OK, I finally got it working. Here are some notes in case anyone else is struggling to add updates to their SLES 11 SP1 autoinstall. First, when you get "Error: failed to add add-on product", press CTRL-ALT-F2 to get to the shell prompt. Examine /var/log/YaST2/y2log. Somewhere among the last ~100 lines you will find more details about the failure. Second, "relurl://" is only supported by add_on_products.xml; it simply does not work in the <add-on> section of autoinst.xml. Neither does "file://", since it does not refer to the installation source. "cd:///updates" does work, but I am leaning towards sticking with add_on_products.xml because I like the idea of "relurl:". Third, I was completely unable to get the various <signature-handling> options to work. (I only tried it in the <global> section, not as part of the add-on.) No matter what I tried, my updates repository was rejected because of signature failures. So I had to do the Full Monty: I created a GPG key, used it to sign the updates/content and SHA1SUMS files, and added the key to the initrd. These steps are documented in different places: http://ugansert.blogspot.com/2009/01/opensuse-111-sles11-and-add-ons.html (SHA1SUMS) http://www.suse.com/~ug/AutoYaST_FAQ.html#bB (updates/content) I automated this entire process, from generating the GPG key to signing the files to adding the key to the initrd... It is a single Makefile that I would be happy to clean up and share if anybody thinks that might be useful. Is there someplace I could upload it? A wiki or something? One last war story and a suggestion. The messages in y2log are verbose, yet not entirely complete... At one point, the "failed to add add-on product" error was caused by a failure to add my GPG key (from the initrd) to the trusted keyring. y2log showed the complete "gpg2 --import ..." command, and it showed that gpg2 had exited non-zero, but it did not contain the actual error message from gpg2. I had to run the full gpg2 command by hand to see the error. It was a time conflict; my key was rejected because its self-signature appeared to be from the future. (I am doing a fresh installation on new hardware, so the CMOS clock was off by a few days, and I had just created the key on a system with an accurate clock.) I would suggest that during an automated installation, the "--ignore-time-conflict" option to gpg2 is appropriate. There is no reason to expect the system clock to be sane until *after* the system is installed... And this failure mode is not exactly pretty. Anyway, thanks for all of the feedback and references. They helped a lot. - Pat -- To unsubscribe, e-mail: opensuse-autoinstall+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-autoinstall+help@opensuse.org