Solved The update metadata is correctly signed, but failed an integrity check

MichaelL

Member

Thanks: 2
Messages: 30

#27
I was fairly sure freebsd-update update always used to return the correct patch number at the end. See what it says after the next update.
 

junovitch@

Daemon
Developer

Thanks: 615
Messages: 1,773

#28
I was fairly sure freebsd-update update always used to return the correct patch number at the end. See what it says after the next update.
Now that you mention this I believe it did. I've been doing source updates more often than anything and would have to double check it. If it still looks off after today's upstream OpenSSL updates hit freebsd-update(8) then it would be worth asking.
 

wolf23

New Member


Messages: 5

#29
Is this the same issue with 10.2-RELEASE-p15 and -p16?


Code:
=============================================================================
FreeBSD-SA-16:17.openssl                                    Security Advisory
                                                          The FreeBSD Project

Topic:          Multiple OpenSSL vulnerabilities

Category:       contrib
Module:         openssl
Announced:      2016-05-04
Credits:        OpenSSL Project
Affects:        All supported versions of FreeBSD.
Corrected:      2016-05-03 18:54:20 UTC (stable/10, 10.3-STABLE)
                2016-05-04 15:25:47 UTC (releng/10.3, 10.3-RELEASE-p2)
                2016-05-04 15:26:23 UTC (releng/10.2, 10.2-RELEASE-p16)
versus


[root@myhost ~]# freebsd-version -ku
10.2-RELEASE-p14
10.2-RELEASE-p15
[root@myhost ~]# freebsd-update fetch
Looking up update.FreeBSD.org mirrors... 4 mirrors found.
Fetching metadata signature for 10.2-RELEASE from update5.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.
Preparing to download files... done.

No updates needed to update system to 10.2-RELEASE-p15.
 

donallen

Active Member

Thanks: 2
Messages: 106

#32
I run into this same issue when trying to upgrade a 10.3 system to 11-RC3:

Code:
# freebsd-update -r 11.0-RC3 upgrade
Looking up update.FreeBSD.org mirrors... 4 mirrors found.
Fetching metadata signature for 10.3-RELEASE from update6.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.

The following components of FreeBSD seem to be installed:
kernel/generic src/src world/base world/doc

The following components of FreeBSD do not seem to be installed:
world/games world/lib32

Does this look reasonable (y/n)? y

Fetching metadata signature for 11.0-RC3 from update6.freebsd.org... done.
Fetching metadata index... done.

The update metadata is correctly signed, but
failed an integrity check.
Cowardly refusing to proceed any further.
 

Unixnut

New Member


Messages: 9

#33
I also seem to be running into the same issue, trying to upgrade to 11-RELEASE:

Code:
# uname -r
10.1-RELEASE-p31
# freebsd-update -r 11.0-RELEASE upgrade
Looking up update.FreeBSD.org mirrors... 4 mirrors found.
Fetching metadata signature for 10.1-RELEASE from update6.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.

The following components of FreeBSD seem to be installed:
kernel/generic src/src world/base world/games world/lib32

The following components of FreeBSD do not seem to be installed:
world/doc

Does this look reasonable (y/n)? y

Fetching metadata signature for 11.0-RELEASE from update6.freebsd.org... done.
Fetching metadata index... done.

The update metadata is correctly signed, but
failed an integrity check.
Cowardly refusing to proceed any further.
 

cpm@

Moderator
Staff member
Moderator
Developer

Thanks: 925
Messages: 2,128

#34
The trick with your brand-new 10.3-RELEASE box would be to update to 10.3-RELEASE-p10 (or whatever the latest is) and then try the upgrade to 11.0-RELEASE. So the first step is to update 10.3-RELEASE to the latest patch-level before attempt to update to the new wanted release.

Code:
# freebsd-update fetch install
# freebsd-update upgrade -r 11.0-RELEASE
# freebsd-update install
# shutdown -r now
See as reference: https://www.freebsd.org/releases/11.0R/installation.html#upgrade-binary
 

oemb1905

New Member

Thanks: 1
Messages: 3

#36
The trick with your brand-new 10.3-RELEASE box would be to update to 10.3-RELEASE-p10 (or whatever the latest is) and then try the upgrade to 11.0-RELEASE. So the first step is to update 10.3-RELEASE to the latest patch-level before attempt to update to the new wanted release.

Code:
# freebsd-update fetch install
# freebsd-update upgrade -r 11.0-RELEASE
# freebsd-update install
# shutdown -r now
See as reference: https://www.freebsd.org/releases/11.0R/installation.html#upgrade-binary
I did that three times before I found and replied to this post, and rebooted each time and still get the integrity check fail ...
 

cpm@

Moderator
Staff member
Moderator
Developer

Thanks: 925
Messages: 2,128

#38
I was forced to update to 10.3 first, then to 11.0. Then, and only then, did it work.
Yes, this step is applied when FreeBSD is upgraded from one major version to another, like from FreeBSD 9.x to FreeBSD 10.x.
 

Kreme

New Member

Thanks: 2
Messages: 7

#40
I was forced to update to 10.3 first, then to 11.0. Then, and only then, did it work.
Yep, same here. Could not update an old 10.1 system until I updated to 10.3 first. Course, first I had to spend 20 minutes with my friends at Google trying to figure out why it wasn't working...
 

SirDice

Administrator
Staff member
Administrator
Moderator

Thanks: 6,774
Messages: 28,526

#41
A bug in freebsd-update(8) is/was the cause of this. Normally you're able to upgrade from any version but the bug prevents this. The only way around it is to update/upgrade to a fixed version first, after that it will work as normal again.

Edit: This is the bug: https://www.freebsd.org/security/advisories/FreeBSD-EN-16:09.freebsd-update.asc

So, if you want to upgrade to 11.0 or 11.1 from 9.x or 10.x you need to make sure you're running the fixed version first (9.3-RELEASE-p45, 10.1-RELEASE-p37, 10.2-RELEASE-p20 or 10.3-RELEASE-p6).
 

maks

Member

Thanks: 4
Messages: 26

#42
I had same issue 'Cowardly refusing to proceed any further.' when tried to update from 10.3-r to 11.2-r. It doesn't work.
Then I updated step by step. First I'm updated system from 10.3 to 11.0 and after this from 11.0 to 11.2
Seems the only way to update from end-of-life versions.
Hope it help.
 
Top