Bug 899510

Summary: Fix support using multiple base URLs for a repo
Product: [openSUSE] openSUSE Tumbleweed Reporter: Michael Andres <ma>
Component: libzyppAssignee: E-mail List <zypp-maintainers>
Status: RESOLVED FIXED QA Contact: E-mail List <qa-bugs>
Severity: Normal    
Priority: P5 - None CC: forgotten_dBpEIsMMD7
Version: 201409*   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard: .
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Michael Andres 2014-10-02 12:26:27 UTC
[http://lists.opensuse.org/zypp-devel/2014-10/msg00000.html]

- Support defining multiple base URLs directly within a .reop file.

- This is currently possible by using a 'mirrorlist=' instead of 'baseurl', but unfortunately using a local file as mirrorlist is broken (code strips 'path' component from URL which is illegal for 'file:' schema)

- Fix zypper to non-interactively switch baseurls upon error.
Comment 1 Forgotten User dBpEIsMMD7 2014-10-02 19:09:25 UTC
current source, for ref

http://doc.opensuse.org/projects/libzypp/13.1/RepoMirrorList_8cc_source.html
Comment 2 Michael Andres 2014-10-20 08:49:18 UTC
libzypp-14.30.0 allows to define multiple base URLs directly within a .reop file. Preferred syntax is:

> baseurl=http://software.opensuse.org/download/ruby/openSUSE_10.2/
>         http://some.opensuse.mirror/ruby/openSUSE_10.2/
>         ...

Using a local file as 'mirrorlist=' is also possible.


Next will be to detect and fix issues when actually using this feature.
Comment 3 Swamp Workflow Management 2015-01-19 17:05:26 UTC
openSUSE-RU-2015:0085-1: An update that has 12 recommended fixes can now be installed.

Category: recommended (moderate)
Bug References: 848054,892431,899510,899781,901590,901691,903675,904737,906549,908135,908345,908976
CVE References: 
Sources used:
openSUSE 13.2 (src):    PackageKit-1.0.3-7.1, PackageKit-branding-openSUSE-13.2-2.4.1, libyui-gtk-pkg-2.43.2-2.3.2, libyui-gtk-pkg-doc-2.43.2-2.3.2, libyui-ncurses-pkg-2.46.1-2.3.2, libyui-ncurses-pkg-doc-2.46.1-2.3.2, libyui-qt-pkg-2.44.7-3.2, libyui-qt-pkg-doc-2.44.7-3.2, libzypp-14.32.0-5.3, libzypp-bindings-0.6.4-6.1, yast2-pkg-bindings-3.1.20-3.2, yast2-pkg-bindings-devel-doc-3.1.20-3.2, zypper-1.11.17-5.1
Comment 4 Forgotten User dBpEIsMMD7 2015-01-19 21:18:17 UTC
> Next will be to detect and fix issues when actually using this feature.

fyi

Upgraded to

	rpm -qa | egrep -i "libzypp|zypper"
		zypper-1.11.17-5.1.x86_64
		zypper-log-1.11.17-5.1.noarch
		libzypp-14.32.0-5.3.x86_64
		libzypp-devel-14.32.0-5.3.x86_64

Adding 2 URLs to a test repo

	cat /etc/zypp/repos.d/LibreOffice.repo 
		[LibreOffice]
		name=LibreOffice
		enabled=1
		baseurl=http://anorien.csc.warwick.ac.uk/mirrors/download.opensuse.org/repositories/LibreOffice:/Factory/openSUSE_13.2/
		        http://download.opensuse.org/repositories/LibreOffice:/Factory/openSUSE_13.2/
		type=rpm-md
		autorefresh=1
		keeppackages=0
		gpgcheck=1

now is accepted & refreshes correctly, using the 1st URL in the list

	zypper -vvv ref LibreOffice
		Verbosity: 3
		Non-option program arguments: 'LibreOffice' 
		Initializing Target
		Specified repositories: LibreOffice 
		Checking whether to refresh metadata for LibreOffice
		Retrieving: http://anorien.csc.warwick.ac.uk/mirrors/download.opensuse.org/repositories/LibreOffice:/Factory/openSUSE_13.2/repodata/repomd.xml ........................................................................................[done]
		Repository 'LibreOffice' is up to date.
		Specified repositories have been refreshed.

manually failing the 1st repo to check fallback

	-	baseurl=http://anorien.csc.warwick.ac.uk/mirrors/download.opensuse.org/repositories/LibreOffice:/Factory/openSUSE_13.2/
	+	baseurl=http://anorien.csc.warwick.ac.uk/mirrors/download.opensuse.org/repositories/XXLibreOffice:/Factory/openSUSE_13.2/
		        http://download.opensuse.org/repositories/LibreOffice:/Factory/openSUSE_13.2/

attempt at refresh FAILs to fallback to the 2nd URL

	zypper -vvv ref LibreOffice
		Verbosity: 3
		Non-option program arguments: 'LibreOffice' 
		Initializing Target
		Specified repositories: LibreOffice 
		Checking whether to refresh metadata for LibreOffice
		Retrieving: http://anorien.csc.warwick.ac.uk/mirrors/download.opensuse.org/repositories/XXLibreOffice:/Factory/openSUSE_13.2/repodata/repomd.xml ......................................................................................[error]
		File '/repodata/repomd.xml' not found on medium 'http://anorien.csc.warwick.ac.uk/mirrors/download.opensuse.org/repositories/XXLibreOffice:/Factory/openSUSE_13.2/'

		Abort, retry, ignore? [a/r/i/? shows all options] (a):
Comment 5 Michael Andres 2015-01-20 11:01:50 UTC
Yes, zypper should silently fallback... I'll have a look.
Comment 6 Forgotten User dBpEIsMMD7 2015-01-20 14:28:36 UTC
also, fyi

With

	cat /etc/zypp/repos.d/KernelStable.repo 
		[KernelStable]
		enabled=1
		name=KernelStable
		baseurl=http://anorien.csc.warwick.ac.uk/mirrors/download.opensuse.org/repositories/Kernel:/stable/standard
		        http://download.opensuse.org/repositories/Kernel:/stable/standard
		autorefresh=1
		gpgcheck=1
		keeppackages=0
		type=rpm-md

zypper dup
	...
	Retrieving package kernel-devel-3.18.2-2.1.g88366a3.noarch                     (3/60),  10.1 MiB ( 49.1 MiB unpacked)
	Retrieving: kernel-devel-3.18.2-2.1.g88366a3.noarch.rpm .........................................[done (573.5 KiB/s)]

	Warning: Digest verification failed for file 'kernel-devel-3.18.2-2.1.g88366a3.noarch.rpm'
	[/var/cache/zypp/packages/KernelStable/noarch/kernel-devel-3.18.2-2.1.g88366a3.noarch.rpm]

	  expected 1e6a1d32c55d0cc47aaf8a71f5ecb7fd177bfee4ec2b148534e1d46da02bbdf5
	  but got  ae10130716e6e0ec3ab833aa854308cf73b37abc608868339bd3858069e17a9a

	However if you made certain that the file with checksum 'ae10..' is secure, correct
	and should be used within this operation, enter the first 4 characters of the checksum
	to unblock using this file on your own risk. Empty input will discard the file.

	Unblock or discard? [ae10/? shows all options] (discard): 

But changing

Changing

	-	baseurl=http://anorien.csc.warwick.ac.uk/mirrors/download.opensuse.org/repositories/Kernel:/stable/standard
	-	        http://download.opensuse.org/repositories/Kernel:/stable/standard
	+	baseurl=http://download.opensuse.org/repositories/Kernel:/stable/standard

Now

zypper dup

	...
	Retrieving: kernel-devel-3.18.2-2.1.g88366a3.noarch.rpm .........................................[done (397.0 KiB/s)]
	( 1/58) Installing: kernel-devel-3.18.2-2.1.g88366a3 ..........................................................[done]
	Retrieving package kernel-source-3.18.3-1.1.gc3e148f.noarch                    (2/58),  76.9 MiB (471.5 MiB unpacked)
	...

Should fallback on digest failure be enabled? Not convinced myself ...
Comment 7 Michael Andres 2015-03-19 15:50:45 UTC
zypper-1.11.24 will not prompt for action, while there are more baseurls to try to download from.

However if a download succeeded, the package is expected to be 'correct'; i.e. to pass the digest check.
Comment 8 Swamp Workflow Management 2015-06-26 13:05:53 UTC
openSUSE-RU-2015:1151-1: An update that has 16 recommended fixes can now be installed.

Category: recommended (low)
Bug References: 725867,820693,832519,897301,899510,903405,923800,925678,925696,929483,929528,929593,929990,931601,932393,933277
CVE References: 
Sources used:
openSUSE 13.2 (src):    PackageKit-1.0.3-13.1, libsolv-0.6.11-13.1, libyui-gtk-pkg-2.43.2-2.8.1, libyui-gtk-pkg-doc-2.43.2-2.8.1, libyui-ncurses-pkg-2.46.1-2.8.1, libyui-ncurses-pkg-doc-2.46.1-2.8.1, libyui-qt-pkg-2.44.7-8.1, libyui-qt-pkg-doc-2.44.7-8.1, libzypp-14.39.0-25.1, libzypp-bindings-0.6.4-14.1, yast2-pkg-bindings-3.1.20-8.1, yast2-pkg-bindings-devel-doc-3.1.20-8.1, zypper-1.11.32-22.1
Comment 9 Swamp Workflow Management 2015-07-02 16:07:24 UTC
SUSE-RU-2015:1175-1: An update that solves one vulnerability and has 45 fixes is now available.

Category: recommended (moderate)
Bug References: 725867,820693,828631,832519,848054,892431,893294,896224,897301,899510,899603,899781,899907,901590,901691,903405,903675,904737,906549,908135,908345,908976,909143,909244,909772,911335,911658,914258,914284,915461,915928,916254,919709,921332,922352,923800,925678,925696,927319,929483,929528,929593,929990,931601,932393,933277
CVE References: CVE-2014-3566
Sources used:
SUSE Linux Enterprise Workstation Extension 12 (src):    PackageKit-0.8.16-11.15
SUSE Linux Enterprise Software Development Kit 12 (src):    PackageKit-0.8.16-11.15, libsolv-0.6.11-8.1, libyui-ncurses-pkg-2.46.1-3.4, libyui-qt-pkg-2.44.7-3.2, libzypp-14.39.0-10.1, libzypp-bindings-0.6.4-5.3
SUSE Linux Enterprise Server 12 (src):    PackageKit-0.8.16-11.15, gnome-packagekit-3.10.1-8.13, libsolv-0.6.11-8.1, libyui-ncurses-pkg-2.46.1-3.4, libyui-qt-pkg-2.44.7-3.2, libzypp-14.39.0-10.1, libzypp-bindings-0.6.4-5.3, yast2-pkg-bindings-3.1.20-3.3, zypper-1.11.32-8.1
SUSE Linux Enterprise Desktop 12 (src):    PackageKit-0.8.16-11.15, gnome-packagekit-3.10.1-8.13, libsolv-0.6.11-8.1, libyui-ncurses-pkg-2.46.1-3.4, libyui-qt-pkg-2.44.7-3.2, libzypp-14.39.0-10.1, libzypp-bindings-0.6.4-5.3, yast2-pkg-bindings-3.1.20-3.3, zypper-1.11.32-8.1
Comment 10 Michael Andres 2016-09-22 15:15:57 UTC
I think we can close it.
Comment 11 Swamp Workflow Management 2017-01-02 17:08:28 UTC
SUSE-RU-2017:0010-1: An update that has four recommended fixes can now be installed.

Category: recommended (low)
Bug References: 1010096,899510,945169,964932
CVE References: 
Sources used:
SUSE OpenStack Cloud 5 (src):    libzypp-9.40.2-14.7, zypper-1.6.334-26.3
SUSE Manager Proxy 2.1 (src):    libzypp-9.40.2-14.7, zypper-1.6.334-26.3
SUSE Manager 2.1 (src):    libzypp-9.40.2-14.7, zypper-1.6.334-26.3
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    libzypp-9.40.2-14.7
SUSE Linux Enterprise Server 11-SP4 (src):    libzypp-9.40.2-14.7, zypper-1.6.334-26.3
SUSE Linux Enterprise Server 11-SP3-LTSS (src):    libzypp-9.40.2-14.7, zypper-1.6.334-26.3
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    libzypp-9.40.2-14.7, zypper-1.6.334-26.3
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    libzypp-9.40.2-14.7, zypper-1.6.334-26.3