The Main repository for Tumbleweed is displaying a signature verification failed error for the repomd.xml file, at this time. E-mail has been sent to admin@o.o.
status.opensuse.org shows a partial outage for three services, but none of them appear to involve the repositories.
Terminal output of sudo zypper dup? Repolist via zypper lr -d?
@epp Likely hit a mirror that is syncing, new snapshot just released… wait an hour or so and try again…
@epp also I wouldn’t raise a Progress Ticket until you get further confirmation as it’s just creating extra work for folks…
@malcolmlewis I thought it was best to report it, not knowing how serious it might be.
@hui
Output:
:~> sudo zypper dup
Signature verification failed for file 'repomd.xml' from repository 'Main Repository (OSS)'.
Note: Signing data enables the recipient to verify that no modifications occurred after the data
were signed. Accepting data with no, wrong or unknown signature can lead to a corrupted system
and in extreme cases even to a system compromise.
Note: File 'repomd.xml' is the repositories master index file. It ensures the integrity of the
whole repo.
Warning: This file was modified after it has been signed. This may have been a malicious change,
so it might not be trustworthy anymore! You should not continue unless you know it's safe.
Note: This might be a transient issue if the server is in the midst of receiving new data. The
data file and its signature are two files which must fit together. In case the request hit the
server in the midst of updating them, the signature verification might fail. After a few
minutes, when the server has updated its data, it should work again.
Signature verification failed for file 'repomd.xml' from repository 'Main Repository (OSS)'. Continue? [yes/no] (no): no
Retrieving repository 'Main Repository (OSS)' metadata .....................................................[error]
Repository 'Main Repository (OSS)' is invalid.
[download.opensuse.org-oss|http://cdn.opensuse.org/tumbleweed/repo/oss/] Failed to retrieve new repository metadata.
History:
- Signature verification failed for repomd.xml
Please check if the URIs defined for this repository are pointing to a valid repository.
Warning: Skipping repository 'Main Repository (OSS)' because of the above error.
Some of the repositories have not been refreshed because of an error.
dist-upgrade: Due to the treatment of orphaned packages dist-upgrade depends on a proper
repository setup more than any other command. It must not continue if enabled repositories fail
to refresh. This may severely damage the system. If a failing repository is actually not needed,
it must be disabled. See 'man zypper' for more information about this command.
The message already contains the explanation (as also pointed out by Malcolm).
I just tried zypper again and am getting the same error, but this time, from the NON-OSS repository. Will check it again later.
@epp and just to clarify, the mirrors your hitting are not controlled by openSUSE Infrastructure, if having issues then the normal course of action would be to contact the mirror admin.
Then if you don’t get a response, then raise a progress ticket to say it’s not working and should be removed from the openSUSE mirror list.
I believe this is the second repository-related error I reported, with the first one possibly different than this. At least, the errors are temporary and I felt by reporting them, at least on the Forums, we get an idea of whether it’s temporary or something more major.
I subsequently booted into my Slowroll installation, which uses download.o.o, that had no issues updating.
Ran zypper dup just now, no errors.
@epp and I rejected the two (every email you send creates a new one) Progress Tickets created…
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.