Bugzilla – Bug 500017
software management: wrong digest -- are attacks that selective
Last modified: 2009-05-07 19:15:42 UTC
wrong digest: are attacks that selective Well, it is not bug report per se, I mean I am not sure -- maybe I am under attack, but it looks a bit suspicious to me, that yast is right. For some time now, each time I run Yast/SM I get warning about this or that packages.gz that checksum is incorrect. I choose not to use that package and I continue. Next time I run Yast/SM I get another warning -- each time it is only _1_ (one) file affected. I see possible scenarios here: a) I am under attack of very subtle attack method, which is very selective, it affects only one package a time and it knows when I run yast (maybe yast is infected?) b) there is some flaw with updating packages -- so for yast it seems the checksum is changed, while in fact the whole package is changed c) my HDD is failing, and that failing is very selective
Hi Maciej, thanks for reporting. Can you attach the yast2 logs please? See http://en.opensuse.org/Bugs/YaST
https://bugzilla.novell.com/show_bug.cgi?id=500388#c1 related?
The other one looks like duplicate to me, the only difference, that the reporter didn't tell if this happens for the same package all the time or for various (but one per each launch of yast).
Created attachment 289881 [details] y2logs.tgz
Well, than please try to select another mirror, just like the user in the other bug. I leave the other one open, as I hope Peter Poeml (commenting the other one) will take care about the servers. *** This bug has been marked as a duplicate of bug 500388 ***
If anything, the other report is a duplicate. But the problem is I don't use any mirror explicitly set as repo -- so yast could pick up the best site for me automatically.
Additional note to all: Since errors like this one are, in essence, unavoidable and occur rather frequently, we have been working on a way to handle them as robustly as possible. See http://en.opensuse.org/Libzypp/Failover and https://features.opensuse.org/302923 for more information about this. openSUSE 11.2 will deal with this by simply ignoring accidentally broken/wrong files from whatever mirror, and use intact files whereever available. The motivation to get this fixed was not only that it is very inconvenient for the users, but also that it is usually quite some work to debug these problems (or even take note of them).