Update signature not verified (CU189 - 23/10/24))

Been getting this error on a IPFire install for over 12 hours now:

Oct 23 01:58:53 rb pakfire: PAKFIRE INFO: IPFire Pakfire 2.29-x86_64 started!
Oct 23 01:58:53 rb pakfire: CORE INFO: Checking for Core-Updates...
Oct 23 01:58:53 rb pakfire: CORE INFO: core-list.db is 2015 seconds old. - DEBUG: noforce
Oct 23 01:58:53 rb pakfire: CORE UPGR: Upgrading from release 187 to 189
Oct 23 01:58:53 rb pakfire: DOWNLOAD STARTED: paks/core-upgrade-2.29-189.ipfire
Oct 23 01:58:53 rb pakfire: MIRROR INFO: 22 servers found in list
Oct 23 01:58:53 rb pakfire: DOWNLOAD INFO: Host: mirror1.ipfire.org (HTTPS) - File: pakfire2/2.29-x86_64/paks/core-upgrade-2.29-189.ipfire
Oct 23 01:58:53 rb pakfire: DOWNLOAD INFO: pakfire2/2.29-x86_64/paks/core-upgrade-2.29-189.ipfire has size of 120402975 bytes
Oct 23 01:58:58 rb pakfire: DOWNLOAD INFO: HTTP-Status-Code: 200 - 200 OK
Oct 23 01:58:59 rb pakfire: DOWNLOAD INFO: File received. Start checking signature...
Oct 23 01:59:00 rb pakfire: DOWNLOAD ERROR: The downloaded file (pakfire2/2.29-x86_64/paks/core-upgrade-2.29-189.ipfire) wasn't verified by IPFire.org. Sorry - Exiting...
Oct 23 01:59:01 rb pakfire: TIME INFO: Time Server 85.199.214.102 has -0.194280 sec offset to localtime.
Oct 23 01:59:01 rb pakfire: PAKFIRE INFO: Pakfire has finished. Closing.

Playing the waiting game has gotten boring - can someone give the server the attention it so desperately craves…

homer-poke

EDIT: Same result when using the commandline:

Troubleshooting options…?

1 Like

This is saying to me that the time being checked by pakfire from an external time source has an offset to the time on your IPFire system. You need to check your time server settings and operation because it looks like your IPfire time server has the wrong time and if the delta is too large then pakfire cannot do the decryption check of the downloaded packages.

1 Like

The decrypting process is a bit complex. There are some conditions for a fail.
Because mostly the reason is a wrong time, the error message is logged.
But a difference of -0.194280 should be negligible. There must be another reason for the failing.

Yes, based on your comment and the fact the progress seemed to always stall just over 90%… it gave me a theory.

For background, the IPFire instance is working in a VM as a firewall between internal LAN and a ‘secured’ LAN segment.
Due to the thin amount of firewall rules and no additional pakfire apps installed, it runs / ran with under 1GB RAM allocated.

After changing the allocation to 1GB the update completed…

So it would seem not enough RAM to complete an update action was the issue - I don’t want to say ‘low RAM’ as IPFire can work as a firewall and routing traffic quite easily with just 500MB RAM.

So… my fault I guess - not that the error messages helped out much.

1 Like

You remembered me at times, when I saw these message very often.
The lifetime of my ALIX based IPFire.
I think to remember, that IPFire tries to put the decrypted file in RAM, maybe even an array in the pakfire program. This can function if you stop all memory consuming processes.
For a smooth update 1GB is recommended.

I’ve added a remark in the system requirements.