https://bugzilla.suse.com/show_bug.cgi?id=1224292 Lubos Kocman changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|security-team@suse.de |lubos.kocman@suse.com -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1224292 https://bugzilla.suse.com/show_bug.cgi?id=1224292#c2 --- Comment #2 from Adrian Schröter --- hm, the key is configured, but the public key file was missing on our main backend. Please try a rebuild for verification. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1224292 https://bugzilla.suse.com/show_bug.cgi?id=1224292#c3 --- Comment #3 from Max Lin --- (In reply to Adrian Schröter from comment #2)

hm, the key is configured, but the public key file was missing on our main backend.

Please try a rebuild for verification.

that is Build695.1 and Build696.2 FYI -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1224292 https://bugzilla.suse.com/show_bug.cgi?id=1224292#c5 Michael Calmer changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(mc@suse.com) | --- Comment #5 from Michael Calmer --- I still get the old key. $> curl -vvv -L -O https://download.opensuse.org/distribution/leap/15.6/repo/oss/repodata/repom... Connected to download.opensuse.org (2a07:de40:b250:131:10:151:131:30) port 443 (#0) ... * SSL connection using TLSv1.3 / TLS_CHACHA20_POLY1305_SHA256 * ALPN: server accepted h2 * Server certificate: * subject: CN=mirrorcache.opensuse.org * start date: Apr 22 00:21:12 2024 GMT * expire date: Jul 21 00:21:11 2024 GMT * subjectAltName: host "download.opensuse.org" matched cert's "download.opensuse.org" * issuer: C=US; O=Let's Encrypt; CN=R3 * SSL certificate verify ok. } [5 bytes data] * using HTTP/2 * h2h3 [:method: GET] * h2h3 [:path: /distribution/leap/15.6/repo/oss/repodata/repomd.xml.key] * h2h3 [:scheme: https] * h2h3 [:authority: download.opensuse.org] * h2h3 [user-agent: curl/8.0.1] * h2h3 [accept: */*] * Using Stream ID: 1 (easy handle 0x558cd07d77e0) } [5 bytes data]

GET /distribution/leap/15.6/repo/oss/repodata/repomd.xml.key HTTP/2 Host: download.opensuse.org user-agent: curl/8.0.1 accept: */* ... < HTTP/2 200 < date: Thu, 16 May 2024 11:20:56 GMT < server: Mojolicious (Perl) < cache-control: public, max-age=231 < content-disposition: inline;filename="repomd.xml.key" < content-length: 988

Content Length of 988 is the length of the old key. The new one should have more than 1024 It also does not look like it is using a mirror. No idea what happens -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1224292 https://bugzilla.suse.com/show_bug.cgi?id=1224292#c7 --- Comment #7 from Max Lin --- (In reply to Lubos Kocman from comment #4)

Michael can you please confirm that issue is fixed for your team?

we need to publish Build696.2(with newer repo metadata has uploaded to d.o.o) in case SUMA team be able to verify it with SUSE manager or uyuni... without a publishing, the alternative options are autobuild might can verify it on build service, or do a verification on https://openqa.opensuse.org/assets/repo/openSUSE-Leap-15.6-oss-Build696.2 (the asset repo on openqa has newer repodata). -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1224292 https://bugzilla.suse.com/show_bug.cgi?id=1224292#c9 Adrian Schröter changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|IN_PROGRESS |RESOLVED --- Comment #9 from Adrian Schröter --- the new key is there now in Build696.3 -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1224292 https://bugzilla.suse.com/show_bug.cgi?id=1224292#c11 --- Comment #11 from Michael Calmer --- distribution/ is now fixed. The problem is still present for the "update" repositories. But as there is no update released yet, it could just be that it get's fixed with the first release of an update. -- You are receiving this mail because: You are on the CC list for the bug.