Red Hat Bugzilla – Bug 1139896
synced RPMs do not have their checksums verified
Last modified: 2017-02-23 15:58:39 EST
During testing we ran into a situation where RPMs had been synchronized from the CDN, copied to disk and then published in a Content View with an RPM that was truncated and not fully complete. Extraction of the RPM shows an incomplete file: # rpm2cpio selinux-policy-targeted-3.7.19-231.el6.noarch.rpm | cpio -idmv .... ./usr/share/selinux/targeted/piranha.pp.bz2 cpio: ./usr/share/selinux/targeted/pkcsslotd.pp.bz2 not created: newer or same age version exists ./usr/share/selinux/targeted/pkcsslotd.pp.bz2 cpio: ./usr/share/selinux/targeted/plymouthd.pp.bz2 not created: newer or same age version exists cpio: premature end of file The metadata containing filesizes and checksums for obvious reasons, does not match the above file since it is corrupt for whatever reason.
Hit submit too soon, meant to say: We need to investigate turning on checksum validation during download which has incorrect documentation as stated here: https://bugzilla.redhat.com/show_bug.cgi?id=1139888 we also need to determine and document a method for resolving this for customers who experience this issue.
I wonder, if this is similar to what was reported here https://www.redhat.com/archives/pulp-list/2013-December/msg00059.html The issue I've seen is having a package synchronized and then re-signed upstream, the subsequential sync of the repository seemed to have this issue.
Without validation, it took 1 hr 12 min. With validation 1 hr 40 min.
Created redmine issue http://projects.theforeman.org/issues/7947 from this bug
Need to add documentation on how to enable checksum validation.
*** Bug 1153649 has been marked as a duplicate of this bug. ***
Moving to POST since upstream bug http://projects.theforeman.org/issues/7947 has been closed ------------- David Davis Applied in changeset commit:katello|cdb1f1e7b726ed1023dc34fa9c73627703277015.
please provide verification steps thanks
Mike can you provide verification steps?
TESTPLAN: sync a repository you know has broken packages (size does not match the metadata). I created a repo like this to assist with verification: https://mmccune.fedorapeople.org/repos/broken-checksum/ Steps: 1) Create a custom repository with the URL https://mmccune.fedorapeople.org/repos/broken-checksum/ 2) sync the repository 3) ensure that the task states that 1 package failed to download, see attached screenshot. Even thou the task is still 'Success' this bug is just about ensuring that it notices the corrupted package which we did *not* notice in 6.0. For the future bug about properly recording errors as a Warning see: https://bugzilla.redhat.com/show_bug.cgi?id=1215838
Created attachment 1019462 [details] TESTPLAN Screenshot - verify you see this in 6.1
VERIFIED: # rpm -qa | grep foreman puppet-foreman_scap_client-0.3.3-8.el7sat.noarch ruby193-rubygem-foreman_docker-1.2.0.10-1.el7sat.noarch ruby193-rubygem-foreman-tasks-0.6.12.4-1.el7sat.noarch rubygem-hammer_cli_foreman_discovery-0.0.1.8-1.el7sat.noarch foreman-libvirt-1.7.2.18-1.el7sat.noarch ruby193-rubygem-foreman_bootdisk-4.0.2.12-1.el7sat.noarch foreman-compute-1.7.2.18-1.el7sat.noarch foreman-ovirt-1.7.2.18-1.el7sat.noarch ruby193-rubygem-foreman_discovery-2.0.0.12-1.el7sat.noarch rubygem-hammer_cli_foreman_tasks-0.0.3.4-1.el7sat.noarch foreman-debug-1.7.2.18-1.el7sat.noarch foreman-postgresql-1.7.2.18-1.el7sat.noarch qe-sat6-rhel71.usersys.redhat.com-foreman-client-1.0-1.noarch qe-sat6-rhel71.usersys.redhat.com-foreman-proxy-1.0-1.noarch ruby193-rubygem-foreman_gutterball-0.0.1.9-1.el7sat.noarch foreman-1.7.2.18-1.el7sat.noarch foreman-gce-1.7.2.18-1.el7sat.noarch ruby193-rubygem-foreman_hooks-0.3.7-2.el7sat.noarch rubygem-hammer_cli_foreman-0.1.4.10-1.el7sat.noarch foreman-selinux-1.7.2.13-1.el7sat.noarch foreman-vmware-1.7.2.18-1.el7sat.noarch rubygem-hammer_cli_foreman_bootdisk-0.1.2.6-1.el7sat.noarch foreman-proxy-1.7.2.4-1.el7sat.noarch qe-sat6-rhel71.usersys.redhat.com-foreman-proxy-client-1.0-1.noarch ruby193-rubygem-foreman-redhat_access-0.1.0-1.el7sat.noarch 1) Create a custom repository with the URL https://mmccune.fedorapeople.org/repos/broken-checksum/ 2) sync the repository 3) ensure that the task states that 1 package failed to download, screenshot attached
Created attachment 1020555 [details] broken package
This bug is slated to be released with Satellite 6.1.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2015:1592