Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 871838

Summary: yum updates on RHEL 5 clients fail, checksum issues
Product: Red Hat Satellite Reporter: Michael Hood <mihood>
Component: PackagingAssignee: Katello Bug Bin <katello-bugs>
Status: CLOSED NEXTRELEASE QA Contact: Katello QA List <katello-qa-list>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 6.0.0CC: bkearney, ehelms, jturner
Target Milestone: UnspecifiedKeywords: Triaged
Target Release: Unused   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-09-04 18:06:13 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
debug none

Description Michael Hood 2012-10-31 14:10:56 UTC
Description of problem:

yum updates on RHEL 5 clients fail, Checksum issues

yum is showing checksum
problems with all of them.


I see no log entries in the clients.
On the CFSE server there are error entries in the production.log; e.g.,
[ERROR: 2012-10-25 08:11:03 #4480] Task package_install (198) is in error 
state

pulp.log has more records, but other than "timeout detected" I don't see
anything that hints toward the root cause of the failure.

FWIW -- this beta is being run on a local network, CFSE and test virts
are all on the same VMWare host, none of the systems are running
iptables, only the CFSE host has SELinux enforcing (and ausearch isn't
reporting any denials).


Version-Release number of selected component (if applicable):


How reproducible:

I began working with three of them in a group per page 63 of the
Evaluation Guide to install an RPM. The package install failed for all
three of them -- Result: Request Timeout

In case it matters:
  - These three systems were subscribed using three
    different activation keys. They all have a common repo that contains 
the
    RPM I am attempting to install.
  - I put one of these systems in a group by itself, attempted the RPM
    install. It times out, all other failure items (below) are
    consistent with when I attempted the group with all three systems.



Steps to Reproduce:
1.
2.
3.
  
Actual results:

the sha256 checksums in the repos produced by CFSE.


Expected results: 

Clients should update fine, without checksum errors.


Additional info:

Customer resolved this issue by installing python-hashlib-20081119-7.el5.x86_64.rpm

Comment 2 James Laska 2012-10-31 18:46:47 UTC
I've been able to successfully register, subscribe, push and pull content to/from my RHEL5 instances.  To further isolate the problem, please ...

 1) attach the full 'yum' command entered, and the entire stdout/stderr of that command.  

 2) include the software versions tested.  The following command will provide the desired output: rpm -qa --qf " * %{sourcerpm}\n" "katello*" pulp candlepin

 3) run the /usr/share/katello/scripts/katello-debug script on your System Engine and attach the resulting tarball.

Comment 3 Michael Hood 2012-11-07 19:35:16 UTC
Created attachment 640308 [details]
debug

Comment 4 Michael Hood 2012-11-07 19:36:35 UTC
Here is the output from 

rpm -qa --qf " * %{sourcerpm}\n" "katello*" pulp candlepin

 # rpm -qa --qf " * %{sourcerpm}\n" "katello*" pulp candlepin
    * katello-configure-1.1.9-7.el6cf.src.rpm
    * katello-qpid-client-key-pair-1.0-1.src.rpm
    * pulp-1.1.13-1.el6cf.src.rpm
    * katello-1.1.12-16.el6cf.src.rpm
    * katello-selinux-1.1.1-1.el6cf.src.rpm
    * katello-cli-1.1.8-7.el6cf.src.rpm
    * katello-1.1.12-16.el6cf.src.rpm
    * katello-candlepin-cert-key-pair-1.0-1.src.rpm
    * candlepin-0.7.8.1-1.el6cf.src.rpm
    * katello-cli-1.1.8-7.el6cf.src.rpm
    * katello-1.1.12-16.el6cf.src.rpm
    * katello-qpid-broker-key-pair-1.0-1.src.rpm
    * katello-1.1.12-16.el6cf.src.rpm
    * katello-1.1.12-16.el6cf.src.rpm
    * katello-certs-tools-1.1.8-1.el6cf.src.rpm

Comment 5 James Laska 2012-11-13 14:40:37 UTC
(In reply to comment #2)
> I've been able to successfully register, subscribe, push and pull content
> to/from my RHEL5 instances.  To further isolate the problem, please ...
> 
>  1) attach the full 'yum' command entered, and the entire stdout/stderr of
> that command.  

Hey Michael, thanks for the katello-debug attachment and comment#4.  I haven't seen this problem when testing RHEL-5.7, 5.8 or 5.9 deployed applications.  Can you please still attach the full yum command and output that you see?

Typically, yum URL issues tend to be related to the key+cert used to access the repositories on the katello system.  I would suggest grabbing the key and cert included in your katello-generated system templates (you can also find the key+cert on registered clients in /etc/yum.repos.d/redhat.repo).  Confirm with the curl command that the provided key and cert are correct 

> curl -k --key katello.key --cert katello.cert https://<fqdn>/pulp/repos/path/to/some/repodata/repomd.xml

Looking in the attached production.log, I see some errors related to activities on the system.  Could these explain why access to the repositories is denied?

> [ERROR: 2012-10-24 15:47:26 #4519] HttpErrors::NotFound: Couldn't find activation key 'bk_inside_key'
> [ERROR: 2012-10-25 07:30:24 #4547] HttpErrors::NotFound: Couldn't find activation key 'dec_inside_key'
> [ERROR: 2012-10-25 15:57:36 #4547] *** ERROR: Package '0e333892-d03a-4297-be8b-08fbbfdb21a7' not found within the repository (404) ***

Asking around in case others have better suggestions/ideas

Comment 6 Michael Hood 2012-11-13 14:56:23 UTC
1) attach the full 'yum' command entered, and the entire stdout/stderr of
> that command.  

Well the yum update peice was resolved by installing python-hashlib.

Here is the customers response:

1) yum behaves as expected after I installed python-hashlib.
   python-hashlib *might* be in a standard RHEL 5 base install. My virt
   guests are based on our court system installations. Those began with
   a philosophy of not installing any software that is not needed.
   So the client might be a local issue.

I will request the yum peice anyways. 

Thanks
Mike

Comment 7 Michael Hood 2012-11-15 14:45:35 UTC
Topic: yum failing on RHEL 5 systems

The repo used for the install does not contain python-hashlib. So, as questioned yesterday, the package was never installed (versus installed with @Base and then removed).

Here is the list of python packages in that repo (dumped from lynx):
   [ ] python-2.4.3-46.el5.x86_64.rpm 18-Jan-2012 06:30 58K
   [ ] python-ctypes-1.0.2-3.el5.x86_64.rpm 15-Dec-2011 07:04 210K
   [ ] python-devel-2.4.3-46.el5.i386.rpm 18-Jan-2012 06:30 3.0M
   [ ] python-devel-2.4.3-46.el5.x86_64.rpm 18-Jan-2012 06:30 3.0M
   [ ] python-dmidecode-3.10.13-1.el5_5.1.x86_64.rpm 06-Sep-2010 07:29 89K
   [ ] python-docs-2.4.3-1.1.noarch.rpm 18-Jan-2007 13:04 2.5M
   [ ] python-elementtree-1.2.6-5.x86_64.rpm 18-Jan-2007 13:04 85K
   [ ] python-ethtool-0.6-5.el5.x86_64.rpm 21-Jun-2011 01:22 30K
   [ ] python-imaging-1.1.5-7.el5.x86_64.rpm 08-Feb-2011 10:19 406K
   [ ] python-imaging-devel-1.1.5-7.el5.i386.rpm 08-Feb-2011 10:19 160K
   [ ] python-imaging-devel-1.1.5-7.el5.x86_64.rpm 08-Feb-2011 10:19 160K
   [ ] python-iniparse-0.2.3-4.el5.noarch.rpm 04-Mar-2008 02:25 34K
   [ ] python-lcms-1.18-0.1.beta1.el5_3.2.x86_64.rpm 08-Mar-2009 05:22 609K
   [ ] python-ldap-2.2.0-2.1.x86_64.rpm 18-Jan-2007 13:04 123K
   [ ] python-libs-2.4.3-46.el5.x86_64.rpm 18-Jan-2012 06:30 5.9M
   [ ] python-numeric-23.7-2.2.2.el5_6.1.x86_64.rpm 10-May-2011 03:48 801K
   [ ] python-pyblock-0.26-4.el5.x86_64.rpm 01-Jul-2009 08:52 61K
   [ ] python-pycurl-7.15.5.1-8.el5.x86_64.rpm 07-Dec-2010 16:41 73K
   [ ] python-rhsm-0.98.9-1.el5.noarch.rpm 25-Jan-2012 02:26 66K
   [ ] python-setuptools-0.6c5-2.el5.noarch.rpm 04-Mar-2008 02:25 480K
   [ ] python-simplejson-2.0.9-8.el5.x86_64.rpm 25-May-2011 04:03 141K
   [ ] python-sqlite-1.1.7-1.2.1.x86_64.rpm 18-Jan-2007 13:04 39K
   [ ] python-suds-0.4.1-2.el5.noarch.rpm 30-May-2011 01:20 251K
   [ ] python-tools-2.4.3-46.el5.x86_64.rpm 18-Jan-2012 06:30 946K
   [ ] python-urlgrabber-3.1.0-6.el5.noarch.rpm 29-Nov-2010 02:44 132K

I can upload the entire package list in the repo if that would be useful. As is, I'm not sure there is a use for showing the python list.

Comment 8 James Laska 2012-11-15 15:16:22 UTC
You are correct, python-hashlib is not provided in the base RHEL repository.  Please ensure the customer is deploying applications and including the appropriate cf-tools repository.  The python-hashlib package is provided in the cf-tools repository.  I'm searching the docs to determine where/if we recommend including the companion cf-tools repository.

The reason I'm are not seeing this issue in our testing is because we include the 'katello-agent' package in the image template (and target_content.xml).

The katello-agent package has the following dependencies ...
 katello-agent -> gofer -> python-gofer -> python-hashlib

In addition, the system templates we use include the base RHEL repository *and* the cf-tools companion repository.  These two factors explain why our RHEL5 testing has not exposed this issue.  

I find it interesting that the yum command was failing without the python-hashlib package installed.  Perhaps another package is missing an explicit dependency on python-hashlib?  

From the yum failure, are you able to determine what code is attempting to use hashlib?  Perhaps that might help identify a package that needs an explicit dependency on python-hashlib.

Comment 9 Bryan Kearney 2014-09-04 18:06:13 UTC
This was an issue with a 2.0.X version of pulp. The 2.4 version in Satellite 6 fixes the issue. I am marking this as closed/nextrelease. If you still see this with Satellite 6, please feel free to re-open.