Constantly getting "Digest verification failed for file ..." error

Hi guys,

I’m on tumbleweed and have been running into this “Digest verification failed for file …” error while updating the repos with zypper recently.

The error is something like this

Retrieving repository 'packman' metadata -------------------------------------------------------------------------------------------------------------------------------------------------/]

Warning: Digest verification failed for file 'primary.xml.gz'

  expected 3911ecd55b1d374295ab68728af006f0423573e8757ededcf55918a5a604b05e
  but got  2d80b34906cc2a5010592b89aae385e8198d90941e6948a3a83033fe01ab22ec

Accepting packages with wrong checksums can lead to a corrupted system and in extreme cases even to a system compromise.

However if you made certain that the file with checksum '2d80..' is secure, correct
and should be used within this operation, enter the first 4 characters of the checksum
to unblock using this file on your own risk. Empty input will discard the file.

**Unblock or discard? [2d80/...? shows all options] (discard): **

It usually happens with packman and repo-debug, I’ve tried clean zypper cache with “zypper clean” and force refresh with “zypper ref -f”, but no good. I tried remove the repo and re-add it using the official suggested repo urls, still no good.
My repo list below:

#  | Alias                               | Name             | Enabled | GPG Check | Refresh | URI                                                                           
 1 | MEGAsync                            | MEGAsync         | No      | ----      | ----    |                           
 2 | X11:Bumblebee                       | X11:Bumblebee    | Yes     | (r ) Yes  | Yes     |
 3 | | openSUSE:Factory | Yes     | (r ) Yes  | Yes     |                             
 4 | packman                             | packman          | Yes     | (r ) Yes  | Yes     |           
 5 | repo-debug                          | repo-debug       | Yes     | (r ) Yes  | Yes     |                            
 6 | repo-non-oss                        | repo-non-oss     | Yes     | (r ) Yes  | Yes     |                          
 7 | repo-oss                            | repo-oss         | Yes     | (r ) Yes  | Yes     |                              
 8 | repo-src-non-oss                    | repo-src-non-oss | Yes     | (r ) Yes  | Yes     |                      
 9 | repo-src-oss                        | repo-src-oss     | Yes     | (r ) Yes  | Yes     |                          
10 | repo-update                         | repo-update      | Yes     | (r ) Yes  | Yes     |  

Any ideas? thanks in advance.

How do you update? FYI On TW only ‘zypper dup’ is supported.

I use “zypper dup --no-allow-vendor-change”, and it has been working well for past. I doubt it’s the problem, since “zypper ref” gives the said verification error.

You could try explicitly specifying a mirror. I generally use either
for example.

Ran into this problem again, and finally found out that it’s something about accessing the repository. If I run the update behind a proxy (which guarantees successful access to the repo), the problem is gone. Weird enough though, even if I do not use the proxy, I can reach the repo in a browser without any problem. Also it’s a mystery why zypper notifies a warning about verification error instead of issues of accessing the repo.

Anyways, hope this helps somebody.

There are a number of mirrors for the repos. These are alternative sites that have a copy of the repo.

When you connect to a repo, your connection is redirected to the “nearest” mirror. The redirection depends on the IP address used and ip geolocation services.

When you use a proxy, the redirection depend on the proxy ip rather than your local ip. So you are probably being redirected to a different mirror when you use a proxy. It looks as if there may be problems with the mirror that you use when not using a proxy.

Was getting this problem with network installation of Tumbleweed, it errored out before the installer started - YAST translation package failed digest verification.
I had tried multiple times on several days, always the same result. As I was finishing this post, tried again - and it succeeded. Apparently either it got another mirror, or the affected mirror got fixed right then.

Having same problem with TW NET install, is it safe to ignore the message? E.g. can I do something about it after install?

Hi, welcome,

Please start a new thread, with messages from your system, this one f.e. is about the packman repo, which is not involved in the NET install.