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c6 Ger J changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution| |NORESPONSE --- Comment #6 from Ger J 2011-11-14 23:04:47 UTC --- doesn't seem anyone will answer you, or fix the problem. as of 11/14 it's still occurring ... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c8 Michal Vyskocil changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |NEEDINFO InfoProvider| |adrian@suse.com --- Comment #8 from Michal Vyskocil 2011-11-15 11:12:39 UTC --- Adrian, is there any way how to fix that? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c10 --- Comment #10 from Michal Vyskocil 2011-12-07 09:18:15 UTC --- (In reply to comment #8)

Adrian, is there any way how to fix that?

ping -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c12 Michal Vyskocil changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution| |WONTFIX --- Comment #12 from Michal Vyskocil 2011-12-07 13:43:35 UTC --- Ger, Jiri, please follow the adrian's advice in comment#11 Adrian, thank you for your help. I close this bug as wontfix/cantfix. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c14 Michal Vyskocil changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |NEEDINFO InfoProvider| |adrian@suse.com --- Comment #14 from Michal Vyskocil 2011-12-08 10:49:30 UTC --- Adrian - I did a zypper rm and zypper ar, but I'm getting the same error. Any other advice? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c16 --- Comment #16 from Michal Vyskocil 2011-12-08 12:29:30 UTC --- This is what I'm getting $ zypper rr JavaPkg Removing repository 'JavaPkg' [done] Repository 'JavaPkg' has been removed. mvyskocil@zelva:gtd$ zypper ar http://download.opensuse.org/repositories/Java:/packages/openSUSE_11.4/ JavaPkg Adding repository 'JavaPkg' [done] Repository 'JavaPkg' successfully added Enabled: Yes Autorefresh: No GPG check: Yes URI: http://download.opensuse.org/repositories/Java:/packages/openSUSE_11.4/ $ zypper ref JavaPkg Retrieving repository 'JavaPkg' metadata [\] File 'repomd.xml' from repository 'JavaPkg' is signed with an unknown key 'F7B4039CC2C0E8D4'. Continue? [yes/no] (no): After answering yes message disappear, but I an sure the **unknown key** is not the root problem. For example zypper ar http://download.opensuse.org/repositories/Java:/sun:/Factory/openSUSE_11.4/ sunjava Adding repository 'sunjava' [done] Repository 'sunjava' successfully added Enabled: Yes Autorefresh: No GPG check: Yes URI: http://download.opensuse.org/repositories/Java:/sun:/Factory/openSUSE_11.4/ mvyskocil@zelva:gtd$ zypper ref sunjava Retrieving repository 'sunjava' metadata [done] Building repository 'sunjava' cache [done] Specified repositories have been refreshed. don't print this message - maybe a key was not uploaded to keyserver? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c18 Michal Vyskocil changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |NEEDINFO CC|adrian@suse.com | InfoProvider| |dmacvicar@suse.com --- Comment #18 from Michal Vyskocil 2011-12-08 13:13:00 UTC --- Duncan - can you explain the comment#16 - what's the difference between Java:packages and Java:sun:Factory and what's the *is signed with an unknown key* message about? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c20 Achim Herwig changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |achim.herwig@wodca.de --- Comment #20 from Achim Herwig 2011-12-31 15:31:16 UTC --- Bug still there. Also did the zypper rr / ar dance, no change... The info whether the gpg key is legit would help a lot already. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c22 Adrian Schröter changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |REOPENED CC| |adrian@suse.com InfoProvider|adrian@suse.com | --- Comment #22 from Adrian Schröter 2012-01-02 09:11:56 UTC --- On our servers both are F7B4039CC2C0E8D4 . download.o.o should also not redirect for these files so I wonder where you found a different key ? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c23 --- Comment #23 from Ger J 2012-01-03 23:31:03 UTC --- (In reply to comment #20)

Bug still there. Also did the zypper rr / ar dance, no change...

The info whether the gpg key is legit would help a lot already.

since a year has passed, just reporting ... still @today: File 'repomd.xml' from repository 'JavaPkg' is signed with an unknown key 'F7B4039CC2C0E8D4'. Continue? [yes/no] (no): -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c Ger J changed: What |Removed |Added ---------------------------------------------------------------------------- InfoProvider|dmacvicar@suse.com |mvyskocil@suse.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c26 --- Comment #26 from Ger J 2012-01-31 20:43:43 UTC --- maybe if someone bothered to answer, it wouldn't be a problem, now would it? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c28 Michal Vyskocil changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tonysu@su-networking.com --- Comment #28 from Michal Vyskocil 2012-02-06 08:09:09 UTC --- *** Bug 745153 has been marked as a duplicate of this bug. *** http://bugzilla.novell.com/show_bug.cgi?id=745153 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c30 Frank Schäfer changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |schaefer.frank@gmx.net --- Comment #30 from Frank Schäfer 2012-05-14 09:54:00 UTC --- GPG-key changes on 5. + 8. + 11. + 14. May. How long will this be going on ? If you can't fix it, kill the whole GPG thing. At least change the user message to "Don't care, just click "accept new key" ". MS is laughing about us... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c32 Michael Zapf changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |Michael.Zapf@web.de --- Comment #32 from Michael Zapf 2012-05-28 23:06:20 UTC --- By the way, it is not only annoying to carry on accepting new keys ... I noticed that after doing this my Apper presented some 40 patches to be installed on my system. That is, Apper seems to get stuck by this problem in the background, so I'd say this is some major issue to be solved. or I'll have to kick this repo out of my list and install Java manually. Michael -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c34 --- Comment #34 from Tony Su 2012-07-18 23:30:01 UTC --- The updated behavior seems to be that this is happening on a weekly basis like clockwork. The problem disappears approximately somewhere between Wednesday to Saturday each week, only to reappear somewhere approximately Sunday to Wednesday each week. Without knowing exactly how the repos are configured(ie one way or two-way syncs, priorities), to me this suspiciously looks like the problem likely is some kind of mis-configured sync partner, configured to sync weekly. Although I'd be somewhat surprised that a sync does not check for repo integrity using the same certs used for end-user authentication, If I were to guess, this could be a result from months ago when the java repo was configured with an untrusted cert which resulted <always> in an error. Someone replaced with a trusted cert, but I suspect that somehow that cert wasn't replicated to <all> the repo sync partners and a server with "higher authority" in the sync cluster has retained and refuses to give up the untrusted cert. Anyway, that's my guess... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=727586 https://bugzilla.novell.com/show_bug.cgi?id=727586#c36 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium CC| |meissner@suse.com AssignedTo|mvyskocil@suse.com |mls@suse.com Summary|[security] Java:packages: |BAD GPG KEY: [security] |Bug -- repository "signed |Java:packages: Bug -- |with an unknown key" |repository "signed with an | |unknown key" --- Comment #36 from Marcus Meissner 2013-01-26 15:24:49 UTC --- Micha, the key in this repository is badly generated and probably will not recover without your manual intervention. $ gpg repomd.xml.key gpg: public key C2C0E8D4 is 109 seconds newer than the signature pub 1024D/C2C0E8D4 2011-09-29 Java:packages OBS Project Java:packages@build.opensuse.org $ This must have happened with a skeewed clock either between the sign host and another host, or some other problem... Can you please fix it / generate a completely new key? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.