http://bugzilla.suse.com/show_bug.cgi?id=899510 Nathan Cutler changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ncutler@suse.com -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=899510 Michael Andres changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|obs:running:3312:moderate | -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=899510 --- Comment #4 from grant k ---

Next will be to detect and fix issues when actually using this feature.

fyi Upgraded to rpm -qa | egrep -i "libzypp|zypper" zypper-1.11.17-5.1.x86_64 zypper-log-1.11.17-5.1.noarch libzypp-14.32.0-5.3.x86_64 libzypp-devel-14.32.0-5.3.x86_64 Adding 2 URLs to a test repo cat /etc/zypp/repos.d/LibreOffice.repo [LibreOffice] name=LibreOffice enabled=1 baseurl=http://anorien.csc.warwick.ac.uk/mirrors/download.opensuse.org/repositories/... http://download.opensuse.org/repositories/LibreOffice:/Factory/openSUSE_13.2... type=rpm-md autorefresh=1 keeppackages=0 gpgcheck=1 now is accepted & refreshes correctly, using the 1st URL in the list zypper -vvv ref LibreOffice Verbosity: 3 Non-option program arguments: 'LibreOffice' Initializing Target Specified repositories: LibreOffice Checking whether to refresh metadata for LibreOffice Retrieving: http://anorien.csc.warwick.ac.uk/mirrors/download.opensuse.org/repositories/... ........................................................................................[done] Repository 'LibreOffice' is up to date. Specified repositories have been refreshed. manually failing the 1st repo to check fallback - baseurl=http://anorien.csc.warwick.ac.uk/mirrors/download.opensuse.org/repositories/... + baseurl=http://anorien.csc.warwick.ac.uk/mirrors/download.opensuse.org/repositories/... http://download.opensuse.org/repositories/LibreOffice:/Factory/openSUSE_13.2... attempt at refresh FAILs to fallback to the 2nd URL zypper -vvv ref LibreOffice Verbosity: 3 Non-option program arguments: 'LibreOffice' Initializing Target Specified repositories: LibreOffice Checking whether to refresh metadata for LibreOffice Retrieving: http://anorien.csc.warwick.ac.uk/mirrors/download.opensuse.org/repositories/... ......................................................................................[error] File '/repodata/repomd.xml' not found on medium 'http://anorien.csc.warwick.ac.uk/mirrors/download.opensuse.org/repositories/...' Abort, retry, ignore? [a/r/i/? shows all options] (a): -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=899510 --- Comment #6 from grant k --- also, fyi With cat /etc/zypp/repos.d/KernelStable.repo [KernelStable] enabled=1 name=KernelStable baseurl=http://anorien.csc.warwick.ac.uk/mirrors/download.opensuse.org/repositories/... http://download.opensuse.org/repositories/Kernel:/stable/standard autorefresh=1 gpgcheck=1 keeppackages=0 type=rpm-md zypper dup ... Retrieving package kernel-devel-3.18.2-2.1.g88366a3.noarch (3/60), 10.1 MiB ( 49.1 MiB unpacked) Retrieving: kernel-devel-3.18.2-2.1.g88366a3.noarch.rpm .........................................[done (573.5 KiB/s)] Warning: Digest verification failed for file 'kernel-devel-3.18.2-2.1.g88366a3.noarch.rpm' [/var/cache/zypp/packages/KernelStable/noarch/kernel-devel-3.18.2-2.1.g88366a3.noarch.rpm] expected 1e6a1d32c55d0cc47aaf8a71f5ecb7fd177bfee4ec2b148534e1d46da02bbdf5 but got ae10130716e6e0ec3ab833aa854308cf73b37abc608868339bd3858069e17a9a However if you made certain that the file with checksum 'ae10..' is secure, correct and should be used within this operation, enter the first 4 characters of the checksum to unblock using this file on your own risk. Empty input will discard the file. Unblock or discard? [ae10/? shows all options] (discard): But changing Changing - baseurl=http://anorien.csc.warwick.ac.uk/mirrors/download.opensuse.org/repositories/... - http://download.opensuse.org/repositories/Kernel:/stable/standard + baseurl=http://download.opensuse.org/repositories/Kernel:/stable/standard Now zypper dup ... Retrieving: kernel-devel-3.18.2-2.1.g88366a3.noarch.rpm .........................................[done (397.0 KiB/s)] ( 1/58) Installing: kernel-devel-3.18.2-2.1.g88366a3 ..........................................................[done] Retrieving package kernel-source-3.18.3-1.1.gc3e148f.noarch (2/58), 76.9 MiB (471.5 MiB unpacked) ... Should fallback on digest failure be enabled? Not convinced myself ... -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=899510 --- Comment #7 from Michael Andres --- zypper-1.11.24 will not prompt for action, while there are more baseurls to try to download from. However if a download succeeded, the package is expected to be 'correct'; i.e. to pass the digest check. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=899510 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |ibs:running:3287:low -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=899510 http://bugzilla.suse.com/show_bug.cgi?id=899510#c11 --- Comment #11 from Swamp Workflow Management --- SUSE-RU-2017:0010-1: An update that has four recommended fixes can now be installed. Category: recommended (low) Bug References: 1010096,899510,945169,964932 CVE References: Sources used: SUSE OpenStack Cloud 5 (src): libzypp-9.40.2-14.7, zypper-1.6.334-26.3 SUSE Manager Proxy 2.1 (src): libzypp-9.40.2-14.7, zypper-1.6.334-26.3 SUSE Manager 2.1 (src): libzypp-9.40.2-14.7, zypper-1.6.334-26.3 SUSE Linux Enterprise Software Development Kit 11-SP4 (src): libzypp-9.40.2-14.7 SUSE Linux Enterprise Server 11-SP4 (src): libzypp-9.40.2-14.7, zypper-1.6.334-26.3 SUSE Linux Enterprise Server 11-SP3-LTSS (src): libzypp-9.40.2-14.7, zypper-1.6.334-26.3 SUSE Linux Enterprise Point of Sale 11-SP3 (src): libzypp-9.40.2-14.7, zypper-1.6.334-26.3 SUSE Linux Enterprise Debuginfo 11-SP3 (src): libzypp-9.40.2-14.7, zypper-1.6.334-26.3 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=899510 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|maint:running:63268:low |. -- You are receiving this mail because: You are on the CC list for the bug.