`zypper dup` error never seen before: `Warning: File 'repomd.xml' from repository 'Main Repository (NON-OSS)' is unsigned.` (EDIT: error stopped happening. So I guess just curious now: what caused it?)

I got this weird error I’d never seen before,
and started writing this post to ask about it,
but by the time I went to post this and ran zypper dup again to double-check,
the error had stopped happening,
and everything appears to be back to normal now.

So I guess I’m just curious now: what caused it?

Did I just coincidentally catch it in a super rare inconsistent state while it was being updated or something?

$ sudo zypper dup
Warning: File 'repomd.xml' from repository 'Main Repository (NON-OSS)' is unsigned.

    Note: Signing data enables the recipient to verify that no modifications occurred after the data
    were signed. Accepting data with no, wrong or unknown signature can lead to a corrupted system
    and in extreme cases even to a system compromise.

    Note: File 'repomd.xml' is the repositories master index file. It ensures the integrity of the
    whole repo.

    Warning: We can't verify that no one meddled with this file, so it might not be trustworthy
    anymore! You should not continue unless you know it's safe.

File 'repomd.xml' from repository 'Main Repository (NON-OSS)' is unsigned, continue? [yes/no] (no): no
Retrieving repository 'Main Repository (NON-OSS)' metadata ............................................................................................................................[error]
Repository 'Main Repository (NON-OSS)' is invalid.
[download.opensuse.org-non-oss|http://download.opensuse.org/tumbleweed/repo/non-oss/] Valid metadata not found at specified URL
History:
 - Signature verification failed for repomd.xml
 - Can't provide /repodata/repomd.xml

Please check if the URIs defined for this repository are pointing to a valid repository.
Warning: Skipping repository 'Main Repository (NON-OSS)' because of the above error.
Retrieving repository 'Main Repository (OSS)' metadata .................................................................................................................................[done]
Building repository 'Main Repository (OSS)' cache ......................................................................................................................................[done]
Retrieving repository 'Packman' metadata ...............................................................................................................................................[done]
Building repository 'Packman' cache ....................................................................................................................................................[done]
Retrieving repository 'vivaldi' metadata ...............................................................................................................................................[done]
Building repository 'vivaldi' cache ....................................................................................................................................................[done]
Some of the repositories have not been refreshed because of an error.
Loading repository data...
Reading installed packages...
Warning: You are about to do a distribution upgrade with all enabled repositories. Make sure these repositories are compatible before you continue. See 'man zypper' for more information about this command.
Computing distribution upgrade...

The following 5 items are locked and will not be changed by any action:
 Installed:
  Mesa Mesa-dri Mesa-gallium Mesa-libEGL1 Mesa-libGL1

The following 18 packages are going to be upgraded:
  alacritty alacritty-bash-completion alacritty-fish-completion alacritty-zsh-completion firewalld firewalld-bash-completion firewalld-lang firewalld-zsh-completion gmenudbusmenuproxy
  openSUSE-release openSUSE-release-appliance-custom plasma5-session plasma5-session-wayland plasma5-workspace plasma5-workspace-libs python3-firewall xdg-desktop-portal xembedsniproxy

The following product is going to be upgraded:
  openSUSE Tumbleweed  20230624-0 -> 20230625-0

The following 3 packages are going to be REMOVED:
  steam steam-devices wine-mono

18 packages to upgrade, 3 to remove.
Overall download size: 21.0 MiB. Already cached: 0 B. After the operation, 229.1 MiB will be freed.
Continue? [y/n/v/...? shows all options] (y): ^C⏎                                                                                                                                             

#105


I’m not sure “Install/Boot/Login” is the right category for this question,
but I didn’t see any category that seemed more obviously fitting for “updating/repositories” or whatever,
and I did just do a reinstall, so maybe it’s related? (Very much doubt it.)

… Actually, I just noticed when I get my my repos list with zypper repos --uri
it still has “openSUSE-20230622-0” with the URI to the USB flash thumbdrive I had the install ISO on:

#  | Alias                            | Name              | Enabled | GPG Check | Refresh | URI
---+----------------------------------+-------------------+---------+-----------+---------+---------------------------------------------------------------------------------------------------
 9 | openSUSE-20230622-0              | openSUSE-202306-> | No      | ----      | ----    | hd:/?device=/dev/disk/by-id/usb-Lexar_USB_Flash_Drive_AAPFE4BIMV0XVF4M-0:0-part2

But like, I never plugged that thumbdrive in to the computer after the install was done,
and obviously I’m never gonna use it again with this install,
and I must’ve done a successful upgrade between then and now anyway,
because my current tumbleweed is 20230624-0
|
But maybe that’s normal/intended for the flash drive you installed from to stay in your repos?
(Maybe for users who don’t have internet afterwards, but go like “oops, I forgot to install libreoffice” or something after the install?)

So I’d guess that thumbdrive repo thing is something that’s always been like that and I’ve just never noted it before,
and it’s completely unrelated to the weird new transient “unsigned file” error, right?

(Sorry if my questions here are kinda dumb and pointless, but I was just curious to understand the system I’m using a little better…)

@dwawlyn Hi, likely the mirror your being directed too… Are you using mirror cache https://en.opensuse.org/MirrorCache?

Try forcing a refresh and add some verbosity…

zypper -vvv ref -f

(-vvv ha! Thanks, I didn’t know about that flag. It’s somehow both silly/cute, and completely sensible.)

I got this:

Forcing raw metadata refresh
Retrieving: http://mirrorcache-us.opensuse.org/tumbleweed/repo/non-oss/media.1/media .........................................................................................[done (109 B/s)]
Retrieving: http://download.opensuse.org/tumbleweed/repo/non-oss/repodata/repomd.xml.asc .....................................................................................[done (827 B/s)]
Retrieving: http://download.opensuse.org/tumbleweed/repo/non-oss/repodata/repomd.xml.key ...................................................................................[done (1.6 KiB/s)]
Retrieving: http://download.opensuse.org/tumbleweed/repo/non-oss/repodata/repomd.xml .........................................................................................[done (899 B/s)]
  Repository:       Main Repository (NON-OSS)
  Key Fingerprint:  AD48 5664 E901 B867 051A B15F 35A2 F86E 29B7 00A4
  Key Name:         openSUSE Project Signing Key <opensuse@opensuse.org>
  Key Algorithm:    RSA 4096
  Key Created:      Mon 20 Jun 2022 07:03:14 AM PDT
  Key Expires:      Fri 19 Jun 2026 07:03:14 AM PDT
  Rpm Name:         gpg-pubkey-29b700a4-62b07e22
Retrieving repository 'Main Repository (NON-OSS)' metadata .............................................................................................................................[done]
Forcing building of repository cache
Building repository 'Main Repository (NON-OSS)' cache ..................................................................................................................................[done]

But yeah, I guess whatever the problem was, it just mysteriously vanished and probably won’t come back, eh…