md5 mismatch of result

[Frank Elsner]

Hello,

todays "dnf update --refresh" showed the following messages:

/var/cache/dnf/updates-0e22a1f5a0a34771/packages/cups-ipptool-2.3.3op2-5.fc33_2.3.3op2-7.fc33.x86_64.drpm: md5 mismatch of result
(51/60): clang-libs-11.0.0-2.fc33_11.0.0-3.fc33 2.1 MB/s | 8.1 MB     00:03    
/var/cache/dnf/updates-0e22a1f5a0a34771/packages/cups-2.3.3op2-5.fc33_2.3.3op2-7.fc33.x86_64.drpm: md5 mismatch of result

And nearly all "iwl*" packages also brougth this md5 mismatch.

What's behind? Is the repo compromised?

--Frank

[Sam Varshavchik]

Frank Elsner via users writes:
> Hello,
>
> todays "dnf update --refresh" showed the following messages:
>
> /var/cache/dnf/updates-0e22a1f5a0a34771/packages/cups- 
> ipptool-2.3.3op2-5.fc33_2.3.3op2-7.fc33.x86_64.drpm: md5 mismatch of result
> (51/60): clang-libs-11.0.0-2.fc33_11.0.0-3.fc33 2.1 MB/s | 8.1 MB     00:03
> /var/cache/dnf/updates-0e22a1f5a0a34771/packages/cups-2.3.3op2-5.fc33_2.3.3op2-7.fc33.x86_64.drpm:  
> md5 mismatch of result
>
> And nearly all "iwl*" packages also brougth this md5 mismatch.
>
> What's behind? Is the repo compromised?

I only got a mismatch on the libtirpc package. My dnf downloaded the entire  
iwl packages and not their drpms. It did download a few other drpms which  
were clean.

I'm pretty sure that packages that are reconstructed from drpms must still  
pass a gpg check.

[Samuel Sieb]

On 2021-05-22 4:37 a.m., Frank Elsner via users wrote:
> Hello,
>
> todays "dnf update --refresh" showed the following messages:
>
> /var/cache/dnf/updates-0e22a1f5a0a34771/packages/cups-ipptool-2.3.3op2-5.fc33_2.3.3op2-7.fc33.x86_64.drpm: md5 mismatch of result
> (51/60): clang-libs-11.0.0-2.fc33_11.0.0-3.fc33 2.1 MB/s | 8.1 MB     00:03
> /var/cache/dnf/updates-0e22a1f5a0a34771/packages/cups-2.3.3op2-5.fc33_2.3.3op2-7.fc33.x86_64.drpm: md5 mismatch of result
>
> And nearly all "iwl*" packages also brougth this md5 mismatch.
>
> What's behind? Is the repo compromised?

https://bugzilla.redhat.com/show_bug.cgi?id=1873876

It just means that the drpm won't be used, the full rpm will be downloaded.

[Frank Elsner]

On Sat, 22 May 2021 11:39:33 -0700 Samuel Sieb wrote:
> On 2021-05-22 4:37 a.m., Frank Elsner via users wrote:
> > Hello,
> >
> > todays "dnf update --refresh" showed the following messages:
> >
> > /var/cache/dnf/updates-0e22a1f5a0a34771/packages/cups-ipptool-2.3.3op2-5.fc33_2.3.3op2-7.fc33.x86_64.drpm: md5 mismatch of result
> > (51/60): clang-libs-11.0.0-2.fc33_11.0.0-3.fc33 2.1 MB/s | 8.1 MB     00:03
> > /var/cache/dnf/updates-0e22a1f5a0a34771/packages/cups-2.3.3op2-5.fc33_2.3.3op2-7.fc33.x86_64.drpm: md5 mismatch of result
> >
> > And nearly all "iwl*" packages also brougth this md5 mismatch.
> >
> > What's behind? Is the repo compromised?
>
> https://bugzilla.redhat.com/show_bug.cgi?id=1873876
>
> It just means that the drpm won't be used, the full rpm will be downloaded.

Thanks for the explaination.

--Frank