repodata for 12.2 and 12.3 Updates contain both sha1 and sha256 checksums

English Install/Boot/Login
1

When 12.1 had problems with different versions of RPM’s in the mirror system I created a script to verify my local copy of the openSUSE repos. See the following:

http://forums.opensuse.org/english/get-technical-help-here/applications/471435-12-1-repo-data-incorrect.html

https://bugzilla.novell.com/show_bug.cgi?id=742772

After I saw a large number of files download last week I ran my script and it reported a large number of files with bad checksums (4.8K in 12.2 OSS Updates, and 6.9K in 12.3 OSS Updtaes). NonOSS had around six in both 12.2 and 12.3, all flash. My script then uses aria 2c to download the correct version in the mirror system using the meta4 files. Arira2c was showing bad checksums and would take multiple downloads before it got the file which match the checksum in the meta4 file.

My script was showing that the checksums still did not match repodata. My first thought was that the 12.1 problem had returned, so I submitted a bug to openSUSE.

https://bugzilla.novell.com/show_bug.cgi?id=843679

After doing a lot of trouble shooting I found that the checksums in repodata for these files were a sha1 checksum and not a sha256.

It appears that the updates I have pending are all sha256 checksums, so I am not able to say if zypper is able to use both sha1 and sha256 checksums from repodata.


zcat repodata/e6e5447767638a711205003715bc4fa05c39b0489cfcfbbd0b8a37a47bfbfe06-filelists.xml.gz >>tmpFileList

for i in boost-license1_49_0 gpg2 icedtea-web libboost_program_options1_49_0 libboost_regex1_49_0 libboost_signals1_49_0 libboost_system1_49_0 libboost_thread1_49_0 libmysqlclient18 libmysqld18 libsnmp30 libtiff5 libtiff5-32bit libtiff-devel MozillaFirefox MozillaThunderbird mysql-community-server-client mysql-community-server-errormessages snmp-mibs timezone timezone-java vino; do echo -e "$i";grep $i tmpFileList|grep pkgid|grep -v src;done

I have not had an answer back from my bug report. I tried to send a email to mirror@opensuse.org list, but was denied. I sent and email to admin@opensuse.org asking why my email to mirror was denied when I used to be subscribed to the list, and I do not remember unsubscribing. I have not heard back from admin@opensuse.org.

From wiki for sha 1
SHA-1 - Wikipedia, the free encyclopedia
In 2005, cryptanalysts found attacks on SHA-1 suggesting that the algorithm might not be secure enough for ongoing use.[3] NIST required many applications in federal agencies to move to SHA-2 after 2010 because of the weakness.

Are the checksums supposed to be sha256?
Does zypper check other checksums if sha256 does not match repodata? If so, what other checksums will zypper and repodata use?

Thanks

Dave W

2

On 2013-10-07 16:36, dwestf wrote:

>
> I have not had an answer back from my bug report. I tried to send a
> email to mirror@opensuse.org list, but was denied.

Reason? You get a denial email with a reason. What was the given reason?

> I sent and email to
> admin@opensuse.org asking why my email to mirror was denied when I used
> to be subscribed to the list, and I do not remember unsubscribing. I
> have not heard back from admin@opensuse.org.

Email instead opensuse at opensuse.org mail list directly, and ask about
the bug, as you did here.

–
Cheers / Saludos,

Carlos E. R.
(from 11.4, with Evergreen, x86_64 “Celadon” (Minas Tirith))

3

Thanks Carlos,

It must have been HTML, I don’t know what client I used the last time I sent an email to the list.

  • Attachments
  • Mails from other lists
  • HTML mails (also multipart text/html!)

Dave

4

Carlos,

Email to opensuse@opensuse.org did not work. It is another mailing list that I am not subscribed to.

Dave

5

On 2013-10-08 12:36, dwestf wrote:>
> Thanks Carlos,
>
> It must have been HTML, I don’t know what client I used the last time I
> sent an email to the list.

Certainly using html causes email to be rejected. How to do without
depends on the client you use.

On 2013-10-08 12:56, dwestf wrote:
>
> Carlos,
>
> Email to opensuse@opensuse.org did not work. It is another mailing list
> that I am not subscribed to.

Then subscribe :slight_smile:

It is probably the best place to ask that question of yours. The proper
place would probably be the security mail list, but it has so low
traffic that often questions go unanswered.

Alternative to subscription, you can use gmane.

Gmane

«Gmane (pronounced “mane”) is an e-mail to news gateway. It allows users
to access electronic mailing lists as if they were Usenet newsgroups,
and also through a variety of web interfaces. Gmane is an archive; it
never expires messages (unless explicitly requested by users). Gmane
also supports importing list postings made prior to a list’s inclusion
on the service.»

That way, the list email does not go to your box; instead, you connect
with an NNTP reader (thunderbird, for instance, has one). No danger of
filling your account with email.

With the added advantage that you can read many previous posts to your
leisure :slight_smile:

–
Cheers / Saludos,

Carlos E. R.
(from 11.4, with Evergreen, x86_64 “Celadon” (Minas Tirith))