Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rabbitmq apks have bad signatures in alpine/latest-stable #555

Open
trappar opened this issue Jan 14, 2021 · 0 comments
Open

rabbitmq apks have bad signatures in alpine/latest-stable #555

trappar opened this issue Jan 14, 2021 · 0 comments

Comments

@trappar
Copy link

trappar commented Jan 14, 2021

I'm getting the following issue when using http://dl-cdn.alpinelinux.org/alpine/latest-stable/main:

Step 7/19 : RUN apk add --allow-untrusted --no-cache --repository http://dl-cdn.alpinelinux.org/alpine/latest-stable/main rabbitmq-c-dev
 ---> Running in e85209db649a
fetch http://dl-cdn.alpinelinux.org/alpine/latest-stable/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.12/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.12/community/x86_64/APKINDEX.tar.gz
(1/6) Installing pkgconf (1.7.3-r0)
(2/6) Installing popt (1.18-r0)
(3/6) Installing popt-dev (1.18-r0)
(4/6) Installing openssl-dev (1.1.1i-r0)
(5/6) Installing rabbitmq-c (0.10.0-r1)
ERROR: rabbitmq-c-0.10.0-r1: BAD signature
(6/6) Installing rabbitmq-c-dev (0.10.0-r1)
ERROR: rabbitmq-c-dev-0.10.0-r1: BAD signature

Switching to http://dl-cdn.alpinelinux.org/alpine/v3.13/main seems to fix the problem:

Step 7/19 : RUN apk add --allow-untrusted --no-cache --repository http://dl-cdn.alpinelinux.org/alpine/v3.13/main rabbitmq-c-dev
 ---> Running in a81d79e58d1d
fetch http://dl-cdn.alpinelinux.org/alpine/v3.13/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.12/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.12/community/x86_64/APKINDEX.tar.gz
(1/6) Installing pkgconf (1.7.3-r0)
(2/6) Installing popt (1.18-r0)
(3/6) Installing popt-dev (1.18-r0)
(4/6) Installing openssl-dev (1.1.1i-r0)
(5/6) Installing rabbitmq-c (0.10.0-r1)
(6/6) Installing rabbitmq-c-dev (0.10.0-r1)

This doesn't seem possible as latest-stable should be the same as 3.13. The indexes here (latest) and here (3.13) shows the same files with the same dates and sizes, that is:

image

But when I actually download both files I get this:

-rw-rw-r-- 1 trappar trappar 37599 Jan 14 11:05 'FROM 3.13 rabbitmq-c-0.10.0-r1.apk'
-rw-rw-r-- 1 trappar trappar 37515 Jan 14 11:06 'FROM latest rabbitmq-c-0.10.0-r1.apk'

As you can see the file from latest has the incorrect size - thus the bad signature.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant