FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Redhat > Fedora Build System

 
 
LinkBack Thread Tools
 
Old 03-23-2010, 08:12 PM
Mike Bonnet
 
Default hash changed for external rpm

On 03/23/2010 04:41 PM, Connie Sieh wrote:
> I recently installed koji and had successfully built rpms from src.rpm's
> for Fedora 12 and Scientific Linux(RHEL 5 rebuild).
>
> I then started getting "hash changed for external rpm" errors while trying
> to build a different src.rpm for the Scientific Linux repository.
>
> -----------------------------------------------------------------------
> 5329 build (dist-sl5, bash-3.2-24.el5.src.rpm): open (sl6) -> FAILED:
> GenericError: hash changed for external rpm:
> termcap-5.5-1.20060701.1.noarch@dist-sl5-external-repo-base
> (dbb20448cc979898c065cc4e551a926c -> 586d659bf4699215a13ba57a4422bb34)
> -------------------------------------------------------------------------
>
> [root@]# rpm -qp --queryformat "%{name} %{sigmd5}
" termcap-5.5-1.20060701.1.noarch.rpm
> termcap dbb20448cc979898c065cc4e551a926c
>
> ----------------------------------------------------------------------------
> I do not understand where the "586d659bf4699215a13ba57a4422bb34" hash is
> coming from. How do I fix this?

dbb204 is the hash of the rpm previously recorded in the database, and
586d65 is the hash of the rpm used for this build. I would check the
pkgorigins file in the latest repo directory to see where the termcap
rpm is coming from, and check the sigmd5 of that rpm.
--
buildsys mailing list
buildsys@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/buildsys
 
Old 03-23-2010, 08:39 PM
Connie Sieh
 
Default hash changed for external rpm

On Tue, 23 Mar 2010, Mike Bonnet wrote:

> On 03/23/2010 04:41 PM, Connie Sieh wrote:
>> I recently installed koji and had successfully built rpms from src.rpm's
>> for Fedora 12 and Scientific Linux(RHEL 5 rebuild).
>>
>> I then started getting "hash changed for external rpm" errors while trying
>> to build a different src.rpm for the Scientific Linux repository.
>>
>> -----------------------------------------------------------------------
>> 5329 build (dist-sl5, bash-3.2-24.el5.src.rpm): open (sl6) -> FAILED:
>> GenericError: hash changed for external rpm:
>> termcap-5.5-1.20060701.1.noarch@dist-sl5-external-repo-base
>> (dbb20448cc979898c065cc4e551a926c -> 586d659bf4699215a13ba57a4422bb34)
>> -------------------------------------------------------------------------
>>
>> [root@]# rpm -qp --queryformat "%{name} %{sigmd5}
" termcap-5.5-1.20060701.1.noarch.rpm
>> termcap dbb20448cc979898c065cc4e551a926c
>>
>> ----------------------------------------------------------------------------
>> I do not understand where the "586d659bf4699215a13ba57a4422bb34" hash is
>> coming from. How do I fix this?
>
> dbb204 is the hash of the rpm previously recorded in the database, and
> 586d65 is the hash of the rpm used for this build. I would check the
> pkgorigins file in the latest repo directory to see where the termcap
> rpm is coming from, and check the sigmd5 of that rpm.

According to the pkgorgins file the termcap rpm is coming from my external
repository. The above queryformat was from that version of termcap.

> --
> buildsys mailing list
> buildsys@lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/buildsys
>

-Connie Sieh
--
buildsys mailing list
buildsys@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/buildsys
 
Old 03-23-2010, 09:03 PM
Mike Bonnet
 
Default hash changed for external rpm

On 03/23/2010 05:39 PM, Connie Sieh wrote:
> On Tue, 23 Mar 2010, Mike Bonnet wrote:
>
>> On 03/23/2010 04:41 PM, Connie Sieh wrote:
>>> I recently installed koji and had successfully built rpms from src.rpm's
>>> for Fedora 12 and Scientific Linux(RHEL 5 rebuild).
>>>
>>> I then started getting "hash changed for external rpm" errors while trying
>>> to build a different src.rpm for the Scientific Linux repository.
>>>
>>> -----------------------------------------------------------------------
>>> 5329 build (dist-sl5, bash-3.2-24.el5.src.rpm): open (sl6) -> FAILED:
>>> GenericError: hash changed for external rpm:
>>> termcap-5.5-1.20060701.1.noarch@dist-sl5-external-repo-base
>>> (dbb20448cc979898c065cc4e551a926c -> 586d659bf4699215a13ba57a4422bb34)
>>> -------------------------------------------------------------------------
>>>
>>> [root@]# rpm -qp --queryformat "%{name} %{sigmd5}
" termcap-5.5-1.20060701.1.noarch.rpm
>>> termcap dbb20448cc979898c065cc4e551a926c
>>>
>>> ----------------------------------------------------------------------------
>>> I do not understand where the "586d659bf4699215a13ba57a4422bb34" hash is
>>> coming from. How do I fix this?
>>
>> dbb204 is the hash of the rpm previously recorded in the database, and
>> 586d65 is the hash of the rpm used for this build. I would check the
>> pkgorigins file in the latest repo directory to see where the termcap
>> rpm is coming from, and check the sigmd5 of that rpm.
>
> According to the pkgorgins file the termcap rpm is coming from my external
> repository. The above queryformat was from that version of termcap.

I'm not sure where that's coming from either then. The error message is
saying that there is a termcap-5.5-1.20060701.1.noarch.rpm that's
getting into your buildroot somehow with a sigmd5 of 586d65.

You might want to check the rpminfo table and see if you can find
where/when termcap-5.5-1.20060701.1.noarch was added to the database.
--
buildsys mailing list
buildsys@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/buildsys
 
Old 03-23-2010, 09:33 PM
Connie Sieh
 
Default hash changed for external rpm

On Tue, 23 Mar 2010, Mike Bonnet wrote:

> On 03/23/2010 05:39 PM, Connie Sieh wrote:
>> On Tue, 23 Mar 2010, Mike Bonnet wrote:
>>
>>> On 03/23/2010 04:41 PM, Connie Sieh wrote:
>>>> I recently installed koji and had successfully built rpms from src.rpm's
>>>> for Fedora 12 and Scientific Linux(RHEL 5 rebuild).
>>>>
>>>> I then started getting "hash changed for external rpm" errors while trying
>>>> to build a different src.rpm for the Scientific Linux repository.
>>>>
>>>> -----------------------------------------------------------------------
>>>> 5329 build (dist-sl5, bash-3.2-24.el5.src.rpm): open (sl6) -> FAILED:
>>>> GenericError: hash changed for external rpm:
>>>> termcap-5.5-1.20060701.1.noarch@dist-sl5-external-repo-base
>>>> (dbb20448cc979898c065cc4e551a926c -> 586d659bf4699215a13ba57a4422bb34)
>>>> -------------------------------------------------------------------------
>>>>
>>>> [root@]# rpm -qp --queryformat "%{name} %{sigmd5}
" termcap-5.5-1.20060701.1.noarch.rpm
>>>> termcap dbb20448cc979898c065cc4e551a926c
>>>>
>>>> ----------------------------------------------------------------------------
>>>> I do not understand where the "586d659bf4699215a13ba57a4422bb34" hash is
>>>> coming from. How do I fix this?
>>>
>>> dbb204 is the hash of the rpm previously recorded in the database, and
>>> 586d65 is the hash of the rpm used for this build. I would check the
>>> pkgorigins file in the latest repo directory to see where the termcap
>>> rpm is coming from, and check the sigmd5 of that rpm.
>>
>> According to the pkgorgins file the termcap rpm is coming from my external
>> repository. The above queryformat was from that version of termcap.
>
> I'm not sure where that's coming from either then. The error message is
> saying that there is a termcap-5.5-1.20060701.1.noarch.rpm that's
> getting into your buildroot somehow with a sigmd5 of 586d65.
>
> You might want to check the rpminfo table and see if you can find
> where/when termcap-5.5-1.20060701.1.noarch was added to the database.
> --
>
So I looked in the database rpminfo table for termcap and did see the
dbb204 hash. I changed it to the 586d65 hash just to see if it would now
match. I reran the build. Now it gets the "rpm" hash right but the
database is wrong. How do I resync the repodata from my external
repository? I have done way too many regen-repo in an attempt to fix
this.

----------------------------------------------------------------------------
5366 build (dist-sl5, bash-3.2-24.el5.src.rpm): open (sl6) -> FAILED:
GenericError: hash changed for external rpm:
termcap-5.5-1.20060701.1.noarch@dist-sl5-external-repo-base
(586d659bf4699215a13ba57a4422bb34 -> dbb20448cc979898c065cc4e551a926c)
----------------------------------------------------------------------------

-Connie Sieh
--
buildsys mailing list
buildsys@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/buildsys
 
Old 03-23-2010, 09:41 PM
Mike Bonnet
 
Default hash changed for external rpm

On 03/23/2010 06:33 PM, Connie Sieh wrote:
> On Tue, 23 Mar 2010, Mike Bonnet wrote:
>
>> On 03/23/2010 05:39 PM, Connie Sieh wrote:
>>> On Tue, 23 Mar 2010, Mike Bonnet wrote:
>>>
>>>> On 03/23/2010 04:41 PM, Connie Sieh wrote:
>>>>> I recently installed koji and had successfully built rpms from src.rpm's
>>>>> for Fedora 12 and Scientific Linux(RHEL 5 rebuild).
>>>>>
>>>>> I then started getting "hash changed for external rpm" errors while trying
>>>>> to build a different src.rpm for the Scientific Linux repository.
>>>>>
>>>>> -----------------------------------------------------------------------
>>>>> 5329 build (dist-sl5, bash-3.2-24.el5.src.rpm): open (sl6) -> FAILED:
>>>>> GenericError: hash changed for external rpm:
>>>>> termcap-5.5-1.20060701.1.noarch@dist-sl5-external-repo-base
>>>>> (dbb20448cc979898c065cc4e551a926c -> 586d659bf4699215a13ba57a4422bb34)
>>>>> -------------------------------------------------------------------------
>>>>>
>>>>> [root@]# rpm -qp --queryformat "%{name} %{sigmd5}
" termcap-5.5-1.20060701.1.noarch.rpm
>>>>> termcap dbb20448cc979898c065cc4e551a926c
>>>>>
>>>>> ----------------------------------------------------------------------------
>>>>> I do not understand where the "586d659bf4699215a13ba57a4422bb34" hash is
>>>>> coming from. How do I fix this?
>>>>
>>>> dbb204 is the hash of the rpm previously recorded in the database, and
>>>> 586d65 is the hash of the rpm used for this build. I would check the
>>>> pkgorigins file in the latest repo directory to see where the termcap
>>>> rpm is coming from, and check the sigmd5 of that rpm.
>>>
>>> According to the pkgorgins file the termcap rpm is coming from my external
>>> repository. The above queryformat was from that version of termcap.
>>
>> I'm not sure where that's coming from either then. The error message is
>> saying that there is a termcap-5.5-1.20060701.1.noarch.rpm that's
>> getting into your buildroot somehow with a sigmd5 of 586d65.
>>
>> You might want to check the rpminfo table and see if you can find
>> where/when termcap-5.5-1.20060701.1.noarch was added to the database.
>> --
>>
> So I looked in the database rpminfo table for termcap and did see the
> dbb204 hash. I changed it to the 586d65 hash just to see if it would now
> match. I reran the build. Now it gets the "rpm" hash right but the
> database is wrong. How do I resync the repodata from my external
> repository? I have done way too many regen-repo in an attempt to fix
> this.

The easiest way to fix this is probably to remove the current external
repo from your tag hierarchy and add a new external repo with a
different name. Each external repo has its own namespace for packages.
--
buildsys mailing list
buildsys@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/buildsys
 
Old 03-23-2010, 10:46 PM
Mike McLean
 
Default hash changed for external rpm

On 03/23/2010 06:33 PM, Connie Sieh wrote:
> So I looked in the database rpminfo table for termcap and did see the
> dbb204 hash. I changed it to the 586d65 hash just to see if it would now
> match. I reran the build. Now it gets the "rpm" hash right but the
> database is wrong. How do I resync the repodata from my external
> repository? I have done way too many regen-repo in an attempt to fix
> this.

Generally speaking, you should not attempt to solve koji issues by
making direct db changes.

The cause of this error is exactly what it says: "hash changed for
external rpm." I.e. for the external repo in question the rpm in
question changed changed contents.

Koji insists on a few modest requirements for external repos. One of
them is that for a given repo, rpms of a given n-v-r do not change
contents (though resigning should be ok I think). This basic sanity
check is necessary to properly track buildroot contents.

Frankly, such behavior from a repo is suspicious. If it happened to me,
I'd be concerned about a possible security issue with the external repo.
Consider that if someone malicious were to hack into a repo and replace
an rpm with a trojaned copy, this is /exactly/ the error you would see
(though of course, it is more likely that someone simply rebuilt the rpm
and didn't bump the release, which is very bad practice).

By changing the database as you have, you have altered history data
about earlier buildroots that contained the rpm with the old hash. Now
the system will report that they contained the rpm with the new hash,
which is incorrect.

If you feel that there was a legitimate reason for the rpm in the
external repo to change then the workaround is, as Mike B wrote, to
create a new external repo entry (with a new name) pointing to the same
url and replace the old external with that in your tag hierarchy. The
reason this works is that Koji does allow different external repos to
disagree about the contents of a particular nvr.

--
buildsys mailing list
buildsys@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/buildsys
 
Old 03-24-2010, 02:40 PM
Connie Sieh
 
Default hash changed for external rpm

On Tue, 23 Mar 2010, Mike McLean wrote:

> On 03/23/2010 06:33 PM, Connie Sieh wrote:
>> So I looked in the database rpminfo table for termcap and did see the
>> dbb204 hash. I changed it to the 586d65 hash just to see if it would now
>> match. I reran the build. Now it gets the "rpm" hash right but the
>> database is wrong. How do I resync the repodata from my external
>> repository? I have done way too many regen-repo in an attempt to fix
>> this.
>
> Generally speaking, you should not attempt to solve koji issues by
> making direct db changes.

I was not trying to fix the issue but understand it better. The rpm at
the repo has the hash that was in the database but when koji gets it and
checks it is different. I was trying to verify where koji was getting the
"wrong" hash from. I still do not know where the wrong hash is coming
from because it is correct in the actual external repo.

>
> The cause of this error is exactly what it says: "hash changed for
> external rpm." I.e. for the external repo in question the rpm in
> question changed changed contents.
>

How does koji download the rpm. I have assumed that yum does the heavy
lifting to get the rpm from the external repo. Could there be a
incompatability between how the rpm hash was added to the external repo as
this is a RHEL 5 repo and thus used the RHEL 5 rpm to add the hash vs the
code that is in Fedora 12?

> Koji insists on a few modest requirements for external repos. One of
> them is that for a given repo, rpms of a given n-v-r do not change
> contents (though resigning should be ok I think). This basic sanity
> check is necessary to properly track buildroot contents.
>
> Frankly, such behavior from a repo is suspicious. If it happened to me,
> I'd be concerned about a possible security issue with the external repo.
> Consider that if someone malicious were to hack into a repo and replace
> an rpm with a trojaned copy, this is /exactly/ the error you would see
> (though of course, it is more likely that someone simply rebuilt the rpm
> and didn't bump the release, which is very bad practice).

I verifyed that the external repo rpm has NOT changed.

>
> By changing the database as you have, you have altered history data
> about earlier buildroots that contained the rpm with the old hash. Now
> the system will report that they contained the rpm with the new hash,
> which is incorrect.

Again this was only so I could better understand the issue.

>
> If you feel that there was a legitimate reason for the rpm in the
> external repo to change then the workaround is, as Mike B wrote, to
> create a new external repo entry (with a new name) pointing to the same
> url and replace the old external with that in your tag hierarchy. The
> reason this works is that Koji does allow different external repos to
> disagree about the contents of a particular nvr.
>
> --
> buildsys mailing list
> buildsys@lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/buildsys
>

-Connie Sieh
--
buildsys mailing list
buildsys@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/buildsys
 
Old 03-24-2010, 08:17 PM
Mike McLean
 
Default hash changed for external rpm

On 03/24/2010 11:40 AM, Connie Sieh wrote:
>> Generally speaking, you should not attempt to solve koji issues by
>> making direct db changes.
>
> I was not trying to fix the issue but understand it better. The rpm at
> the repo has the hash that was in the database but when koji gets it and
> checks it is different. I was trying to verify where koji was getting the
> "wrong" hash from. I still do not know where the wrong hash is coming
> from because it is correct in the actual external repo.

Fair enough. I've just seen more than a few folks alter their db
unnecessarily and I tend to caution against it.

> How does koji download the rpm. I have assumed that yum does the heavy
> lifting to get the rpm from the external repo. Could there be a
> incompatability between how the rpm hash was added to the external repo as
> this is a RHEL 5 repo and thus used the RHEL 5 rpm to add the hash vs the
> code that is in Fedora 12?

Yes, koji doesn't download external rpms. Yum does.

An external rpm is added to the database when a kojid instance makes a
call to update the buildroot contents. It gets this data by querying the
rpmdb from the buildroot. So if the entry is in your db, then at some
point kojid found it in a buildroot. Yum should flat out refuse to
install an rpm that doesn't match its sigmd5, so I doubt the data could
have been incorrect at the time of the build.

As for possible incompatibilities. I don't think the sigmd5 header in
rpm has changed in a long time. Plus, if yum/rpm got the sigmd5 value
wrong, it wouldn't have matched the contents and it would have refused
to install in the buildroot.

Also keep in mind that all the yum/rpm operations in kojid use the
yum/rpm of the host system, not the buildroot.

> I verifyed that the external repo rpm has NOT changed.

How did you verify this?

> So I looked in the database rpminfo table for termcap and did see the
> dbb204 hash. I changed it to the 586d65 hash just to see if it would now
> match. I reran the build. Now it gets the "rpm" hash right but the
> database is wrong. How do I resync the repodata from my external
> repository? I have done way too many regen-repo in an attempt to fix
> this.
>
> ----------------------------------------------------------------------------
> 5366 build (dist-sl5, bash-3.2-24.el5.src.rpm): open (sl6) -> FAILED:
> GenericError: hash changed for external rpm:
> termcap-5.5-1.20060701.1.noarch@dist-sl5-external-repo-base
> (586d659bf4699215a13ba57a4422bb34 -> dbb20448cc979898c065cc4e551a926c)
> ----------------------------------------------------------------------------

So let me see if I've got the order of things correct.
1. Got hash changed error showing dbb2* -> 586d*
2. Determine that the sigmd5 for the rpm in question really is dbb2*
3. Check database, find rpminfo entry showing dbb2*, changed it to 586d*
3. Now the same build reports the opposite hash change: 586d* -> dbb2*

It seem, as you said, that 586d* is the mystery here. Showed up in one
buildroot unexpectedly and now seems to have disappeared. Let's see what
turns up in the db.

Try running these queries:

select payloadhash, external_repo.name from rpminfo left outer join
external_repo on external_repo_id = external_repo.id where rpminfo.name
= 'termcap' and version='5.5' and release='1.20060701.1' and arch='noarch';

select rpminfo.name, version, release, arch, payloadhash,
external_repo.name from rpminfo left outer join external_repo on
external_repo_id = external_repo.id where payloadhash =
'586d659bf4699215a13ba57a4422bb34';

Also, look at the repo used for task 5366 and compare it to the repo
used for task 5329. Look at the repodata pertaining to termcap as well
as the pkgorigins file. Unfortunately the repodata does not include
sigmd5, but it should at least show if the rpm changed between the two
repos.
--
buildsys mailing list
buildsys@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/buildsys
 

Thread Tools




All times are GMT. The time now is 03:14 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org