[opensuse-buildservice] Key change for openSUSE:Tools?
I'm suddenly seeing the error below. Did the key for openSUSE:Tools change? I just resubscribed to this list so my apologies if there was some announcement (I didn't see anything to that effect in the archives). $ zypper -vvvvv ref openSUSE_Tools Verbosity: 5 Non-option program arguments: 'openSUSE_Tools' Initializing Target Specified repositories: openSUSE_Tools Checking whether to refresh metadata for openSUSE.org tools (openSUSE_11.3) Retrieving: http://download.opensuse.org/repositories/openSUSE:/Tools/openSUSE_11.3/repo... [done] Retrieving: http://download.opensuse.org/repositories/openSUSE:/Tools/openSUSE_11.3/repo... [done] Retrieving: http://download.opensuse.org/repositories/openSUSE:/Tools/openSUSE_11.3/repo... [done] Signature verification failed for file 'repomd.xml' from repository 'openSUSE.org tools (openSUSE_11.3)'. Warning: This might be caused by a malicious change in the file! Continuing might be risky. Continue anyway? [yes/no] (no): Thanks, -Archie -- Archie L. Cobbs -- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-buildservice+owner@opensuse.org
Am Mittwoch, 14. Dezember 2011, 11:05:56 schrieb Archie Cobbs:
I'm suddenly seeing the error below.
Did the key for openSUSE:Tools change?
The last time in July 2010. But only extended at that point of time.
I just resubscribed to this list so my apologies if there was some announcement (I didn't see anything to that effect in the archives).
$ zypper -vvvvv ref openSUSE_Tools Verbosity: 5 Non-option program arguments: 'openSUSE_Tools' Initializing Target Specified repositories: openSUSE_Tools Checking whether to refresh metadata for openSUSE.org tools (openSUSE_11.3) Retrieving: http://download.opensuse.org/repositories/openSUSE:/Tools/openSUSE_11.3/rep odata/repomd.xml.asc [done] Retrieving: http://download.opensuse.org/repositories/openSUSE:/Tools/openSUSE_11.3/rep odata/repomd.xml.key [done] Retrieving: http://download.opensuse.org/repositories/openSUSE:/Tools/openSUSE_11.3/rep odata/repomd.xml [done] Signature verification failed for file 'repomd.xml' from repository 'openSUSE.org tools (openSUSE_11.3)'.
I do not see anything broken here atm. But you may got data from a broken (or even evil) mirror. You can check in zypp.log from where. bye adrian
Warning: This might be caused by a malicious change in the file! Continuing might be risky. Continue anyway? [yes/no] (no):
Thanks, -Archie -- Adrian Schroeter SUSE Linux Products GmbH email: adrian@suse.de
-- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-buildservice+owner@opensuse.org
Thanks for the help. It appears that the repomd.xml.asc file on opensuse.mirror.netriplex.com is different from download.opensuse.org (though repomd.xml and repomd.xml.key are correct): diff -u download.opensuse.org/repomd.xml.asc opensuse.mirror.netriplex.com/repomd.xml.asc --- download.opensuse.org/repomd.xml.asc 2011-12-15 08:12:21.000000000 -0600 +++ opensuse.mirror.netriplex.com/repomd.xml.asc 2011-09-02 07:26:55.000000000 -0500 @@ -1,7 +1,7 @@ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) -iD4DBQBO6gBFhXU6pe7+/ekRAob5AJi7vT9Vv++RLNc1lJ/chCCe/Y9kAJ9WEqdj -rTxQJCen1jRISBDMOB9bXA== -=A/gD +iD8DBQBOYMuPhXU6pe7+/ekRAqEaAJ0ef5ZBqKbouTcmOPlH+lnGEKoDEQCe +MtWAWkWn1PAZnhdF0gnKkn5pBq8= +=+a2Y -----END PGP SIGNATURE----- Can someone investigate this? This has been the situation for about three days now. This is difficult for us because in my location I always get this same mirror: HTTP/1.1 302 Found Date: Thu, 15 Dec 2011 15:16:07 GMT Server: Apache/2.2.12 (Linux/SUSE) X-Prefix: 74.207.224.0/20 X-AS: 3595 X-MirrorBrain-Mirror: opensuse.mirror.netriplex.com X-MirrorBrain-Realm: country Location: http://opensuse.mirror.netriplex.com/repositories/openSUSE:/Tools/openSUSE_1... Cache-Control: max-age=0 Expires: Thu, 15 Dec 2011 15:16:07 GMT Content-Length: 374 Keep-Alive: timeout=2, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Thanks, -Archie On Thu, Dec 15, 2011 at 1:52 AM, Adrian Schröter <adrian@suse.de> wrote:
Am Mittwoch, 14. Dezember 2011, 11:05:56 schrieb Archie Cobbs:
I'm suddenly seeing the error below.
Did the key for openSUSE:Tools change?
The last time in July 2010. But only extended at that point of time.
I just resubscribed to this list so my apologies if there was some announcement (I didn't see anything to that effect in the archives).
$ zypper -vvvvv ref openSUSE_Tools Verbosity: 5 Non-option program arguments: 'openSUSE_Tools' Initializing Target Specified repositories: openSUSE_Tools Checking whether to refresh metadata for openSUSE.org tools (openSUSE_11.3) Retrieving: http://download.opensuse.org/repositories/openSUSE:/Tools/openSUSE_11.3/rep odata/repomd.xml.asc [done] Retrieving: http://download.opensuse.org/repositories/openSUSE:/Tools/openSUSE_11.3/rep odata/repomd.xml.key [done] Retrieving: http://download.opensuse.org/repositories/openSUSE:/Tools/openSUSE_11.3/rep odata/repomd.xml [done] Signature verification failed for file 'repomd.xml' from repository 'openSUSE.org tools (openSUSE_11.3)'.
I do not see anything broken here atm. But you may got data from a broken (or even evil) mirror. You can check in zypp.log from where.
bye adrian
Warning: This might be caused by a malicious change in the file! Continuing might be risky. Continue anyway? [yes/no] (no):
Thanks, -Archie -- Adrian Schroeter SUSE Linux Products GmbH email: adrian@suse.de
-- Archie L. Cobbs -- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-buildservice+owner@opensuse.org
participants (2)
-
Adrian Schröter -
Archie Cobbs