Hi,
someone else experiencing Problems with the SLE11-SDK-SP2-Updates repo?
Doing a "zypper ref" on a SLES 11 SP2 machine, I get
---snip---
Repository 'SLE11-SDK-SP2-Core' is up to date. Retrieving repository 'SLE11-SDK-SP2-Updates' metadata [|] Signature verification failed for file 'repomd.xml' from repository 'SLE11-SDK-SP2-Updates'. Warning: This might be caused by a malicious change in the file! Continuing might be risky. Continue anyway? [yes/no] (no):
---pins---
And thus I fail connecting the box to our SUSE Manager. "smt-mirror" on the old SMT server shows the same problem.
---snip--- cat /etc/zypp/repos.d/nu_novell_com:SLE11-SDK-SP2-Updates.repo [nu_novell_com:SLE11-SDK-SP2-Updates] name=SLE11-SDK-SP2-Updates enabled=1 autorefresh=1 baseurl=https://nu.novell.com/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64?credenti... type=rpm-md keeppackages=0 service=nu_novell_com ---pins---
Regards, Werner
I get this quite often too. I am guessing it happens because mirrors don't get updated atomically, so sometimes a given mirror will have an inconsistent set of files. If you wait a day or so it usually gets better.
It would be nice if there were a way of directing zypper to try different mirrors, because I often find that zypper works on machine A but not on machine B. Does anyone know how to do this?
Regards, Bob
On Mon, 17 Jun 2013, Werner Flamme wrote:
Hi,
someone else experiencing Problems with the SLE11-SDK-SP2-Updates repo?
Doing a "zypper ref" on a SLES 11 SP2 machine, I get
---snip---
Repository 'SLE11-SDK-SP2-Core' is up to date. Retrieving repository 'SLE11-SDK-SP2-Updates' metadata [|] Signature verification failed for file 'repomd.xml' from repository 'SLE11-SDK-SP2-Updates'. Warning: This might be caused by a malicious change in the file! Continuing might be risky. Continue anyway? [yes/no] (no):
---pins---
And thus I fail connecting the box to our SUSE Manager. "smt-mirror" on the old SMT server shows the same problem.
---snip--- cat /etc/zypp/repos.d/nu_novell_com:SLE11-SDK-SP2-Updates.repo [nu_novell_com:SLE11-SDK-SP2-Updates] name=SLE11-SDK-SP2-Updates enabled=1 autorefresh=1 baseurl=https://nu.novell.com/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64?credenti... type=rpm-md keeppackages=0 service=nu_novell_com ---pins---
Regards, Werner
--
-- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-security+owner@opensuse.org
============================================================== Bob Vickers R.Vickers@cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691
Thank you for confirming.
Looking at my "SMT mirror" logs, I see the last successful sync for that repo was on June 11th. From June 12th on, I get errors as quoted. Is it possible that the mirrors do not get in sync for five days?
---snip--- Mirroring: https://nu.novell.com/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/ Target: /srv/ftp/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64 D /srv/ftp/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/.repodata/repomd.xml E '/srv/ftp/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/.repodata/filelists.xml.gz': Checksum mismatch' File not found /srv/ftp/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/.repodata/filelists.xml.gz E '/srv/ftp/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/.repodata/other.xml.gz': Checksum mismatch' File not found /srv/ftp/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/.repodata/other.xml.gz E '/srv/ftp/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/.repodata/primary.xml.gz': Checksum mismatch' File not found /srv/ftp/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/.repodata/primary.xml.gz E '/srv/ftp/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/.repodata/updateinfo.xml.gz': Checksum mismatch' File not found /srv/ftp/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/.repodata/updateinfo.xml.gz E '/srv/ftp/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/.repodata/susedata.xml.gz': Checksum mismatch' File not found /srv/ftp/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/.repodata/susedata.xml.gz E '/srv/ftp/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/.repodata/deltainfo.xml.gz': Checksum mismatch' File not found /srv/ftp/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/.repodata/deltainfo.xml.gz Finished downloading and parsing the metadata, going to download the rest of the files... D /srv/ftp/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/.repodata/repomd.xml.asc D /srv/ftp/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/.repodata/repomd.xml.key => Finished mirroring 'https://nu.novell.com/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/' => Total files : 9 => Total transferred files : 3 => Total transferred file size : 64613704 bytes (61.62 MB) => Total linked files : 0 => Total copied files : 0 => Files up to date : 0 => Errors : 12 => Mirror Time : 00:01:27 => New security updates : 0 => New recommended updates : 0 ---pins---
I just deleted the .repodata and repodata subdir. The errors persisted. After mirroring, .repodata contained three files: drwxr-xr-x 2 smt www 65 Jun 17 12:06 .repodata drwxr-xr-x 2 smt www 65 Jun 17 12:07 repodata drwxr-xr-x 5 smt www 42 Apr 13 2012 rpm
I created repodata dir, copied the files - and smt-mirror does not show any errors. There is no attempt to fetch filelists.xml.gz, other.xml.gz, primary.xml.gz, updateinfo.xml.gz, susedata.xml.gz or deltainfo.xml.gz.
Of course, on a host using the mirrored repo, I get
---snip--- Retrieving repository 'SLE11-SDK-SP2-Updates' metadata [] Signature verification failed for file 'repomd.xml' from repository 'SLE11-SDK-SP2-Updates'. Warning: This might be caused by a malicious change in the file! Continuing might be risky. Continue anyway? [yes/no] (no): Retrieving repository 'SLE11-SDK-SP2-Updates' metadata [error] Repository 'SLE11-SDK-SP2-Updates' is invalid. [|] Valid metadata not found at specified URL(s) Please check if the URIs defined for this repository are pointing to a valid repository. Skipping repository 'SLE11-SDK-SP2-Updates' because of the above error. ---pins---
So, I guess I just have to wait until the next patch is submitted (and the sync hopefully completes) or until my DNS provides a host that has synced correctly. Currently, this is
---snip--- host nu.novell.com nu.novell.com is an alias for nu.novell.com.edgekey.net. nu.novell.com.edgekey.net is an alias for e4579.c.akamaiedge.net. e4579.c.akamaiedge.net has address 23.63.146.147 ---pins---
Bob Vickers [17.06.2013 11:08]:
I get this quite often too. I am guessing it happens because mirrors don't get updated atomically, so sometimes a given mirror will have an inconsistent set of files. If you wait a day or so it usually gets better.
It would be nice if there were a way of directing zypper to try different mirrors, because I often find that zypper works on machine A but not on machine B. Does anyone know how to do this?
Regards, Bob
On Mon, 17 Jun 2013, Werner Flamme wrote:
Hi,
someone else experiencing Problems with the SLE11-SDK-SP2-Updates repo?
Doing a "zypper ref" on a SLES 11 SP2 machine, I get
---snip---
Repository 'SLE11-SDK-SP2-Core' is up to date. Retrieving repository 'SLE11-SDK-SP2-Updates' metadata [|] Signature verification failed for file 'repomd.xml' from repository 'SLE11-SDK-SP2-Updates'. Warning: This might be caused by a malicious change in the file! Continuing might be risky. Continue anyway? [yes/no] (no):
---pins---
And thus I fail connecting the box to our SUSE Manager. "smt-mirror" on the old SMT server shows the same problem.
---snip--- cat /etc/zypp/repos.d/nu_novell_com:SLE11-SDK-SP2-Updates.repo [nu_novell_com:SLE11-SDK-SP2-Updates] name=SLE11-SDK-SP2-Updates enabled=1 autorefresh=1 baseurl=https://nu.novell.com/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64?credenti... type=rpm-md keeppackages=0 service=nu_novell_com ---pins---
Regards, Werner
--
On Mon, Jun 17, 2013 at 10:08:51AM +0100, Bob Vickers wrote:
I get this quite often too. I am guessing it happens because mirrors don't get updated atomically, so sometimes a given mirror will have an inconsistent set of files. If you wait a day or so it usually gets better.
It would be nice if there were a way of directing zypper to try different mirrors, because I often find that zypper works on machine A but not on machine B. Does anyone know how to do this?
There is some mirroring in the background via Akamai... However if the problem persists, either one Akamai mirror is out of sync, or the repo itself is out of sync.
It currently looks good for me on my server.
Can you check zypper.log which file had the incorrect checksum?
Ciao, Marcus
Marcus Meissner [17.06.2013 13:19]:
On Mon, Jun 17, 2013 at 10:08:51AM +0100, Bob Vickers wrote:
I get this quite often too. I am guessing it happens because mirrors don't get updated atomically, so sometimes a given mirror will have an inconsistent set of files. If you wait a day or so it usually gets better.
It would be nice if there were a way of directing zypper to try different mirrors, because I often find that zypper works on machine A but not on machine B. Does anyone know how to do this?
There is some mirroring in the background via Akamai... However if the problem persists, either one Akamai mirror is out of sync, or the repo itself is out of sync.
It currently looks good for me on my server.
Can you check zypper.log which file had the incorrect checksum?
Marcus,
sorry, I can't :-(. "grep '2013-06-17 12' /var/log/zypper.log " gives 1940 lines, and they are very confusing, I cannot filter them for more details.
The only place where I see errors in these lines they are talking about the "repomd.xml" file, which was also printed in the error log I quoted in 51BEE2F2.5040807@ufz.de.
The error persists for 5 days now - it often happens that I have a "wrong checksum" error, but it's usually gone after a few hours. This time it seems different, so I asked...
Regards, Werner
[17.06.2013 14:26] [Werner Flamme]:
Today, the SMT sync succeeded after 5 days of giving checksum errors:
=> Finished mirroring 'https://nu.novell.com/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/' => Total files : 21 => Total transferred files : 16 => Total transferred file size : 21625543 bytes (20.62 MB) => Total linked files : 5 => Total copied files : 0 => Files up to date : 2373 => Errors : 0 => Mirror Time : 00:01:02 => New security updates : 111 * Security update for rubygem-json_pure * Security update for IBM Java * Security update for libxml2 * Security update for Mozilla Firefox * Security update for libwebkit * Security update for Mozilla Firefox * Security update for PHP5 ...
Either there were new patches and the sync succeeded this time, or Marcus had a golden fingertip ;-). Thank you!
Regards, Werner
On Tue, Jun 18, 2013 at 07:31:20AM +0200, Werner Flamme wrote:
[17.06.2013 14:26] [Werner Flamme]:
Today, the SMT sync succeeded after 5 days of giving checksum errors:
=> Finished mirroring 'https://nu.novell.com/repo/$RCE/SLE11-SDK-SP2-Updates/sle-11-x86_64/' => Total files : 21 => Total transferred files : 16 => Total transferred file size : 21625543 bytes (20.62 MB) => Total linked files : 5 => Total copied files : 0 => Files up to date : 2373 => Errors : 0 => Mirror Time : 00:01:02 => New security updates : 111
- Security update for rubygem-json_pure
- Security update for IBM Java
- Security update for libxml2
- Security update for Mozilla Firefox
- Security update for libwebkit
- Security update for Mozilla Firefox
- Security update for PHP5
...
Either there were new patches and the sync succeeded this time, or Marcus had a golden fingertip ;-). Thank you!
There were new patches (e.g. the kernel).
We will have to watch this a bit closer.
Ciao, Marcus
-
Bob Vickers -
Marcus Meissner -
Werner Flamme