CentOS AH update: error: No detached metadata found for GPG verification

[dmartinpro]

I'm facing this error when trying to upgrade an Atomic host.
Current Centos Atomic host version is:
Deployments:

• centos-atomic-host:centos-atomic-host/7/x86_64/standard
  Version: 7.20170209 (2017-02-10 00:54:47)
  Commit: d433342b09673c9c4d75ff6eef50a447e73a7541491e5197e1dde14147b164b8
  OSName: centos-atomic-host

Any clue?

[miabbott]

I'm able to reproduce this with a Vagrant box.

I started with version 7.20161006 then deployed to 7.20170209. Then tried an ostree pull with HTTP debugging.

# atomic host status
State: idle
Deployments:
● centos-atomic-host:centos-atomic-host/7/x86_64/standard
       Version: 7.20170209 (2017-02-10 00:54:47)
        Commit: d433342b09673c9c4d75ff6eef50a447e73a7541491e5197e1dde14147b164b8
        OSName: centos-atomic-host
  GPGSignature: 1 signature
                Signature made Fri 10 Feb 2017 01:06:18 AM UTC using RSA key ID F17E745691BA8335
                Good signature from "CentOS Atomic SIG <[email protected]>"

  centos-atomic-host:centos-atomic-host/7/x86_64/standard
       Version: 7.20161006 (2016-10-05 23:28:52)
        Commit: 2ad34dba5286d69de71b61678d5190b246e7836beada3cdfa18f7bfa4ae3c3f0
        OSName: centos-atomic-host
  GPGSignature: 1 signature
                Signature made Wed 05 Oct 2016 11:39:15 PM UTC using RSA key ID F17E745691BA8335
                Good signature from "CentOS Atomic SIG <[email protected]>"
-bash-4.2# ostree remote list -u
centos-atomic-host  http://mirror.centos.org/centos/7/atomic/x86_64/repo
-bash-4.2# env OSTREE_DEBUG_HTTP=1 ostree pull centos-atomic-host:centos-atomic-host/7/x86_64/standard

> GET /centos/7/atomic/x86_64/repo/config HTTP/1.1
> Soup-Debug-Timestamp: 1490120894
> Soup-Debug: SoupSessionAsync 1 (0x7f15d8008160), SoupMessage 1 (0x7f15d81e00d0), SoupSocket 1 (0x7f15d8002120)
> Host: mirror.centos.org
> User-Agent: ostree libsoup/2.48.1
> Connection: Keep-Alive
  
< HTTP/1.1 200 OK
< Soup-Debug-Timestamp: 1490120894
< Soup-Debug: SoupMessage 1 (0x7f15d81e00d0)
< Date: Tue, 21 Mar 2017 18:28:13 GMT
< Server: Apache/2.4.6 (CentOS)
< Last-Modified: Mon, 13 Mar 2017 21:02:37 GMT
< ETag: "8f-54aa307f25540"
< Accept-Ranges: bytes
< Content-Length: 143
< Keep-Alive: timeout=5, max=100
< Connection: Keep-Alive
< 
  
> GET /centos/7/atomic/x86_64/repo/summary.sig HTTP/1.1
> Soup-Debug-Timestamp: 1490120894
> Soup-Debug: SoupSessionAsync 1 (0x7f15d8008160), SoupMessage 2 (0x7f15d81e02b0), SoupSocket 1 (0x7f15d8002120)
> Host: mirror.centos.org
> User-Agent: ostree libsoup/2.48.1
> Connection: Keep-Alive
  
< HTTP/1.1 404 Not Found
< Soup-Debug-Timestamp: 1490120894
< Soup-Debug: SoupMessage 2 (0x7f15d81e02b0)
< Date: Tue, 21 Mar 2017 18:28:13 GMT
< Server: Apache/2.4.6 (CentOS)
< Content-Length: 237
< Keep-Alive: timeout=5, max=99
< Connection: Keep-Alive
< Content-Type: text/html; charset=iso-8859-1
  
> GET /centos/7/atomic/x86_64/repo/summary HTTP/1.1
> Soup-Debug-Timestamp: 1490120894
> Soup-Debug: SoupSessionAsync 1 (0x7f15d8008160), SoupMessage 3 (0x7f15d81e0490), SoupSocket 2 (0x126e670)
> Host: mirror.centos.org
> User-Agent: ostree libsoup/2.48.1
> Connection: Keep-Alive
  
< HTTP/1.1 200 OK
< Soup-Debug-Timestamp: 1490120894
< Soup-Debug: SoupMessage 3 (0x7f15d81e0490)
< Date: Tue, 21 Mar 2017 18:28:13 GMT
< Server: Apache/2.4.6 (CentOS)
< Last-Modified: Mon, 13 Mar 2017 21:25:38 GMT
< ETag: "127-54aa35a42b880"
< Accept-Ranges: bytes
< Content-Length: 295
< Keep-Alive: timeout=5, max=100
< Connection: Keep-Alive
< 
  
> GET /centos/7/atomic/x86_64/repo/deltas/1D/M0KwlnPJxNdf9u71CkR+c6dUFJHlGX4d3hQUexZLg-hB+uUeW2hxapmW3b205UOFW7+rnG5MtDMmeyTkHou8E/superblock HTTP/1.1
> Soup-Debug-Timestamp: 1490120894
> Soup-Debug: SoupSessionAsync 1 (0x7f15d8008290), SoupMessage 1 (0x7f15d81e00d0), SoupSocket 1 (0x7f15d8002390)
> Host: mirror.centos.org
> User-Agent: ostree libsoup/2.48.1
> Connection: Keep-Alive
  
< HTTP/1.1 200 OK
< Soup-Debug-Timestamp: 1490120894
< Soup-Debug: SoupMessage 1 (0x7f15d81e00d0)
< Date: Tue, 21 Mar 2017 18:28:13 GMT
< Server: Apache/2.4.6 (CentOS)
< Last-Modified: Mon, 13 Mar 2017 21:25:38 GMT
< ETag: "25e87-54aa35a42b880"
< Accept-Ranges: bytes
< Content-Length: 155271
< Keep-Alive: timeout=5, max=100
< Connection: Keep-Alive
< 
  
> GET /centos/7/atomic/x86_64/repo/objects/5a/98b8ff87848dcdd3716797d116739d3683631c26bc743b800a87c1059b6c06.filez HTTP/1.1
> Soup-Debug-Timestamp: 1490120894
> Soup-Debug: SoupSessionAsync 1 (0x7f15d8008290), SoupMessage 2 (0x7f15d81e0490), SoupSocket 1 (0x7f15d8002390)
> Host: mirror.centos.org
> User-Agent: ostree libsoup/2.48.1
> Connection: Keep-Alive
  

error: No detached metadata found for GPG verification

My remote config looks pretty standard

# cat /etc/ostree/remotes.d/centos-atomic-host.conf 
[remote "centos-atomic-host"]
url=http://mirror.centos.org/centos/7/atomic/x86_64/repo
branches=centos-atomic-host/7/x86_64/standard;
gpg-verify=true

[cgwalters]

Reproduced too. It's specific to upgrading from d433342b09673c9c4d75ff6eef50a447e73a7541491e5197e1dde14147b164b8.

I think this is because the delta from d433342b09673c9c4d75ff6eef50a447e73a7541491e5197e1dde14147b164b8 ➡️ 841fae51e5b68716a9996ddbdb4e543855bbfab9c6e4cb433267b24e41e8bbc1 doesn't contain the GPG signature.

It should be easy to fix on their side, just regenerating the delta. I'll ping the CentOS guys.

In the meantime, you can work around this client side by doing a non-delta pull:

# ostree pull --disable-static-deltas centos-atomic-host:centos-atomic-host/7/x86_64/standard

[cgwalters]

See CentOS/sig-atomic-buildscripts#259

[dmartinpro]

I'm still facing the exact same issue from 7.20170309

[cgwalters]

Let's discuss in CentOS/sig-atomic-buildscripts#259 - I don't think there are any ostree bugs here, it's a bug in the CentOS AH ostree repo.