Troubleshooting Synchronization
Synchronization can fail for a number of reasons. To get more information about a connection problem, run this command:
export URLGRABBER_DEBUG=DEBUG spacewalk-repo-sync -c <channelname> <options> > /var/log/spacewalk-repo-sync-$(date +%F-%R).log 2>&1
You can also check logs created by Zypper at /var/log/zypper.log
- GPG Key Mismatch
-
Uyuni does not automatically trust third party GPG keys. If package synchronization fails, it could be because of an untrusted GPG key. You can find out if this is the case by opening
/var/log/rhn/reposync
and looking for an error like this:['/usr/bin/spacewalk-repo-sync', '--channel', 'sle-12-sp1-ga-desktop- nvidia-driver-x86_64', '--type', 'yum', '--non-interactive'] RepoMDError: Cannot access repository. Maybe repository GPG keys are not imported
To resolve the problem, you need to import the GPG key to Uyuni. For more on importing GPG keys, see Repository Metadata.
- GPG Key Removal from
spacewalk-repo-sync
-
When a GPG key for repository has been manually imported using
spacewalk-repo-sync
, and this key is no longer needed (for example if the the key was compromised, or was used for testing purposes only), it can be removed from the zypper RPM database used byspacewalk-repo-sync
with the following command:rpm --dbpath=/var/lib/spacewalk/reposync/root/var/lib/rpm/ -e gpg-pubkey-*
where
gpg-pubkey-*
is the name of the GPG key to be removed. - Renewing GPG Key
-
If you want to renew a GPG key, first remove the old key, and then generate and import a new one.
- Checksum Mismatch
-
If a checksum has failed, you might see an error like this in the
/var/log/rhn/reposync/*.log
log file:Repo Sync Errors: (50, u'checksums did not match 326a904c2fbd7a0e20033c87fc84ebba6b24d937 vs afd8c60d7908b2b0e2d95ad0b333920aea9892eb', 'Invalid information uploaded to the server') The package microcode_ctl-1.17-102.57.62.1.x86_64 which is referenced by patch microcode_ctl-8413 was not found in the database. This patch has been skipped.
You can resolve this error by running the synchronization from the command prompt with the
-Y
option:spacewalk-repo-sync --channel <channelname> -Y
This option verifies the repository data before the synchronization, rather than relying on locally cached checksums.
- Connection Timeout
-
If the download times out with the following error:
28, 'Operation too slow. Less than 1000 bytes/sec transferred the last 300 seconds
You can resolve this error by specifying
reposync_timeout
andreposync_minrate
configuration values in/etc/rhn/rhn.conf
. By default, when less than 1000 bytes per second are transferred in 300 secs, the download is aborted. You can adjust the number of bytes per second withreposync_minrate
, and the number of seconds to wait withreposync_timeout
. - Manually Trusting the Key During reposync
-
It is possible that in some cases when
reposync
is run, you may need to accept the GPG key manually. For example:# spacewalk-repo-sync -c nvidia-compute-sle-15-x86_64-we-sp3 17:07:40 ====================================== 17:07:40 | Channel: nvidia-compute-sle-15-x86_64-we-sp3 17:07:40 ====================================== 17:07:40 Sync of channel started. New repository or package signing key received: Repository: nvidia-compute-sle-15-x86_64-we-sp3 Key Fingerprint: 610C 7B14 E068 A878 070D A4E9 9CD0 A493 D42D 0685 Key Name: cudatools <cudatools@nvidia.com> Key Algorithm: RSA 4096 Key Created: Thu Apr 14 16:04:01 2022 Key Expires: (does not expire) Rpm Name: gpg-pubkey-d42d0685-62589a51 Note: Signing data enables the recipient to verify that no modifications occurred after the data were signed. Accepting data with no, wrong or unknown signature can lead to a corrupted system and in extreme cases even to a system compromise. Note: A GPG pubkey is clearly identified by its fingerprint. Do not rely on the key's name. If you are not sure whether the presented key is authentic, ask the repository provider or check their web site. Many providers maintain a web page showing the fingerprints of the GPG keys they are using. Do you want to reject the key, trust temporarily, or trust always? [r/t/a/?] (r):