slackpkg update fails to verify CHECKSUMS.md5 signature

mralk3 · 07-21-2015, 12:24 PM

I've followed the RPi guide up to this point.

I am unable to upgrade my system because the CHECKSUMS.md5 file cannot be verified. Also it looks like other files that are supposed to be saved to /tmp by slackpkg are not being saved either.

I've done nothing special to /tmp regarding permissions, or to any other permissions on my system.

I have upgraded my system with the /patches directory off my USB stick, but other parts of the system are still missing.

Quote:

slackpkg - version 2.81.1

What am I doing wrong?

I have also searched the Slack ARM forums, as well as the web looking for a solution, with no resolution.

EDIT:

The following returns nothing

Quote:

gpg --list-keys

I am using the following mirror, and have tried different mirrors with the same result:

Code:

ftp://ftp.arm.slackware.com/slackwarearm/slackwarearm-14.1/

I failed to also add during the edit that I am running Slackware arm 14.1. Also, here is the output of an attempt to try and import the gpg key using slackpkg:

Quote:

root@raspi:~# slackpkg update gpg

Downloading ftp://ftp.arm.slackware.com/slackwar...m-14.1/GPG-KEY...
--1969-12-31 17:10:40-- ftp://ftp.arm.slackware.com/slackwar...m-14.1/GPG-KEY
=> '/tmp/slackpkg.PwvXPE/gpgkey'
Resolving ftp.arm.slackware.com (ftp.arm.slackware.com)... 91.109.244.240
Connecting to ftp.arm.slackware.com (ftp.arm.slackware.com)|91.109.244.240|:21... connected.
Logging in as anonymous ... Logged in!
==> SYST ... done. ==> PWD ... done.
==> TYPE I ... done. ==> CWD (1) /slackwarearm/slackwarearm-14.1 ... done.
==> SIZE GPG-KEY ... 1747
==> PASV ... done. ==> RETR GPG-KEY ... done.
Length: 1747 (1.7K) (unauthoritative)

100[==================================================================================================== ==========================>] 1,747 --.-K/s in 0s

1969-12-31 17:10:42 (14.7 MB/s) - '/tmp/slackpkg.PwvXPE/gpgkey' saved [1747]

root@raspi:~# gpg --list-keys

"slackpkg help" returns the following, even after an update.

Quote:

slackpkg help

The package list is missing.
Before you install|upgrade|reinstall anything you need to run:

# slackpkg update

phenixia2003 · 07-21-2015, 01:36 PM

Hello,

You can fully disable gpg check in slackpkg.conf (ie set variable CHECKGPG=off), or temporarily at runtime as below :

Code:

$ slackpkg -checkgpg=off update

--
SeB

mralk3 · 07-21-2015, 04:12 PM

Quote:

Originally Posted by phenixia2003

You can fully disable gpg check in slackpkg.conf (ie set variable CHECKGPG=off), or temporarily at runtime as below :

Code:

$ slackpkg -checkgpg=off update

Thank you for your response. While this bypasses the problem I've encountered, it does not fix the problem. For now I will bypass GPG signatures, but I hope for some solution to the problem.

drmozes · 07-21-2015, 05:02 PM

Quote:

Originally Posted by mralk3

Thank you for your response. While this bypasses the problem I've encountered, it does not fix the problem. For now I will bypass GPG signatures, but I hope for some solution to the problem.

Do it manually.

Download the GPG key:

Code:

cd /tmp
wget -q http://arm.slackware.com/pgp-keys/GPG-KEY 
openssl sha1 GPG-KEY
SHA1(GPG-KEY)= 3784c2338e7f64eefc4cee6242ed790b87506d1a

Compare that SHA1 sig with the version in the Slackware ARM master tree:

Code:

openssl sha1 /devel/armedslack/slackwarearm-14.1/GPG-KEY
SHA1(/devel/armedslack/slackwarearm-14.1/GPG-KEY)= 3784c2338e7f64eefc4cee6242ed790b87506d1a

If it matches, import the GPG key:

Code:

gpg --import GPG-KEY

Download the new slackpkg package from the 14.1 patches:

Code:

cd /tmp
wget ftp://ftp.arm.slackware.com/slackwarearm/slackwarearm-14.1/patches/packages/slackpkg-2.82.0-noarch-12_slack14.1.txz
wget ftp://ftp.arm.slackware.com/slackwarearm/slackwarearm-14.1/patches/packages/slackpkg-2.82.0-noarch-12_slack14.1.txz.asc

Verify that it's been signed by the correct key:

Code:

# gpg --verify slackpkg-2.82.0-noarch-12_slack14.1.txz.asc slackpkg-2.82.0-noarch-12_slack14.1.txz
gpg: Signature made Mon 16 Jun 2014 08:25:55 PM BST using RSA key ID 1623FC33
gpg: Good signature from "Slackware ARM (Slackware ARM Linux Project) <mozes@slackware.com>"

Manually upgrade it:

Code:

upgradepkg  slackpkg-2.82.0-noarch-12_slack14.1.txz

You should be able to use slackpkg to update to the latest patch packages.

Please also read the change logs since there are often important update information in there, which if not followed exactly, could render your system unusable!

mralk3 · 07-21-2015, 05:50 PM

Thanks for the helpful reply. My issue, which as it turns out was not much of an issue, is resolved. For some reason the gpg key you recommended was not the key I was trying to import this morning. I do not remember exactly what I did this morning. I will chalk it up to user error and being a bit sleepy this morning.

I apologize for the waste of time.

drmozes · 07-22-2015, 01:27 AM

Quote:

Originally Posted by mralk3

Thanks for the helpful reply. My issue, which as it turns out was not much of an issue, is resolved. For some reason the gpg key you recommended was not the key I was trying to import this morning. I do not remember exactly what I did this morning. I will chalk it up to user error and being a bit sleepy this morning.

I apologize for the waste of time.

The issue is that if you install 14.1 and then try to use slackpkg to update it, it will fail because the GPG key was replaced _after_ 14.1 was released. There is a newer slackpkg in /patches which uses the new key, and since Slackware only provides updates in /patches (never in the main tree - apart from in one ARMedslack release where the Kernel had a filesystem corruption issue), you first need to manually update slackpkg from /patches.
I am considering replacing the slackpkg in the 14.1 main tree to avoid these sorts of issues. On the other hand, users really should be reading the Change Log and not blindly updating. If you were to blindly update from 14.1 to -current with one of the supported devices (not the community supported devices such as the RPi), you'd end up with a broken system.

We'll make this thread sticky. That should help in the future.

enine · 07-27-2015, 07:07 AM

Also if your time/date is way off it will fail. I see your time stamp on the download:

Quote:

1969-12-31 17:10:42

set the date to the current date or setup time syncing and see if that helps. I had set both my pi's to sync from each other when I intended to sync one from the internet and the other from it and caught it when slackpkg failed.

mralk3 · 07-27-2015, 11:43 AM

Thank you for your reply. I have since fixed this after having difficulty using my raspberry pi due to out of date time. My little RPi is now chugging along and hosting all my Slackware mirrors, as well as seeding all Slackware installation disks.

drmozes · 07-27-2015, 12:01 PM

Quote:

Originally Posted by enine

Also if your time/date is way off it will fail. I see your time stamp on the download:

set the date to the current date or setup time syncing and see if that helps. I had set both my pi's to sync from each other when I intended to sync one from the internet and the other from it and caught it when slackpkg failed.

I've patched slackpkg to abort if the date is not current. I'll upload it with the next change batch in a couple of weeks.

mralk3 · 07-27-2015, 12:05 PM

Quote:

Originally Posted by drmozes

I've patched slackpkg to abort if the date is not current. I'll upload it with the next change batch in a couple of weeks.

That would be great since I updated the date several times and it didn't stay updated. It wasn't until after about the third reboot, firmware upgrade, and kernel upgrade using "rpi-update". A warning message will be helpful from slackpkg.

enine · 07-27-2015, 01:48 PM

Quote:

Originally Posted by mralk3

Thank you for your reply. I have since fixed this after having difficulty using my raspberry pi due to out of date time. My little RPi is now chugging along and hosting all my Slackware mirrors, as well as seeding all Slackware installation disks.

Are you running a slackpkg mirror on yours? I started looking into doing that so i could have one server download all the updates then have the rest get updates from the first. Though at the time I had 4 systems the same, now I have 2 32bit and 2 64bit and two different Pi's and the BBB. I want to get the other two 32bit replaced with 64bit and and am thinking of dropping the Pi(1) and BBB for Rp2's to get those the same as well.

mralk3 · 07-27-2015, 01:59 PM

I have Slackwarearm-14.1, Slackware64-current and Slackware64-14.1 mirrored on my RPi B+. I am using an 8GB internal SD Card for the (full) installation and a 64GB USB stick to store the mirrors. I use these mirrors for quickly updating and installing virtual machines and my two laptops. I plan on setting up a PXE boot service on the RPi in the future. The mirrors are all http mirrors, hosted with Apache.

enine · 07-27-2015, 02:05 PM

When you update each such as the virtual machines. Do they go out to the internet or do they get all the updates from your mirrors?
do you host a torrent of the instal iso's for others to download, are you using a command line BT?

I suppose I'm getting too OT, my mind is still on vacation.

drmozes · 07-27-2015, 02:05 PM

Quote:

Originally Posted by mralk3

That would be great since I updated the date several times and it didn't stay updated. It wasn't until after about the third reboot, firmware upgrade, and kernel upgrade using "rpi-update". A warning message will be helpful from slackpkg.

Unless your system has an RTC (Raspberry Pi's do not without an add-on), it'll never keep the time after a reboot/power cycle.

mralk3 · 07-27-2015, 02:12 PM

Quote:

Originally Posted by enine

When you update each such as the virtual machines. Do they go out to the internet or do they get all the updates from your mirrors?

All the updates are pulled from the mirrors on my raspberry pi. The exception is for multilib stuff that is downloaded from alienbob's multilib repositories.

Quote:

do you host a torrent of the instal iso's for others to download, are you using a command line BT?

I suppose I'm getting too OT, my mind is still on vacation.

I set up rtorrent to download each Slackware ISO and left it seeding after the downloads were finished. It is not a tracker, just a seeder.