Am Mittwoch, 8. Januar 2020, 09:55:19 CET schrieb stakanov:

In data martedì 7 gennaio 2020 19:26:01 CET, Todd Rme ha scritto:

...

I am getting the following issue with the NVidia repository with YaST2:

An error occurred during repository initialization. [NVidia|https://download.nvidia.com/opensuse/tumbleweed] Valid metadata not found at specified URL History: - Signature verification failed for repomd.xml - Can't provide /repodata/repomd.xml

Has the signature changed or is there another issue?

I can confirm this, but I am getting a slightly other error, that is: the content of the xml file has been changed after application of the signature (which can indicate damage or compromised content!)

I would have the following two questions: 1) in general terms, as this is a "third party", do we have to give this kind of information to opensuse (as here in factory or as a bugreport on bugzilla?) or shall we forward the information to nvidia? 2) if opensuse is the receiver: a mail like this or a bug report? Which is more appropriate for such an error

Thank you in advance.

This happens (almost) every time there is a new nvidia driver. What happens is this: the driver packages get updated, repository gets recreated and copied to nvidia's servers. Then, the CDN that nvidia uses picks up the new files - and for some reason not all of them, my guess is it operates based on filenames but not checksums, so any files that still have the same name aren't refreshed on the CDN. So, (stll guessing here) the right contact to talk to would be nvidia. And I fully expect there to be at least 15 escalation levels in a row before it reaches someone who would even begin to understand what we're talkking about. my experience so far is that eventually it's going to "fix itself", once everything is in sync on their CDN again. Of course that isn't really acceptable. Cheers MH -- Mathias Homann Mathias.Homann@openSUSE.org telegram: https://telegram.me/lemmy98 irc: [lemmy] on freenode and ircnet obs: lemmy04 gpg key fingerprint: 8029 2240 F4DD 7776 E7D2 C042 6B8E 029E 13F2 C102 -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 08/01/2020 09.55, stakanov wrote: | In data martedì 7 gennaio 2020 19:26:01 CET, Todd Rme ha scritto: |> I am getting the following issue with the NVidia repository with |> YaST2: |> |> An error occurred during repository initialization. |> [NVidia|https://download.nvidia.com/opensuse/tumbleweed] Valid |> metadata not found at specified URL History: - Signature |> verification failed for repomd.xml - Can't provide |> /repodata/repomd.xml |> |> Has the signature changed or is there another issue? | I can confirm this, but I am getting a slightly other error, that | is: the content of the xml file has been changed after application | of the signature (which can indicate damage or compromised | content!) | | I would have the following two questions: 1) in general terms, as | this is a "third party", do we have to give this kind of | information to opensuse (as here in factory or as a bugreport on | bugzilla?) or shall we forward the information to nvidia? There a readme file somewhere in the nvidia server that says clearly the responsibility for the rpms lie with *suse. However, this is not the rpm per se, but repository metadata, thus I'm not sure. Still I guess *suse. - -- Cheers / Saludos, Carlos E. R. (from 15.1 x86_64 at Telcontar) -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQQZEb51mJKK1KpcU/W1MxgcbY1H1QUCXhW2HwAKCRC1MxgcbY1H 1ZExAJ96r9HcnDmxGH9CL64H9S/gq7VIdgCeIri+DgB+EWqq/5KKNSD+52pF3+4= =jnlP -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org