Bug 7566 - "SHA1 verification failed" for sa-update.razx.cloud since 1-2 weeks
Summary: "SHA1 verification failed" for sa-update.razx.cloud since 1-2 weeks
Status: RESOLVED FIXED
Alias: None
Product: Spamassassin
Classification: Unclassified
Component: sa-update (show other bugs)
Version: 3.4.1
Hardware: PC All
: P2 normal
Target Milestone: Undefined
Assignee: Dave Jones
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-03-19 10:02 UTC by Larsen
Modified: 2018-03-22 16:56 UTC (History)
3 users (show)


Attachment Type Modified Status Actions Submitter/CLA Status
debug log text/plain None Larsen [NoCLA]
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Larsen 2018-03-19 10:02:31 UTC 
Created attachment 5560 [details]
debug log

I got this error from several servers starting 1-2 weeks ago:

/etc/cron.daily/60sa-update:
channel: SHA1 verification failed, channel failed
run-parts: /etc/cron.daily/60sa-update exited with return code 4

It's always the same mirror http://sa-update.razx.cloud that fails.

sa-update is run by cron. I have attached the debug log.

Using SpamAsassin 3.4.1-6~bpo8+1 on Debian Jessie with Plesk 17.8.11 (possibly also on servers not using Plesk).
Comment 1 Kevin A. McGrail 2018-03-19 12:45:25 UTC 
Thanks for the report.

That is a real mirror and that debug is the correct sha1 it is looking for which it is failing.

Grabbing the file manually, sa-update.razx.cloud/1827131.tar.gz is wrong.

Checking manually: 1f5ebe36fc3f4cf9c87146fc19cfa56f7287fced  1827131.tar.gz

Right:
-rw-r--r-- 1 9997 9997 276361 Mar 18 22:43 1827131.tar.gz

Wrong:
-rw-r--r-- 1 root root 210712 Mar 18 04:31 1827131.tar.gz

Dave, we need to take razx out of the mirror list and identify how they are getting truncated / corrupted files. 

The good news is that our safety valves prevented a bad installation of rules

Thanks, KAM
Comment 2 Dave Jones 2018-03-19 13:26:28 UTC 
I guess I can add logic to our hourly script to check sha1 values on the latest tar.gz to catch rsync'ing issues.
Comment 3 Kevin A. McGrail 2018-03-19 13:56:17 UTC 
I can't see the value of a check of that. This is an rsync/ssh issue and something is massively odd.  Perhaps the server is out of space and truncating?
Comment 4 Dave Jones 2018-03-19 14:02:16 UTC 
Sure.  It's very odd but I would like to know about it as soon as the problem shows up rather than have errors in sa-update logs and relying on someone to open a bug like this before we know about it.

If we know about it as soon as it starts, that helps tshoot the problem by correlating with other known issues on that server like low disk space.
Comment 5 Kevin A. McGrail 2018-03-19 16:20:20 UTC 
(In reply to Dave Jones from comment #4)
> Sure.  It's very odd but I would like to know about it as soon as the
> problem shows up rather than have errors in sa-update logs and relying on
> someone to open a bug like this before we know about it.
> 
> If we know about it as soon as it starts, that helps tshoot the problem by
> correlating with other known issues on that server like low disk space.

Agreed just in decades of running sa-update, this is the single case we know of and re-running will resolve the issue with randomness.  Just trying to be aware of your finite amount of time.
Comment 6 Dave Jones 2018-03-19 20:46:37 UTC 
Dave Warren found a caching issue and should have this resolved.  I have added back his mirror.
Comment 7 Larsen 2018-03-22 16:56:39 UTC 
I didn't notice any further errors since then.