Solved The update metadata is correctly signed, but failed an integrity check

MichaelL

Member

Reaction score: 2
Messages: 30

I was fairly sure freebsd-update update always used to return the correct patch number at the end. See what it says after the next update.
 

junovitch@

Daemon
Developer

Reaction score: 615
Messages: 1,773

I was fairly sure freebsd-update update always used to return the correct patch number at the end. See what it says after the next update.
Now that you mention this I believe it did. I've been doing source updates more often than anything and would have to double check it. If it still looks off after today's upstream OpenSSL updates hit freebsd-update(8) then it would be worth asking.
 

wolf23

New Member


Messages: 5

Is this the same issue with 10.2-RELEASE-p15 and -p16?


Code:
=============================================================================
FreeBSD-SA-16:17.openssl                                    Security Advisory
                                                          The FreeBSD Project

Topic:          Multiple OpenSSL vulnerabilities

Category:       contrib
Module:         openssl
Announced:      2016-05-04
Credits:        OpenSSL Project
Affects:        All supported versions of FreeBSD.
Corrected:      2016-05-03 18:54:20 UTC (stable/10, 10.3-STABLE)
                2016-05-04 15:25:47 UTC (releng/10.3, 10.3-RELEASE-p2)
                2016-05-04 15:26:23 UTC (releng/10.2, 10.2-RELEASE-p16)
versus


[root@myhost ~]# freebsd-version -ku
10.2-RELEASE-p14
10.2-RELEASE-p15
[root@myhost ~]# freebsd-update fetch
Looking up update.FreeBSD.org mirrors... 4 mirrors found.
Fetching metadata signature for 10.2-RELEASE from update5.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.
Preparing to download files... done.

No updates needed to update system to 10.2-RELEASE-p15.
 

donallen

Active Member

Reaction score: 2
Messages: 106

I run into this same issue when trying to upgrade a 10.3 system to 11-RC3:

Code:
# freebsd-update -r 11.0-RC3 upgrade
Looking up update.FreeBSD.org mirrors... 4 mirrors found.
Fetching metadata signature for 10.3-RELEASE from update6.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.

The following components of FreeBSD seem to be installed:
kernel/generic src/src world/base world/doc

The following components of FreeBSD do not seem to be installed:
world/games world/lib32

Does this look reasonable (y/n)? y

Fetching metadata signature for 11.0-RC3 from update6.freebsd.org... done.
Fetching metadata index... done.

The update metadata is correctly signed, but
failed an integrity check.
Cowardly refusing to proceed any further.
 

Unixnut

New Member


Messages: 9

I also seem to be running into the same issue, trying to upgrade to 11-RELEASE:

Code:
# uname -r
10.1-RELEASE-p31
# freebsd-update -r 11.0-RELEASE upgrade
Looking up update.FreeBSD.org mirrors... 4 mirrors found.
Fetching metadata signature for 10.1-RELEASE from update6.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.

The following components of FreeBSD seem to be installed:
kernel/generic src/src world/base world/games world/lib32

The following components of FreeBSD do not seem to be installed:
world/doc

Does this look reasonable (y/n)? y

Fetching metadata signature for 11.0-RELEASE from update6.freebsd.org... done.
Fetching metadata index... done.

The update metadata is correctly signed, but
failed an integrity check.
Cowardly refusing to proceed any further.
 

cpm@

Moderator
Staff member
Moderator
Developer

Reaction score: 931
Messages: 2,130

The trick with your brand-new 10.3-RELEASE box would be to update to 10.3-RELEASE-p10 (or whatever the latest is) and then try the upgrade to 11.0-RELEASE. So the first step is to update 10.3-RELEASE to the latest patch-level before attempt to update to the new wanted release.

Code:
# freebsd-update fetch install
# freebsd-update upgrade -r 11.0-RELEASE
# freebsd-update install
# shutdown -r now
See as reference: https://www.freebsd.org/releases/11.0R/installation.html#upgrade-binary
 

oemb1905

New Member

Reaction score: 1
Messages: 3

The trick with your brand-new 10.3-RELEASE box would be to update to 10.3-RELEASE-p10 (or whatever the latest is) and then try the upgrade to 11.0-RELEASE. So the first step is to update 10.3-RELEASE to the latest patch-level before attempt to update to the new wanted release.

Code:
# freebsd-update fetch install
# freebsd-update upgrade -r 11.0-RELEASE
# freebsd-update install
# shutdown -r now
See as reference: https://www.freebsd.org/releases/11.0R/installation.html#upgrade-binary
I did that three times before I found and replied to this post, and rebooted each time and still get the integrity check fail ...
 

oemb1905

New Member

Reaction score: 1
Messages: 3

I was forced to update to 10.3 first, then to 11.0. Then, and only then, did it work.
 

cpm@

Moderator
Staff member
Moderator
Developer

Reaction score: 931
Messages: 2,130

I was forced to update to 10.3 first, then to 11.0. Then, and only then, did it work.
Yes, this step is applied when FreeBSD is upgraded from one major version to another, like from FreeBSD 9.x to FreeBSD 10.x.
 

Unixnut

New Member


Messages: 9

I also seem to be running into the same issue, trying to upgrade to 11-RELEASE:
I managed to solve it by first doing all outstanding patching on 10.1, then upgrading to 10.2. After that doing another upgrade to 11-RELEASE worked fine.
 

Kreme

New Member

Reaction score: 2
Messages: 7

I was forced to update to 10.3 first, then to 11.0. Then, and only then, did it work.
Yep, same here. Could not update an old 10.1 system until I updated to 10.3 first. Course, first I had to spend 20 minutes with my friends at Google trying to figure out why it wasn't working...
 

SirDice

Administrator
Staff member
Administrator
Moderator

Reaction score: 7,091
Messages: 29,261

A bug in freebsd-update(8) is/was the cause of this. Normally you're able to upgrade from any version but the bug prevents this. The only way around it is to update/upgrade to a fixed version first, after that it will work as normal again.

Edit: This is the bug: https://www.freebsd.org/security/advisories/FreeBSD-EN-16:09.freebsd-update.asc

So, if you want to upgrade to 11.0 or 11.1 from 9.x or 10.x you need to make sure you're running the fixed version first (9.3-RELEASE-p45, 10.1-RELEASE-p37, 10.2-RELEASE-p20 or 10.3-RELEASE-p6).
 

maks

Member

Reaction score: 4
Messages: 26

I had same issue 'Cowardly refusing to proceed any further.' when tried to update from 10.3-r to 11.2-r. It doesn't work.
Then I updated step by step. First I'm updated system from 10.3 to 11.0 and after this from 11.0 to 11.2
Seems the only way to update from end-of-life versions.
Hope it help.
 

HighSierraSky

New Member


Messages: 1

Me too.
But I can not upgrade 10.3 to 11.2.
I am trying 10.3 -> 10.4 -> 11.2
Now, It is working well.
Maybe I need to pray...
 
Top