Core update, pakfire The downloaded file... wasn't verified by IPFire.org

General questions.
callifo
Posts: 34
Joined: September 30th, 2013, 4:14 pm

Core update, pakfire The downloaded file... wasn't verified by IPFire.org

Post by callifo » July 31st, 2018, 12:58 pm

Hi all,

Have had an issue updating to 122, it seemed to break my boot partition (probably my bad, might have rebooted too soon), and I had an existing dd image backup from 3 months ago so I reloaded that again and everything is up and running.

However pakfire does not work for some reason.

Code: Select all

[root@ipfire /]# pakfire update --force
server-list.db       100.00% |=============================>|    1.74 KB
packages_list.db     100.00% |=============================>|    3.41 KB
core-list.db         100.00% |=============================>|   233.00 B
[root@ipfire /]# pakfire upgrade --force
CORE UPGR: Upgrading from release 119 to 121
core-upgrade-2.19... 100.00% |=============================>|   12.56 MB
meta-core-upgrade... 100.00% |=============================>|   964.00 B
DOWNLOAD ERROR: The downloaded file (ipfire/pakfire2/2.19/meta/meta-core-upgrade-121) wasn't verified by IPFire.org. Sorry - Exiting...
TIME INFO: Time Server 129.250.35.251 has -0.014448 sec offset to localtime.
Tried pushing the pakfire version back to 118 (/opt/pakfire/db/core/mine) and trying updating from there instead and this also does not work, same error.

Code: Select all

[root@ipfire ~]# echo 118 > /opt/pakfire/db/core/mine
[root@ipfire ~]# pakfire update --force
server-list.db       100.00% |=============================>|    1.74 KB
packages_list.db     100.00% |=============================>|    3.41 KB
core-list.db         100.00% |=============================>|   233.00 B
[root@ipfire ~]# pakfire upgrade
CORE UPGR: Upgrading from release 118 to 121
meta-core-upgrade... 100.00% |=============================>|   964.00 B
DOWNLOAD ERROR: The downloaded file (ipfire/pakfire2/2.19/meta/meta-core-upgrade-121) wasn't verified by IPFire.org. Sorry - Exiting...
TIME INFO: Time Server 203.122.222.157 has -0.010935 sec offset to localtime.
Spent an hour looking through the forums, and also tried clearing the gpg keys and allowing them to be re-downloaded but this also didn't yield a fix. Also cleared the pakfire database, cache and the temp folders and this didn't help. Checked that DNSSEC was also working, and using Google DNS this passed the built in check.

Any suggestions on where to start looking?
Last edited by callifo on July 31st, 2018, 1:30 pm, edited 1 time in total.

User avatar
MichaelTremer
Core Developer
Core Developer
Posts: 5799
Joined: August 11th, 2005, 9:02 am

Re: Core update, pakfire The downloaded file... wasn't verified by IPFire.org

Post by MichaelTremer » July 31st, 2018, 1:01 pm

What does this command show you?

Code: Select all

gpg --homedir /opt/pakfire/ --list-keys
Support the project with our Donation Challenge!

Get Commercial Support for IPFire and more from Lightning Wire Labs!

Image

callifo
Posts: 34
Joined: September 30th, 2013, 4:14 pm

Re: Core update, pakfire The downloaded file... wasn't verified by IPFire.org

Post by callifo » July 31st, 2018, 1:05 pm

Code: Select all

[root@ipfire /]# gpg --homedir /opt/pakfire/ --list-keys
gpg: WARNING: unsafe permissions on homedir `/opt/pakfire/'
Without homedir,

Code: Select all

[root@ipfire /]# gpg --list-keys
/root/.gnupg/pubring.gpg
------------------------
pub   1024D/64D96617 2007-04-23
uid                  Michael Tremer (Pakfire Signing Key) <paks@ipfire.org>
sub   2048g/1620EB8B 2007-04-23

User avatar
MichaelTremer
Core Developer
Core Developer
Posts: 5799
Joined: August 11th, 2005, 9:02 am

Re: Core update, pakfire The downloaded file... wasn't verified by IPFire.org

Post by MichaelTremer » July 31st, 2018, 1:09 pm

We move the gpg keys into the /opt/pakfire directory, so keep the --homedir switch. The other one is the old one.

When you run

Code: Select all

/etc/init.d/pakfire start
, that should re-import the right keys. Can you run that command and let me know if that is showing any error messages?

-Michael
Support the project with our Donation Challenge!

Get Commercial Support for IPFire and more from Lightning Wire Labs!

Image

callifo
Posts: 34
Joined: September 30th, 2013, 4:14 pm

Re: Core update, pakfire The downloaded file... wasn't verified by IPFire.org

Post by callifo » July 31st, 2018, 1:12 pm

I don't appear to have a pakfire in /etc/init.d/ folder,

Code: Select all

[root@ipfire /]# ls -lh /etc/init.d/
total 300K
-rwxr-xr-- 1 root root  705 Feb 21  2015 acpid
-rwxr-xr-- 1 root root 2.4K Dec 13  2017 apache
-rwxr-xr-- 1 root root 1.3K Oct 16  2016 asterisk
-rwxr-xr-x 1 root root  365 Oct 17  2015 asteriskupdate.sh
-rwxr-xr-- 1 root root  874 Feb 21  2015 beep
-rwxr-xr-- 1 root root 3.6K Feb 21  2015 checkfs
-rwxr-xr-x 1 root root  604 Apr 20  2014 checkPing
-rwxr-xr-- 1 root root 1.4K Feb  9 06:34 clamav
-rwxr-xr-- 1 root root 3.6K Feb 26 04:29 cleanfs
-rwxr-xr-- 1 root root 3.4K Dec 21  2015 collectd
-rwxr-xr-- 1 root root 2.4K Feb 21  2015 connectd
-rwxr-xr-- 1 root root 3.0K Feb 21  2015 console
-rwxr-xr-- 1 root root  699 Apr 21  2017 cups
-rwxr-xr-- 1 root root  690 May 21  2015 cyrus-sasl
-rwxr-xr-- 1 root root 2.2K Oct 16  2016 dhcp
-rwxr-xr-- 1 root root  916 Feb 21  2015 dhcrelay
-rwxr-xr-- 1 root root  701 Feb 21  2015 fcron
-rwxr-xr-- 1 root root  892 Feb 21  2015 fireinfo
-rwxr-xr-- 1 root root  15K Oct 23  2017 firewall
-rwxr-xr-- 1 root root 1.5K Feb 21  2015 firstsetup
-rwxr-xr-- 1 root root  891 Feb 21  2015 fsresize
-rw-r--r-- 1 root root  17K Apr  2  2016 functions
-rwxr-xr-- 1 root root 1015 Jun 10  2017 guardian
-rwxr-xr-- 1 root root  819 Feb 21  2015 halt
-rwxr-xr-- 1 root root   19 Feb 21  2015 ipsec
-rwxr-xr-- 1 root root 3.8K Feb 21  2015 leds
-rwxr-xr-- 1 root root 1.4K Oct 16  2016 localnet
-rwxr-xr-- 1 root root 1.2K Mar 21  2016 messagebus
-rwxr-xr-- 1 root root 1.3K Apr 15  2015 miniupnpd
-rwxr-xr-- 1 root root 1.8K Feb 21  2015 modules
-rwxr-xr-- 1 root root 1.3K Feb 21  2015 mountfs
-rwxr-xr-- 1 root root 1.1K Feb 21  2015 mountkernfs
-rwxr-xr-- 1 root root  668 Feb 21  2015 mounttmpfs
-rwxr-xr-- 1 root root  826 Jun 10  2017 netsnmpd
-rwxr-xr-- 1 root root 2.4K Oct 16  2016 network
drwxr-xr-x 5 root root 4.0K Aug 15  2017 networking
-rwxr-xr-- 1 root root  475 May 21  2015 network-trigger
-rwxr-xr-x 1 root root  851 May 22  2015 noip
-rwxr-xr-- 1 root root 1.2K Aug 18  2017 ntp
-rwxr-xr-- 1 root root 3.9K May 26  2014 nut
-rwxr-xr-- 1 root root 1.8K Feb 21  2015 partresize
-rwxr-xr-- 1 root root  737 Feb 21  2015 random
-rwxr-xr-- 1 root root 2.4K Feb 21  2015 rc
-rwxr-xr-- 1 root root  658 Feb 21  2015 reboot
-rwxr-xr-- 1 root root 1.2K Feb 21  2015 rngd
-rwxr-xr-- 1 root root  929 Feb 21  2015 sendsignals
-rwxr-xr-- 1 root root 1.2K Oct 16  2016 setclock
-rwxr-xr-- 1 root root  534 Feb 21  2015 smartenabler
-rwxr-xr-- 1 root root 4.0K Sep 14  2016 snort
-rwxr-xr-- 1 root root 3.7K Feb 21  2015 squid
-rwxr-xr-- 1 root root 1.4K Oct 25  2015 sshd
-rwxr-xr-- 1 root root 1.2K Feb 21  2015 static-routes
-rwxr-xr-- 1 root root  825 Feb 21  2015 swap
-rwxr-xr-- 1 root root  767 Feb 21  2015 sysctl
-rwxr-xr-- 1 root root 1.2K Feb 21  2015 sysklogd
-rwxr-xr-- 1 root root  591 Feb 21  2015 teamspeak
-rwxr-xr-- 1 root root  654 Feb 21  2015 template
-rwxr-xr-- 1 root root 2.2K Feb 21  2015 udev
-rwxr-xr-- 1 root root  869 Feb 21  2015 udev_retry
-rwxr-xr-- 1 root root  13K Feb 26 04:29 unbound
-rwxr-xr-- 1 root root 1.1K Feb 21  2015 upnpd
-rwxr-xr-- 1 root root  605 Dec 21  2015 vnstat
-rwxr-xr-- 1 root root  995 Feb 21  2015 waitdrives
-rwxr-xr-- 1 root root 6.1K Jun 10  2017 wlanclient
Image

User avatar
MichaelTremer
Core Developer
Core Developer
Posts: 5799
Joined: August 11th, 2005, 9:02 am

Re: Core update, pakfire The downloaded file... wasn't verified by IPFire.org

Post by MichaelTremer » July 31st, 2018, 1:13 pm

Oops. That is not right. What version do you have installed? Did you ever install any testing releases?
Support the project with our Donation Challenge!

Get Commercial Support for IPFire and more from Lightning Wire Labs!

Image

callifo
Posts: 34
Joined: September 30th, 2013, 4:14 pm

Re: Core update, pakfire The downloaded file... wasn't verified by IPFire.org

Post by callifo » July 31st, 2018, 1:18 pm

I might have at some point, I *think* I put this box together about 7 years ago.

System info page:
IPFire version: IPFire 2.19 (i586) - core119
Pakfire version: 2.19
Kernel version: Linux ipfire 3.14.79-ipfire-pae #1 SMP Sat Nov 5 07:06:35 GMT 2016 i686 Intel(R) Atom(TM) CPU N550 @ 1.50GHz GenuineIntel GNU/Linux

Prior to the restore, I did manage to run the pakfire update to 122 with no issues, but I rebooted too soon I suspect. As mentioned though this backup image is from end of April I believe, but I haven't done anything to it much since then. I did have to manually install an older asterisk build as the newer one wont run (as per the submitted bug in bugzilla).

Edit: I made a backup of the busted image before I blew it away and reloaded the older image, and it too does not have pakfire in that folder.
Image

User avatar
MichaelTremer
Core Developer
Core Developer
Posts: 5799
Joined: August 11th, 2005, 9:02 am

Re: Core update, pakfire The downloaded file... wasn't verified by IPFire.org

Post by MichaelTremer » July 31st, 2018, 1:24 pm

What do you think was the last properly installed version? You can open /opt/pakfire/db/core/mine and set that back to 118 to have Pakfire re-install the 119 release which will hopefully help.
Support the project with our Donation Challenge!

Get Commercial Support for IPFire and more from Lightning Wire Labs!

Image

callifo
Posts: 34
Joined: September 30th, 2013, 4:14 pm

Re: Core update, pakfire The downloaded file... wasn't verified by IPFire.org

Post by callifo » July 31st, 2018, 1:29 pm

The test releases have not been recent (if at all), I've been on the regular builds since at least build 90. I think it was a very long time ago I might have tried to fix something by using a test build.

I tried that, and whilst it will download the update, it wont apply it as the file doesn't pass the installer signature check.

Code: Select all

[root@ipfire ~]# echo 118 > /opt/pakfire/db/core/mine
[root@ipfire ~]# pakfire update --force
server-list.db       100.00% |=============================>|    1.74 KB
packages_list.db     100.00% |=============================>|    3.41 KB
core-list.db         100.00% |=============================>|   233.00 B
[root@ipfire ~]# pakfire upgrade
CORE UPGR: Upgrading from release 118 to 121
meta-core-upgrade... 100.00% |=============================>|   964.00 B
DOWNLOAD ERROR: The downloaded file (ipfire/pakfire2/2.19/meta/meta-core-upgrade-121) wasn't verified by IPFire.org. Sorry - Exiting...
TIME INFO: Time Server 203.122.222.157 has -0.010935 sec offset to localtime.
Image

User avatar
MichaelTremer
Core Developer
Core Developer
Posts: 5799
Joined: August 11th, 2005, 9:02 am

Re: Core update, pakfire The downloaded file... wasn't verified by IPFire.org

Post by MichaelTremer » July 31st, 2018, 1:32 pm

That might happen, that you need to restart pakfire after the new keys have been imported. Any luck with that?
Support the project with our Donation Challenge!

Get Commercial Support for IPFire and more from Lightning Wire Labs!

Image

callifo
Posts: 34
Joined: September 30th, 2013, 4:14 pm

Re: Core update, pakfire The downloaded file... wasn't verified by IPFire.org

Post by callifo » July 31st, 2018, 1:47 pm

I've rebooted the box without any luck, same message eventuates. Without the pakfire file in /etc/init.d/ is there another way?

Can I manually add the gpg keys to the /opt/pakfire store?
Image

callifo
Posts: 34
Joined: September 30th, 2013, 4:14 pm

Re: Core update, pakfire The downloaded file... wasn't verified by IPFire.org

Post by callifo » July 31st, 2018, 2:24 pm

I've fixed up the user permissions on /opt/ipfire (to resolve the "gpg: WARNING: unsafe permissions on homedir `/opt/pakfire/'") and then run the following:

Code: Select all

gpg --homedir /opt/pakfire/ --keyserver pgp.ipfire.org --always-trust --status-fd 2 --recv-key "179740DC4D8C47DC63C099C74BDE364C64D96617"
Which results in,

Code: Select all

[root@ipfire opt]# gpg --homedir /opt/pakfire/ --keyserver pgp.ipfire.org --always-trust --status-fd 2 --recv-key "179740DC4D8C47DC63C099C74BDE364C64D96617"
gpg: requesting key 64D96617 from hkp server pgp.ipfire.org
gpg: key 64D96617: public key "Michael Tremer (Pakfire Signing Key) <paks@ipfire.org>" imported
[GNUPG:] IMPORTED 4BDE364C64D96617 Michael Tremer (Pakfire Signing Key) <paks@ipfire.org>
[GNUPG:] IMPORT_OK 1 179740DC4D8C47DC63C099C74BDE364C64D96617
gpg: no need for a trustdb check with `always' trust model
gpg: Total number processed: 1
gpg:               imported: 1
[GNUPG:] IMPORT_RES 1 0 1 0 0 0 0 0 0 0 0 0 0 0
[root@ipfire opt]# gpg --homedir /opt/pakfire/ --list-keys
gpg: checking the trustdb
gpg: no ultimately trusted keys found
/opt/pakfire//pubring.gpg
-------------------------
pub   1024D/64D96617 2007-04-23
uid                  Michael Tremer (Pakfire Signing Key) <paks@ipfire.org>
sub   2048g/1620EB8B 2007-04-23
Re-run pakfire and it's still no good.
Image

User avatar
MichaelTremer
Core Developer
Core Developer
Posts: 5799
Joined: August 11th, 2005, 9:02 am

Re: Core update, pakfire The downloaded file... wasn't verified by IPFire.org

Post by MichaelTremer » July 31st, 2018, 2:31 pm

Hey,

this is the old key. The new one is this one:

https://git.ipfire.org/?p=ipfire-2.x.gi ... 68;hb=HEAD
Support the project with our Donation Challenge!

Get Commercial Support for IPFire and more from Lightning Wire Labs!

Image

callifo
Posts: 34
Joined: September 30th, 2013, 4:14 pm

Re: Core update, pakfire The downloaded file... wasn't verified by IPFire.org

Post by callifo » July 31st, 2018, 2:55 pm

Thanks Michael, update is now running.

Just noticed if I 'fix' the permissions on the pakfire folder to make the gpg tool happy so it will permit the new key import, it breaks my ipfire webpage. So I needed to import that new key and then change the folder back to what it was.

Edit: /etc/init.d/pakfire has also now returned.
Image

dbossung
Posts: 2
Joined: August 1st, 2018, 1:41 pm

Re: Core update, pakfire The downloaded file... wasn't verified by IPFire.org

Post by dbossung » August 1st, 2018, 3:13 pm

For those finding this solution, I can verify it worked for me updating from 1.17 to 1.22. I got a little lost with downloading the key and adding it to the public key ring. So here is what I did.

Get a copy of the key referenced in the thread, I put it in /opt/pakfire as I did not have the location /opt/ipfire.
I named the downloaded key fire key.asc.

Use
gpg --import key.asc (or whatever you named the file)

Now the command
pakfire upgrade should work as advertised Follow this with
pakfire update and the update starts.

After rereading the thread I think there is an easier way to use gpg directly to get the key from pgp.ipfire.org but doing it this way worked even though I may have re-invented a wheel doing so. ;) Hope this helps someone.

Post Reply