On 21/10/14 15:21, Debian Bug Tracking System wrote: > Thank you for filing a new Bug report with Debian. > > This is an automatically generated reply to let you know your message > has been received. > > Your message is being forwarded to the package maintainers and other > interested parties for their attention; they will reply in due course. > > As you requested using X-Debbugs-CC, your message was also forwarded to > [email protected] > (after having been given a Bug report number, if it did not have one). > > Your message has been sent to the package maintainer(s): > APT Development Team <[email protected]> > > If you wish to submit further information on this problem, please > send it to [email protected]. > > Please do not send mail to [email protected] unless you wish > to report a problem with the Bug-tracking system. > The IRC log may be relevant in terms of how confusing this can be. Please delete if irrelevant. Thanks.
[ Skip 10min+ session previous day ] [13:59] <toad_> has security support been discontinued for 32-bit i386 ? security.debian.org is still giving 404's on apt-get update [13:59] <toad_> and the updated packages are still not on the mirrors [14:03] <jmlongo> are you on wheezy? [14:03] <toad_> yes [14:03] <toad_> 7.7 [14:04] <jmlongo> I just did an apt-get update and got -> "Des: 6 http://security.debian.org wheezy/updates/main i386 Packages [229 kB] " [14:05] <toad_> jmlongo: I get "Err http://security.debian.org wheezy/updates/main i386 Packages \n 404 Not Found [IP: 195.20.242.89 80]" [14:06] <toad_> jmlongo: yesterday the IP address was different (212.*?) so AFAICS it's not just one server [14:08] <toad_> ideas? [14:08] <toad_> I guess I need to contact the security team directly ... [14:08] <toad_> it's been at least TWO DAYS [14:12] <petn-randall> toad_: Yes, s.d.o resolves to 2 IPv4 addresses, and one IPv6 one, so that's expected. [14:14] <toad_> petn-randall: what is expected? critical bugs that can't be fixed because critical server is broken for two days on a common architecture? [14:15] <petn-randall> toad_: No, that it resolves to two different IP addresses. [14:15] <toad_> the fact that it gives the same errors on both IPv4 addresses might indicate that the problem isn't with one server, but somewhere else ... [14:15] <toad_> yes ok [14:15] <toad_> so I should email security@? [14:16] <petn-randall> !tell toad_ -about squeeze lts [14:16] <petn-randall> toad_: Check the factoid first. [14:16] <toad_> I'm using wheezy! [14:17] <toad_> so there's nothing else I should check? [14:18] <petn-randall> toad_: Can you show us the full output of 'apt-get update' on http://paste.debian.net? [14:18] <petn-randall> toad_: Sorry about the squeeze/wheezy mixup, read it wrong. Which update are you missing in particular? [14:19] <toad_> http://paste.debian.net/127901/ [14:20] <toad_> it doesn't get the recent mysql stuff [14:20] <petn-randall> toad_: Can you also paste your /etc/apt/sources.list? [14:20] <toad_> it's all still at 5.5.38-0+wheezy1 even after apt-get dist-upgrade says there's nothing to do [14:21] <toad_> http://paste.debian.net/127902/ [14:21] <toad_> it still breaks if i turn off contrib non-free in the security line [14:21] * toad_ tries commenting out deb-multimedia [14:22] --> Slydder has joined this channel ([email protected]). [14:23] <toad_> hmmm, i wonder if there could be a symlink missing? should i try stable rather than wheezy? [14:25] <toad_> http://security.debian.org/dists/wheezy/updates/main/binary-i386/ [14:25] <peter1138> deb http://security.debian.org/ wheezy/updates main contrib non-free [14:25] <peter1138> works for me [14:25] <toad_> the log says it's trying to fetch the uncompressed package file ... surely that's a lie? [14:26] <toad_> W: Failed to fetch http://security.debian.org/dists/wheezy/updates/main/binary-i386/Packages 404 Not Found [IP: 195.20.242.89 80] [14:26] <toad_> of course Packages doesn't exist ... we want Packages.bz2 or Packages.gz [14:26] <toad_> but maybe it's lying about the url? [14:27] <toad_> why would it try to fetch the uncompressed file? [14:27] <peter1138> Yes it always says just Release [14:28] <peter1138> (Or Packages) [14:29] <toad_> hmmm [14:29] <toad_> but if i wget the .bz2 file from the same box, it downloads it successfully [14:30] <toad_> how do i splice the packages file in manually? in /var/somewhere? [14:31] <toad_> can i just put it in /var/lib/apt/lists/ ? [14:32] * rfreeman-w eyes toad_ [14:33] <rfreeman-w> wget http://security.debian.org/dists/wheezy/updates/main/binary-i386/Packages 2014-10-21 15:33:23 ERROR 404: Not Found [14:33] <jmlongo> well .. If I use that ip of yours on my sources lists it gives me the 404 error .. [14:33] <toad_> yay, it workked [14:34] <toad_> rfreeman-w: yeah, it lies about the URL that it's fetching [14:34] <rfreeman-w> toad_, you should never have to bypass apt-get/aptitude and install things manually by grabbing tarball [14:34] <toad_> agreed, but it won't install security updates! [14:34] <toad_> for two days running! [14:34] <rfreeman-w> if you have to then something is wrong and it is not safe as it bypasses apt-get gpg [14:34] <toad_> not installing the update isn't safe either ... and aren't the individual packages signed? [14:34] <rfreeman-w> did you just installed not gpg verified update package though? I hope it's not the devel box ;) I would not [14:35] <toad_> the Release is signed [14:35] <toad_> there are no warnings [14:35] <jmlongo> how about changing security.debian.org with 200.17.202.197?? [14:35] <toad_> so no, i didn't have to tell apt-get dist-upgrade to install unsigned packages [14:35] <rfreeman-w> if something is really broken I'm quite sure guys in #debian-security will look into it [14:35] <toad_> yes, I have emailed them :( [14:36] <toad_> I had expected it would be fixed in two days, but it wasn't ... but it's possible it's some obscure property of my system that I don't understand ... [14:36] <toad_> w.r.t. security, IIRC the signatures are checked at apt-get dist-upgrade time - I've always got errors in the past at that point - isn't this correct? [14:36] <rfreeman-w> I'm not 100% sure, but afair apt-get update chancks them and then remembers which checksums to expect [14:37] <weasel> toad_: find /var/lib/apt -type f -exec rm {} \+ [14:37] <weasel> toad_: apt-get update [14:37] <toad_> I 100% agree that this should never be necessary though ... :( [14:37] <weasel> does it work now? [14:37] <weasel> erm [14:37] <weasel> find /var/lib/apt/lists [14:37] <weasel> the lists is important [14:38] <rfreeman-w> toad_, next time just paste to IRC/freenet/etc the checksum of file you downloaded before installing it - that way at least we can check in retrospection, so it takes just 3 seconds more to be "paranoid" :) [14:38] <toad_> :) [14:39] <toad_> hmmm ... so you can get a 404 error as the result of having a stale file in lists/partial ?! WTF?! [14:39] <rfreeman-w> toad_, #debian-security tells to append .gz or .bz2 to end of URL, indeed it works with the .bz [14:39] <toad_> oh, because it's doing a partial fetch, and it's unclean? isn't there a different error code for that though?! [14:39] <rfreeman-w> .gz [14:39] <toad_> yeah, I got that bit [14:40] <toad_> I downloaded it and unpacked it and stuck it in lists/ and it worked fine [14:40] <toad_> however it sounds like the sigs weren't checked as a result? [14:40] <weasel> toad_: that 404 is just a horrible error message. [14:40] <toad_> yep [14:41] <weasel> toad_: apt tries Packages.bz2, falls over for some reason. tries Packages.gz, falls over for some reason. tries Packages, oh that doesn't exist. reports last error. -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
