Bug 1086738 - Error message 'Digest verification failed' during installation
Error message 'Digest verification failed' during installation
Status: RESOLVED FIXED
Classification: openSUSE
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Installation
Current
i686 openSUSE Factory
: P5 - None : Normal (vote)
: ---
Assigned To: E-mail List
Jiri Srain
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2018-03-24 23:06 UTC by Thomas Holleis
Modified: 2018-04-16 09:32 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---
dimstar: needinfo? (thomas.holleis)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Holleis 2018-03-24 23:06:49 UTC
In the beginning of the installation process with 'openSUSE-Tumbleweed-NET-i586-Snapshot20180320-Media.iso' on my notebook (HP Compaq nx7300, Celeron CPU) following error message dialog (text mode) will be shown:

http://download.opensuse.org/tumbleweed/repo/oss/boot/i386/yast2-trans-en_US.rpm: Digest verification failed.
If you really trust your repository, you may continue in an insecure mode.
    [OK]   [*Back]

Log message from console:

loading http://download.opensuse.org/tumbleweed/repo/oss/boot/i386/yast2-trans-en_US.rpm -> /download/file_0006
sha1   37d35af88cb0593905e6cfcc1761349b
sha256 7ea4a636ee4e7f3f0b4236f8a7944ac3
digest check failed

The current listed sha256 checksum on 'http://download.opensuse.org/tumbleweed/repo/oss/CHECKSUMS' for 'boot/i386/yast2-trans-en_US.rpm' is 70e0d01be3b8f13d2581c03c28a29d08e65aa21cf54b118fea5fa9a6c074924c.
Comment 1 Jean Delvare 2018-03-25 09:11:29 UTC
I have the same error message here, but on a different file (boot/i386/loader/initrd).
Comment 2 Dominique Leuenberger 2018-03-26 08:13:42 UTC
This was a side-effect of the migration to the new product builder, which publishes the repo now cleanly as 'rpm-md', no longer using susetags.

But as the FTP Mirroring is setup in a way to 'preserve old files for 3 days' (so that reverting to older RPM versions is still possible),l some susetags file remained in place (namely /content in this case) which confused linuxrc on where to find the digest verification checksums for the current FTP tree.

content has been removed, and from my tests at least, linuxrc was happy getting initrd from the FTP tree again.

Can you please retest from your side?
Comment 3 Jean Delvare 2018-03-26 09:08:45 UTC
Still doesn't work for me (on 32-bit x86.) Maybe it needs more time to propagate to mirrors or something? It's not clear to me if download.opensuse.org redirects to mirrors transparently or if it is really a single host.
Comment 4 Dominique Leuenberger 2018-03-26 09:16:48 UTC
(In reply to Jean Delvare from comment #3)
> Still doesn't work for me (on 32-bit x86.) Maybe it needs more time to
> propagate to mirrors or something? It's not clear to me if
> download.opensuse.org redirects to mirrors transparently or if it is really
> a single host.

'it depends' :) - metadata is generally served from download.o.o directly, without mirror redirects. Larger data (which has version information in the file name) should be redirected to mirrors.

The file in comment #0 does not have the digest though which the reported claimed:

http://download.opensuse.org/tumbleweed/repo/oss/boot/i386/yast2-trans-en_US.rpm.mirrorlist

SHA-256 Hash: 70e0d01be3b8f13d2581c03c28a29d08e65aa21cf54b118fea5fa9a6c074924c
SHA-1 Hash: 026e94b4feb1c9444aca1c945eaaef30877e9190
MD5 Hash: 9ca4fada9877907ff3e7985546aad016

vs what command #0 said:
sha1   37d35af88cb0593905e6cfcc1761349b
sha256 7ea4a636ee4e7f3f0b4236f8a7944ac3

So at least in THIS Case, there must be a 'broken mirror' in the play.

/@Jean: for you it is still boot/i386/loader/initrd? Or did the error move?
Comment 5 Jean Delvare 2018-03-26 12:18:40 UTC
Today the error for me was on boot/i386/yast2-trans-en_US.rpm, same as the initial report.
Comment 6 Thomas Holleis 2018-03-26 21:01:23 UTC
The original reported error is still there.
Comment 7 Dominique Leuenberger 2018-03-27 11:46:21 UTC
Last night - the FTP tree was (finally) cleaned up of the legacy susetags metadata - which means at least now we have a 'clean' FTP Tree.

I did do a quick test with the 0324/i586 NET installer, and this seemed ok
Comment 8 Steffen Winterfeldt 2018-03-27 12:05:16 UTC
then let's close this bug
Comment 9 Thomas Holleis 2018-03-27 17:12:21 UTC
No, it does not work even with the new NET image from 03/24. Got the same error.
Comment 10 Jean Delvare 2018-03-30 11:07:37 UTC
Still doesn't work for me, tested today with 0326/i586 NET installed.
Comment 11 Jean Delvare 2018-04-03 06:34:10 UTC
As it still doesn't work for me even with the latest 0331/i586 NET installer, I investigated. It turns out that my download request is being redirected to:

http://mirrors.standaloneinstaller.com/opensuse-stable/tumbleweed/repo/oss/boot/i386/yast2-trans-en_US.rpm

This mirror has apparently not been updated in a long while:

Index of /opensuse-stable/tumbleweed/repo/oss/boot/i386

Name				Last modified		Size
----------------------------------------------------------------------
Parent Directory
cracklib-dict-full.rpm		2017-05-27 18:14 	3.1M
yast2-trans-de.rpm		2017-10-12 01:59 	643K
yast2-trans-en_US.rpm		2017-10-12 01:59 	95K

As a matter of fact, https://mirrors.opensuse.org/list/tumbleweed.html does NOT list this mirror as hosting Tumbleweed contents.

I have reported this problem as bug #1087824.
Comment 12 Jean Delvare 2018-04-03 06:43:20 UTC
Another related issue is that the installer continues even if the user selects "Back" after the digest verification failure. I have reported this as separate bug #1087829.
Comment 13 Thomas Holleis 2018-04-15 10:48:48 UTC
Steffen Winterfeldt, please can you reopen this bug, the problem is still there.
I did a test with the NET/i586 iso from 04/10.
Comment 14 Jean Delvare 2018-04-16 09:32:01 UTC
Thomas, please check to which mirror(s) you are being redirected. Maybe you use an outdated mirror, as happens to me, in which case your problem is bug #1087824.