Upgrades... sha1 mismatch

Scion · July 21, 2021, 3:07pm

The fact that Zulu was the only upgrade out of 80 that failed is a relief as I do not use Zulu.

The interesting thing about this is in years of working I have never seen this after a : fwconsole ma upgradeall

Considering I don’t use Zulu, I don’t really care about the fact it cant update.

It the why that confounds me. Why did this sha1 not match? Is this a common thing?

Thanks…

mbrooks · July 21, 2021, 3:18pm

@Scion This will happen if the download was incomplete or corrupted. From the looks of your screenshot, the sha1 check may have happened before the download was completed. My question is if this is repeatable? Does it happen every time you try to upgrade zulu?

Scion · July 21, 2021, 4:06pm

Absolutely, every time.

mbrooks · July 21, 2021, 4:52pm

There is probably a fwconsole command to do this, but I would try to remove the zulu module from the cache directory /var/www/html/admin/modules/_cache/ and retry.

Example:
rm /var/www/html/admin/modules/_cache/zulu-15.0.58.12.tgz.gpg

Scion · July 21, 2021, 5:32pm

Thank you very much!

Here is the content of the directory. I notice the owner of the most recent is root instead of asterisk, interesting.

So, just blow all of those Zulu files away and try again?

mbrooks · July 21, 2021, 7:13pm

@Scion interesting. I imagine the root owner may come from running fwconsole as root and the asterisk ownership probably comes from running it in the GUI.

But yes, it should be safe to blow those files away and retry.

Scion · July 22, 2021, 12:29am

So… Interesting.

I had to upgrade a COMPLETELY DIFFERENT PBX tonight because of fax issues (another story) and the same thing happened when it hit Zulu from fwconsole ma upgradeall from CLI.

Perhaps this is a colossal coincidence?

adell4444 · July 22, 2021, 12:37am

Same network?

Scion · July 22, 2021, 3:34am

Nope. Separate VULTR cloud hosted instance. Not really surprising, isn’t Zulu dying on the vine?

Scion · July 22, 2021, 3:55am

I’m going to go out on a limb here. I host many, many, of these in the cloud. I bet this would occur on at least 90% if I ran that command from CLI at this point. BUT! The good news is, Zulu and I had a great battle in the past and I have moved on. I have not tried to delete the cached files yet because, I simply don’t care. I just hope this isn’t a issue for Zulu reliant folks.

philsum · July 22, 2021, 3:57pm

I’m having exactly the same issue - SHA1 signature failure on latest offered zulu module, but like you, we don’t use it…so not too worried.

sorvani · July 23, 2021, 6:58pm

You would be correct, but that is 100% not the problem with a SHA verification. Because I only ever upgrade from the command line with fwconsole and have never had this problem, ever.

The reason all of the rest of them are asterisk? because sudo fwconsole chown

This is how I upgrade systems (except when I am proving a point like now).

github.com

sorvani/freepbx-helper-scripts/blob/master/InitialSetup/update.sh

#!/bin/bash
logdate=`date +"%Y%m%d-%H%M%S"`
logfile=upgrade-$logdate.log
printf "Beginning update of FreePBX 15...\n" | tee -a $logfile
if [ "$EUID" -ne 0 ]
  then printf "This script must be executed with sudo. Please run again: sudo ./update.sh\n" | tee -a $logfile
  exit
fi

printf "Updating operating system.\n" | tee -a $logfile
printf "This can take a seemingly excessive amount of time depending on\n" | tee -a $logfile
printf "how many Linux updates have been released since the last update.\n" | tee -a $logfile
yum update -y | tee -a $logfile

printf "Upgrading all installed modules...\n" | tee -a $logfile
printf "This can also take a seemingly excessive amount of time depending on\n" | tee -a $logfile
printf "how many module updates have been released since the update.\n" | tee -a $logfile
fwconsole ma upgradeall 2> /dev/null >> $logfile

printf "Updating all permissions...\n" | tee -a $logfile

This file has been truncated. show original

I chown always after upgrades, because history.

Here is what the script output earlier this month when I ran upgrades.

https://pastebin.freepbx.org/view/ed975aef

sorvani · July 23, 2021, 7:03pm

The problem did not exist on June 29, 2021.

https://pastebin.freepbx.org/view/8032e4ec

sorvani · July 23, 2021, 7:13pm

System that never had Zulu.

jfinstrom · July 23, 2021, 7:24pm

When I experience an issue, rather than making assumptions I RTFM. If there is no friendly manual I RTFC…

github.com

FreePBX/framework/blob/4267c043877a29528b93c9f7c36277ed36ced7d4/amp_conf/htdocs/admin/libraries/modulefunctions.class.php#L1523


		fwrite($fp,$filedata);
		fclose($dp);
		fclose($fp);




		if (is_readable($filename) !== TRUE ) {
			return array(sprintf(_('Unable to save %s'),$filename));
		}


		if(!empty($modulexml['signed']['type']) && $modulexml['signed']['type'] == 'gpg') {
				if($modulexml['signed']['sha1'] != sha1_file($filename)) {
						return array(sprintf(_('File Integrity failed for %s - aborting (sha1 did not match)'), $filename));
				}
				try {
					if(!FreePBX::GPG()->trustFreePBX()) {
						return array(sprintf(_('Cant Verify downloaded module %s. Unable to trust GPG Key - aborting (Cause: No Cause Given)'), $filename));
					}
				}catch(\Exception $e) {
					return array(sprintf(_('Cant Verify downloaded module %s. Unable to trust GPG Key - aborting (Cause: %s)'), $filename, $e->getMessage()));
				}
				try {

A quick look at the friendly code we see the module xml from the mirror has an entry

<signed>
	<type>gpg</type>
	<sha1>443de78921edf2a06bb6d0885cbdb6cdab07f28e</sha1>
</signed>

So if we pull down the file:

<location>packages/zulu/5.6/zulu-14.0.58.10.tgz.gpg</location>

and run sha1sum zulu-14.0.58.10.tgz.gpg
we should get the same sha1 sum…

if not well the file is bad or the sum is…

Scion · July 23, 2021, 9:36pm

Sum times things just go wrong…

billsimon · July 24, 2021, 12:33am

New install,

 - File Integrity failed for /var/www/html/admin/modules/_cache/zulu-15.0.58.12.tgz.gpg - aborting (sha1 did not match)

It looks like the most recent version that will pass validity check and install is 15.0.58.10:

fwconsole ma upgrade zulu --tag 15.0.58.10

lgaetz · July 26, 2021, 12:48pm

Just did a test by running this on a 15 system:

fwconsole ma downloadinstall zulu --tag 15.0.58.12

module installed without issue. Is this resolved now, or are there people still seeing ths?

lncjohn · July 26, 2021, 3:01pm

Within the last 10 minutes I ran

fwconsole ma upgradeall

and got the sha1 error. I found this thread and tried

fwconsole ma downloadinstall zulu --tag 15.0.58.12

and it worked.

ivana72 · July 26, 2021, 3:26pm

correct, it is still happening on all systems. I’m also using the --tag to fix that.