http://bugzilla.opensuse.org/show_bug.cgi?id=1207810 Bug ID: 1207810 Summary: suspicious mirror Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: openSUSE Tumbleweed Status: NEW Severity: Critical Priority: P5 - None Component: Security Assignee: security-team@suse.de Reporter: lcfork233@proton.me QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- Warning: Digest verification failed for file 'bd28fa48d984b87e9f52b9940f844fd074579967dba3469b510d39488984684cbfc2513d2f461fb6bef645f3f17eedbcd23174714908089d819371fe714220f0-primary.xml.gz' [/var/tmp/AP_0xPIL2U8/repodata/bd28fa48d984b87e9f52b9940f844fd074579967dba3469b510d39488984684cbfc2513d2f461fb6bef645f3f17eedbcd23174714908089d819371fe714220f0-primary.xml.gz] expected bd28fa48d984b87e9f52b9940f844fd074579967dba3469b510d39488984684cbfc2513d2f461fb6bef645f3f17eedbcd23174714908089d819371fe714220f0 but got e14006d801ecead6e58949f5b34cf0b56e1ada07493d50ee123080c9a0b26c21e53a8d27e62f3438367a3b435992447d925f13636c47d651fa389dd9a5e5aafe Accepting packages with wrong checksums can lead to a corrupted system and in extreme cases even to a system compromise. However if you made certain that the file with checksum 'e140..' is secure, correct and should be used within this operation, enter the first 4 characters of the checksum to unblock using this file on your own risk. Empty input will discard the file. Unblock or discard? [e140/...? shows all options] (discard): When doing zypper refresh, digest verification failed, and everytime the checksum would change. I used ```curl -LI http://download.opensuse.org/tumbleweed/repo/non-oss/repodata/bd28fa48d984b87e9f52b9940f844fd074579967dba3469b510d39488984684cbfc2513d2f461fb6bef645f3f17eedbcd23174714908089d819371fe714220f0-primary.xml.gz``` to check what mirror is doing funky things, I got opensuse.ucom.am. This mirror seems to have outdated/modified softwares. It seems suspicious and should be avoided at all cost. -- You are receiving this mail because: You are on the CC list for the bug.