MySQL Bugs: #116066: mysql80-community-release For SLES15 Improperly Signed

Bug #116066	mysql80-community-release For SLES15 Improperly Signed
Submitted:	11 Sep 2024 16:21	Modified:	13 Sep 2024 13:45
Reporter:	Stefan Kurek	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Package Repos	Severity:	S2 (Serious)
Version:	8.0	OS:	SUSE (SLES 15.6)
Assigned to:	Balasubramanian Kandasamy	CPU Architecture:	x86

Description:
It looks like the 8.0 version of the community release for SLES 15 needs to be resigned. I'm trying to install mysql 8.0 on SLES15.6, but this appears to currently be broken. When trying to run `sudo zypper -n install https://dev.mysql.com/get/mysql80-community-release-sl15.rpm` I receiver the following error:
```
Refreshing service 'Web_and_Scripting_Module_x86_64'.
Building repository 'MySQL Connectors Community' cache ........................................[done]
Signature verification failed for file 'repomd.xml' from repository 'MySQL Tools Community'.

    Note: Signing data enables the recipient to verify that no modifications occurred after the data
    were signed. Accepting data with no, wrong or unknown signature can lead to a corrupted system
    and in extreme cases even to a system compromise.

    Note: File 'repomd.xml' is the repositories master index file. It ensures the integrity of the
    whole repo.

    Warning: This file was modified after it has been signed. This may have been a malicious change,
    so it might not be trustworthy anymore! You should not continue unless you know it's safe.

    Note: This might be a transient issue if the server is in the midst of receiving new data. The
    data file and its signature are two files which must fit together. In case the request hit the
    server in the midst of updating them, the signature verification might fail. After a few
    minutes, when the server has updated its data, it should work again.
```

I also see this for "MySQL Tools Community".

How to repeat:
sudo rpm --import https://repo.mysql.com/RPM-GPG-KEY-mysql-2023
sudo rpm --import https://repo.mysql.com/RPM-GPG-KEY-mysql-2022
sudo zypper -n install https://dev.mysql.com/get/mysql80-community-release-sl15.rpm
sudo zypper -n install mysql-community-server

Hello Stefan Kurek,

Thank you for the report and feedback.

regards,
Umesh

Thank you for your bug report. 

mysql80-community-release-sl15.rpm shouldn't be used. Please use mysql84-community-release-sl15.rpm for the installation, note the mysql84 file prefix (versus mysql80)

As of the April 2024 release, we have updated the SL15 repository setup RPM (mysql84-community-release-sl15.rpm) to denote the default MySQL series to install (enabled subrepository by default), which is the latest LTS version.

To summarize the installation steps:

1. Import the RPM keys by running the following commands:
   sudo rpm --import https://repo.mysql.com/RPM-GPG-KEY-mysql-2023
   sudo rpm --import https://repo.mysql.com/RPM-GPG-KEY-mysql-2022
   
2. Install the repository setup RPM:
   sudo zypper -n install https://dev.mysql.com/get/mysql84-community-release-sl15.rpm
   
3. Install MySQL 8.4.2 LTS release binaries using the following command:
   sudo zypper -n install mysql-community-server

To install Server 8.0.x releases, use these commands:
   sudo zypper modifyrepo -d mysql-8.4-lts-community
   sudo zypper modifyrepo -e mysql80-community
   sudo zypper -n install mysql-community-server

Unfortunately I'm still seeing a similar problem while running those exact commands. It still looks like there is a signing issue.
```
Repository 'mysql-8.4-lts-community' has been successfully disabled.
Repository 'mysql80-community' has been successfully enabled.
Refreshing service 'Basesystem_Module_x86_64'.
Refreshing service 'Containers_Module_x86_64'.
Refreshing service 'Desktop_Applications_Module_x86_64'.
Refreshing service 'Development_Tools_Module_x86_64'.
Refreshing service 'Public_Cloud_Module_x86_64'.
Refreshing service 'Python_3_Module_x86_64'.
Refreshing service 'SUSE_Linux_Enterprise_Server_x86_64'.
Refreshing service 'Server_Applications_Module_x86_64'.
Refreshing service 'Web_and_Scripting_Module_x86_64'.
Building repository 'MySQL Connectors Community' cache ........................................[done]
Building repository 'MySQL Tools 8.4 LTS Community' cache .....................................[done]
Signature verification failed for file 'repomd.xml' from repository 'MySQL 8.0 Community Server'.

Note: Signing data enables the recipient to verify that no modifications occurred after the data
were signed. Accepting data with no, wrong or unknown signature can lead to a corrupted system
and in extreme cases even to a system compromise.

Note: File 'repomd.xml' is the repositories master index file. It ensures the integrity of the
whole repo.

Warning: This file was modified after it has been signed. This may have been a malicious change,
so it might not be trustworthy anymore! You should not continue unless you know it's safe.

Note: This might be a transient issue if the server is in the midst of receiving new data. The
data file and its signature are two files which must fit together. In case the request hit the
server in the midst of updating them, the signature verification might fail. After a few
minutes, when the server has updated its data, it should work again.

Signature verification failed for file 'repomd.xml' from repository 'MySQL 8.0 Community Server'. Continue? [yes/no] (no): no
Error building the cache:
[mysql80-community|http://repo.mysql.com/yum/mysql-8.0-community/suse/15/x86_64/] Valid metadata not found at specified URL
History:
- Signature verification failed for repomd.xml
...
```

I couldn't replicate the issue. could you try below steps:

1) Please verify if the GPG keys are installed correctly.

rpm -qa | egrep -i "3a79bd29|a8d3785c"

2) zypper clean -a

3) zypper refresh

4) zypper repos -E | grep mysql.*community

# Verify if mysql80-community is enabled

5) sudo zypper -n install mysql-community-server

Still having issues. Specifically on the refresh here.

```
stefan_kurek_bluemedora_com@stefan-sles-15-6:~> sudo rpm -qa | egrep -i "3a79bd29|a8d3785c"
gpg-pubkey-a8d3785c-6536acda
gpg-pubkey-3a79bd29-61b8bab7
stefan_kurek_bluemedora_com@stefan-sles-15-6:~> sudo zypper clean -a
All repositories have been cleaned up.
stefan_kurek_bluemedora_com@stefan-sles-15-6:~> sudo zypper refresh
Retrieving repository 'SLE-Module-Basesystem15-SP6-Pool' metadata .............................[done]
Building repository 'SLE-Module-Basesystem15-SP6-Pool' cache ..................................[done]
Retrieving repository 'SLE-Module-Basesystem15-SP6-Updates' metadata ..........................[done]
Building repository 'SLE-Module-Basesystem15-SP6-Updates' cache ...............................[done]
Retrieving repository 'SLE-Module-Containers15-SP6-Pool' metadata .............................[done]
Building repository 'SLE-Module-Containers15-SP6-Pool' cache ..................................[done]
Retrieving repository 'SLE-Module-Containers15-SP6-Updates' metadata ..........................[done]
Building repository 'SLE-Module-Containers15-SP6-Updates' cache ...............................[done]
Retrieving repository 'SLE-Module-Desktop-Applications15-SP6-Pool' metadata ...................[done]
Building repository 'SLE-Module-Desktop-Applications15-SP6-Pool' cache ........................[done]
Retrieving repository 'SLE-Module-Desktop-Applications15-SP6-Updates' metadata ................[done]
Building repository 'SLE-Module-Desktop-Applications15-SP6-Updates' cache .....................[done]
Retrieving repository 'SLE-Module-DevTools15-SP6-Pool' metadata ...............................[done]
Building repository 'SLE-Module-DevTools15-SP6-Pool' cache ....................................[done]
Retrieving repository 'SLE-Module-DevTools15-SP6-Updates' metadata ............................[done]
Building repository 'SLE-Module-DevTools15-SP6-Updates' cache .................................[done]
Retrieving repository 'SLE-Module-Public-Cloud15-SP6-Pool' metadata ...........................[done]
Building repository 'SLE-Module-Public-Cloud15-SP6-Pool' cache ................................[done]
Retrieving repository 'SLE-Module-Public-Cloud15-SP6-Updates' metadata ........................[done]
Building repository 'SLE-Module-Public-Cloud15-SP6-Updates' cache .............................[done]
Retrieving repository 'SLE-Module-Python3-15-SP6-Pool' metadata ...............................[done]
Building repository 'SLE-Module-Python3-15-SP6-Pool' cache ....................................[done]
Retrieving repository 'SLE-Module-Python3-15-SP6-Updates' metadata ............................[done]
Building repository 'SLE-Module-Python3-15-SP6-Updates' cache .................................[done]
Retrieving repository 'SLE-Product-SLES15-SP6-Pool' metadata ..................................[done]
Building repository 'SLE-Product-SLES15-SP6-Pool' cache .......................................[done]
The gpg key signing file 'repomd.xml' will expire in 7 days.
  Repository:       SLE-Product-SLES15-SP6-Updates
  Key Fingerprint:  FEAB 5025 39D8 46DB 2C09 61CA 70AF 9E81 39DB 7C82
  Key Name:         SuSE Package Signing Key <build@suse.de>
  Key Algorithm:    RSA 2048
  Key Created:      Mon Sep 21 08:21:47 2020
  Key Expires:      Fri Sep 20 08:21:47 2024 (expires in 7 days)
  Rpm Name:         gpg-pubkey-39db7c82-5f68629b
Retrieving repository 'SLE-Product-SLES15-SP6-Updates' metadata ...............................[done]
Building repository 'SLE-Product-SLES15-SP6-Updates' cache ....................................[done]
Retrieving repository 'SLE-Module-Server-Applications15-SP6-Pool' metadata ....................[done]
Building repository 'SLE-Module-Server-Applications15-SP6-Pool' cache .........................[done]
Retrieving repository 'SLE-Module-Server-Applications15-SP6-Updates' metadata .................[done]
Building repository 'SLE-Module-Server-Applications15-SP6-Updates' cache ......................[done]
Retrieving repository 'SLE-Module-Web-Scripting15-SP6-Pool' metadata ..........................[done]
Building repository 'SLE-Module-Web-Scripting15-SP6-Pool' cache ...............................[done]
Retrieving repository 'SLE-Module-Web-Scripting15-SP6-Updates' metadata .......................[done]
Building repository 'SLE-Module-Web-Scripting15-SP6-Updates' cache ............................[done]
Retrieving repository 'MySQL Connectors Community' metadata ...................................[done]
Building repository 'MySQL Connectors Community' cache ........................................[done]
Retrieving repository 'MySQL Tools 8.4 LTS Community' metadata ................................[done]
Building repository 'MySQL Tools 8.4 LTS Community' cache .....................................[done]
Signature verification failed for file 'repomd.xml' from repository 'MySQL 8.0 Community Server'.

    Note: Signing data enables the recipient to verify that no modifications occurred after the data
    were signed. Accepting data with no, wrong or unknown signature can lead to a corrupted system
    and in extreme cases even to a system compromise.

    Note: File 'repomd.xml' is the repositories master index file. It ensures the integrity of the
    whole repo.

    Warning: This file was modified after it has been signed. This may have been a malicious change,
    so it might not be trustworthy anymore! You should not continue unless you know it's safe.

    Note: This might be a transient issue if the server is in the midst of receiving new data. The
    data file and its signature are two files which must fit together. In case the request hit the
    server in the midst of updating them, the signature verification might fail. After a few
    minutes, when the server has updated its data, it should work again.

Signature verification failed for file 'repomd.xml' from repository 'MySQL 8.0 Community Server'. Continue? [yes/no] (no): 
```

Could there possibly be a bad mirror in play? I did actually notice that sometimes when a partner spins up a cloud VM in a different region, he is able to install successfully.

We have purged the Akamai edge server caches of suse repomd.xml and repomd.xml.asc files. 

Please could you re-try the install steps.

It immediately worked on the first try with no issues :). Thanks for following through!