Frank Elsner via users writes:
Hello,
todays "dnf update --refresh" showed the following messages:
/var/cache/dnf/updates-0e22a1f5a0a34771/packages/cups- ipptool-2.3.3op2-5.fc33_2.3.3op2-7.fc33.x86_64.drpm: md5 mismatch of result (51/60): clang-libs-11.0.0-2.fc33_11.0.0-3.fc33 2.1 MB/s | 8.1 MB 00:03 /var/cache/dnf/updates-0e22a1f5a0a34771/packages/cups-2.3.3op2-5.fc33_2.3.3op2-7.fc33.x86_64.drpm: md5 mismatch of result
And nearly all "iwl*" packages also brougth this md5 mismatch.
What's behind? Is the repo compromised?
I only got a mismatch on the libtirpc package. My dnf downloaded the entire iwl packages and not their drpms. It did download a few other drpms which were clean.
I'm pretty sure that packages that are reconstructed from drpms must still pass a gpg check.