Re: zypper ignores instruction to 'discard' packages with FAILed/mismatched digest checksum. downloads & installs it anyway.

Hello,

On 08/02/2016 10:00 PM, [email protected] wrote:
> While doing a package upgrade
> 
> I saw this
> 
> 	..................................................................[done (2.2 MiB/s)]
> 
> 	Warning: Digest verification failed for file 'MozillaFirefox-47.0.1-541.2.x86_64.rpm'
> 	[/var/cache/zypp/packages/MozillaFACTORY/x86_64/MozillaFirefox-47.0.1-541.2.x86_64.rpm]

This is a file in your local cache. From a previous run, possibly broken
or manipulated.

> 	Unblock or discard? [2c7a/? shows all options] (discard):
> 
> I hit <ENTER> to accept the default and "discard"

You discard the cached file.

> Instead of discarding it, it ACCEPTED the upgrade as started to download it

You did not accept the upgrade. You discarded the cached file. Zypper
then starts to download a fresh copy:
> 
> 	Retrieving: MozillaFirefox-47.0.1-541.2.x86_64.rpm .........................................................................................<77%>=======================
> 
> and eventually installed it

But only after verifying that the fresh downloaded file matches the
digest as per the signed repository metadata.

Not an issue, works as expected.

Andreas

-- 
Andreas Stieger <[email protected]>
Project Manager Security
SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton,
HRB 21284 (AG Nürnberg)
-- 
To unsubscribe, e-mail: [email protected]
To contact the owner, e-mail: [email protected]