Solved The update metadata is correctly signed, but failed an integrity check

I was fairly sure freebsd-update update always used to return the correct patch number at the end. See what it says after the next update.
 
MichaelL said:
I was fairly sure freebsd-update update always used to return the correct patch number at the end. See what it says after the next update.
Click to expand...
Now that you mention this I believe it did. I've been doing source updates more often than anything and would have to double check it. If it still looks off after today's upstream OpenSSL updates hit freebsd-update(8) then it would be worth asking.
 
Is this the same issue with 10.2-RELEASE-p15 and -p16?


Code: 
=============================================================================
FreeBSD-SA-16:17.openssl                                    Security Advisory
                                                          The FreeBSD Project

Topic:          Multiple OpenSSL vulnerabilities

Category:       contrib
Module:         openssl
Announced:      2016-05-04
Credits:        OpenSSL Project
Affects:        All supported versions of FreeBSD.
Corrected:      2016-05-03 18:54:20 UTC (stable/10, 10.3-STABLE)
                2016-05-04 15:25:47 UTC (releng/10.3, 10.3-RELEASE-p2)
                2016-05-04 15:26:23 UTC (releng/10.2, 10.2-RELEASE-p16)

versus


[root@myhost ~]# freebsd-version -ku
10.2-RELEASE-p14
10.2-RELEASE-p15
[root@myhost ~]# freebsd-update fetch
Looking up update.FreeBSD.org mirrors... 4 mirrors found.
Fetching metadata signature for 10.2-RELEASE from update5.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.
Preparing to download files... done.

No updates needed to update system to 10.2-RELEASE-p15.
 
I run into this same issue when trying to upgrade a 10.3 system to 11-RC3:

Code: 
# freebsd-update -r 11.0-RC3 upgrade
Looking up update.FreeBSD.org mirrors... 4 mirrors found.
Fetching metadata signature for 10.3-RELEASE from update6.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.

The following components of FreeBSD seem to be installed:
kernel/generic src/src world/base world/doc

The following components of FreeBSD do not seem to be installed:
world/games world/lib32

Does this look reasonable (y/n)? y

Fetching metadata signature for 11.0-RC3 from update6.freebsd.org... done.
Fetching metadata index... done.

The update metadata is correctly signed, but
failed an integrity check.
Cowardly refusing to proceed any further.
 
I also seem to be running into the same issue, trying to upgrade to 11-RELEASE:

Code: 
# uname -r
10.1-RELEASE-p31
# freebsd-update -r 11.0-RELEASE upgrade
Looking up update.FreeBSD.org mirrors... 4 mirrors found.
Fetching metadata signature for 10.1-RELEASE from update6.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.

The following components of FreeBSD seem to be installed:
kernel/generic src/src world/base world/games world/lib32

The following components of FreeBSD do not seem to be installed:
world/doc

Does this look reasonable (y/n)? y

Fetching metadata signature for 11.0-RELEASE from update6.freebsd.org... done.
Fetching metadata index... done.

The update metadata is correctly signed, but
failed an integrity check.
Cowardly refusing to proceed any further.
 
The trick with your brand-new 10.3-RELEASE box would be to update to 10.3-RELEASE-p10 (or whatever the latest is) and then try the upgrade to 11.0-RELEASE. So the first step is to update 10.3-RELEASE to the latest patch-level before attempt to update to the new wanted release.

Code: 
# freebsd-update fetch install
# freebsd-update upgrade -r 11.0-RELEASE
# freebsd-update install
# shutdown -r now
See as reference: https://www.freebsd.org/releases/11.0R/installation.html#upgrade-binary
 
cpm@ said:
The trick with your brand-new 10.3-RELEASE box would be to update to 10.3-RELEASE-p10 (or whatever the latest is) and then try the upgrade to 11.0-RELEASE. So the first step is to update 10.3-RELEASE to the latest patch-level before attempt to update to the new wanted release.

Code: 
# freebsd-update fetch install
# freebsd-update upgrade -r 11.0-RELEASE
# freebsd-update install
# shutdown -r now
See as reference: https://www.freebsd.org/releases/11.0R/installation.html#upgrade-binary
Click to expand...

I did that three times before I found and replied to this post, and rebooted each time and still get the integrity check fail ...
 
oemb1905 said:
I was forced to update to 10.3 first, then to 11.0. Then, and only then, did it work.
Click to expand...

Yes, this step is applied when FreeBSD is upgraded from one major version to another, like from FreeBSD 9.x to FreeBSD 10.x.
 
oemb1905 said:
I was forced to update to 10.3 first, then to 11.0. Then, and only then, did it work.
Click to expand...

Yep, same here. Could not update an old 10.1 system until I updated to 10.3 first. Course, first I had to spend 20 minutes with my friends at Google trying to figure out why it wasn't working...
 
A bug in freebsd-update(8) is/was the cause of this. Normally you're able to upgrade from any version but the bug prevents this. The only way around it is to update/upgrade to a fixed version first, after that it will work as normal again.

Edit: This is the bug: https://www.freebsd.org/security/advisories/FreeBSD-EN-16:09.freebsd-update.asc

So, if you want to upgrade to 11.0 or 11.1 from 9.x or 10.x you need to make sure you're running the fixed version first (9.3-RELEASE-p45, 10.1-RELEASE-p37, 10.2-RELEASE-p20 or 10.3-RELEASE-p6).
 
I had same issue 'Cowardly refusing to proceed any further.' when tried to update from 10.3-r to 11.2-r. It doesn't work.
Then I updated step by step. First I'm updated system from 10.3 to 11.0 and after this from 11.0 to 11.2
Seems the only way to update from end-of-life versions.
Hope it help.
 
To update several jails without this error occurs, execute like this:

# freebsd-update -d /here/is/the/jail/var/db/freebsd-update/ -b /here/is/the/jail fetch install
 
You must log in or register to reply here.
Back
Top