Leap 16.0 ISO verification issue (404 / expired signature)

English Install/Boot/Login
1

A couple of days ago, I tried installing openSUSE Leap 16.0 from:

However, I could not (and still can’t) find the checksum and signature files from that download page (still leads to 404 page). I later found what I think is the current Leap 16.0 ISO directory here:

https://download.opensuse.org/distribution/leap/16.0/offline/

I downloaded the ISO, the .sha512 file, and the .sha512.asc signature file from there. The verification itself succeeded, but GPG warned that the signing key or signature is expired.

Where can I get the latest checksum and signature files?

2

The downloadpage still points to the old sha256 checksums. But the project switched to sha512. There is an ongoing ticket.

https://progress.opensuse.org/issues/201924

1 Like
3

Well, bigger problem is the iso itself. It never passes the integrity check and will tell you that the media is corrupted.
I double checked with diff the created USB from the iso file and the mounted iso itself and they are always exactly the same whether it’s “burned” with dd or impression, it’s always perfectly fine - with three file exceptions and these are:

  1. install/CHECKSUMS.asc
  2. install/repodata/repomd.xml.asc
  3. install/repodata/repomd.xml.key

So the media check informs user that no checksum files are found and thus the media is corrupted.

Funny, since the only files corrupted are the ones responsible for the check…

4 
curl -L --fail --remote-name-all --progress-bar \
https://download.opensuse.org/distribution/leap/16.0/offline/Leap-16.0-online-installer-x86_64-Build178.27.install.iso{,.sha512}
################################################################################################################################################################## 100.0%
################################################################################################################################################################## 100.0%

sha512sum --check --quiet Leap-16.0-online-installer-x86_64-Build178.27.install.iso.sha512 2> >(if grep .; then echo FAILED; else echo PASSED; fi)
PASSED
5

Sure, that’s not a problem, the accompanied sha512 checksum is fine. I was talking about the installer’s media check option.
As I said, the transferred image is fine with both, dd and impression, just the three mentioned files are different and installer’s media check fails.

My main machine has TW, I was only trying the Leap installer on another machine.

6

@inf78 Is this the respin of Leap, or the old version? If it’s the respin, then a bug report would be needed…

7

No, it’s the “Leap-16.0-offline-installer-x86_64-Build178.27.install.iso”, sha512 matches, no problem.

I did some testing and it’s super weird. The mentioned three files are always different after transfer (dd or impression) and media check option of Leap’s installer will mark the media as corrupted. That’s on real hardware. But in VBox, the same media with apparently different three files WILL pass the check just fine. I am at a loss here…

8

You are perhaps using a USB for installing. In my experience, the media-check always fails on a USB installer, but works on an actual DVD. For VBOX, you are possibly using the iso file directly as a virtual DVD, so the check is working for that.

I’m just guessing.

I use the checksum to verify the downloaded iso. I don’t try the installer media check.

9

I’m the same as @nrickert, plus I tag the media with an installer password, so it’s all moot.

10

That’s the problem - I am not. I used intentionally the same “corrupted” USB stick for that purpose. And it works in VBox as expected. Frankly, it doesn’t make any sense to me whatsoever. I will try the same stick on the secondary machine in VBox there as well, I am curious…

11

The other machine doesn’t allow me to select the USB contents, so I put it back in the main TW machine and no, I can’t see it either. So in the end, I was probably really testing the iso directly…
Sorry people, disregard the VBox stuff, I need to sleep. 2.5 hours today wasn’t much…

But if anyone can test USB installer’s media check, that would be great. :wink:

12

What did use top copy yo the USB

13

As I wrote - dd and impression, with same results.