# SLED11SP2 - update repository integrity problem **URL:** \ **Category:** SLED Updates\ **Created:** [October 16, 2012, 1:18pm UTC](https://forums.suse.com/t/sled11sp2-update-repository-integrity-problem/23204 "2012-10-16T13:18:08Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![davidharing](https://avatars.discourse-cdn.com/v4/letter/d/c6cbf5/32.png) [@davidharing](https://forums.suse.com/u/davidharing)\ **Post date:** [October 16, 2012, 1:18pm UTC](https://forums.suse.com/t/sled11sp2-update-repository-integrity-problem/23204/1 "2012-10-16T13:18:08Z")
Hello, I cannot refresh SLED11-SP2-Updates repo anymore… I keep getting warning about possibly corrupt repomd.xml: File repomd.xml from repository SLED11-SP2-Updates [https://nu.novell.com/repo/$RCE/SLED11-SP2-Updates/sle-11-x86\_64?credentials=NCC](https://nu.novell.com/repo/%24RCE/SLED11-SP2-Updates/sle-11-x86_64?credentials=NCC) credentials is signed with the following GnuPG key, but the integrity check failed: ID: E3A5C360307E3D54 Fingerprint: 4E98 E675 19D9 8DC7 362A 5990 E3A5 C360 307E 3D54 Name: SuSE Package Signing Key [build@suse.de](mailto:build@suse.de) Created: 05/04/2010 Expires: 05/03/2014 The file has been changed, either by accident or by an attacker, since the repository creator signed it. Using it is a big risk for the integrity and security of your system. Does anybody experience similiar problems? Thanks… ---
**Author:** ![mikewillis](https://avatars.discourse-cdn.com/v4/letter/m/b2d939/32.png) [@mikewillis](https://forums.suse.com/u/mikewillis)\ **Post date:** [October 16, 2012, 2:47pm UTC](https://forums.suse.com/t/sled11sp2-update-repository-integrity-problem/23204/2 "2012-10-16T14:47:25Z")
Try running ```auto $ zypper clean -a ``` That cleans all cache packages and metadata for all repos. ---
**Author:** ![davidharing](https://avatars.discourse-cdn.com/v4/letter/d/c6cbf5/32.png) [@davidharing](https://forums.suse.com/u/davidharing)\ **Post date:** [October 16, 2012, 3:00pm UTC](https://forums.suse.com/t/sled11sp2-update-repository-integrity-problem/23204/3 "2012-10-16T15:00:40Z")
I have cleaned the cache (zypper clean -a) but the problem persists… ---
**Author:** ![mikewillis](https://avatars.discourse-cdn.com/v4/letter/m/b2d939/32.png) [@mikewillis](https://forums.suse.com/u/mikewillis)\ **Post date:** [October 16, 2012, 4:12pm UTC](https://forums.suse.com/t/sled11sp2-update-repository-integrity-problem/23204/4 "2012-10-16T16:12:14Z")
It turns out I was also getting an error, not exactly the same as yours but related looking and also on SLED11-SP2-Updates. This was with my own copy of the repo. (I maintain a local mirror using Subscription Management Tool.) Having told SMT to re-sync, the error has gone away. So looks like a transient issue that’s been resolved. Are you still seeing a problem? ---
**Author:** ![davidharing](https://avatars.discourse-cdn.com/v4/letter/d/c6cbf5/32.png) [@davidharing](https://forums.suse.com/u/davidharing)\ **Post date:** [October 16, 2012, 4:29pm UTC](https://forums.suse.com/t/sled11sp2-update-repository-integrity-problem/23204/5 "2012-10-16T16:29:50Z")
No change here, still the same error ☹ ---
**Author:** ![marshsupp](https://avatars.discourse-cdn.com/v4/letter/m/b5a626/32.png) [@marshsupp](https://forums.suse.com/u/marshsupp)\ **Post date:** [October 17, 2012, 12:09am UTC](https://forums.suse.com/t/sled11sp2-update-repository-integrity-problem/23204/6 "2012-10-17T00:09:00Z")
I’m having the same issue with the SLES 11 sp2 for VMware update repository: File repomd.xml from repository SLES11-SP2-VMware-Updates [https://nu.novell.com/repo/$RCE/SLES11-SP2-VMware-Updates/sle-11-x86\_64?credentials=NCCcredentials](https://nu.novell.com/repo/%24RCE/SLES11-SP2-VMware-Updates/sle-11-x86_64?credentials=NCCcredentials) is signed with the following GnuPG key, but the integrity check failed: ``` ID: E3A5C360307E3D54 Fingerprint: 4E98 E675 19D9 8DC7 362A 5990 E3A5 C360 307E 3D54 Name: SuSE Package Signing Key Created: 05/04/10 Expires: 05/03/14 This means that the file has been changed by accident or by an attacker since the repository creator signed it. Using it is a big risk for the integrity and security of your system. ``` Tried running “zypper clean -a”, but no change. ---
**Author:** ![davidharing](https://avatars.discourse-cdn.com/v4/letter/d/c6cbf5/32.png) [@davidharing](https://forums.suse.com/u/davidharing)\ **Post date:** [October 17, 2012, 11:00am UTC](https://forums.suse.com/t/sled11sp2-update-repository-integrity-problem/23204/7 "2012-10-17T11:00:47Z")
I have found that in this situation I can refresh the repository with gpk-update: - after cleaning the cache (zypper clean -a) - run gpk-update to check for online updates in configured repos - get popup dialog “Software signature is required” asking whether to trust the source of packages - the GPG key presented is ID E3A5C360307E3D54 with User ID SuSE Package Signing Key [build@suse.de](mailto:build@suse.de), i.e. looks like the same key as before (same fingerprint) - if accepted, the repo gets refreshed and becomes usable _until_ I clean the cache - then I am back at the beginning Strange… ---
**Author:** ![davidharing](https://avatars.discourse-cdn.com/v4/letter/d/c6cbf5/32.png) [@davidharing](https://forums.suse.com/u/davidharing)\ **Post date:** [October 17, 2012, 11:58am UTC](https://forums.suse.com/t/sled11sp2-update-repository-integrity-problem/23204/8 "2012-10-17T11:58:50Z")
Well, after I have checked this morning everything seems to be working OK… Maybe there was some problem with particular repo mirror(s)… I believe akamai CDN is used for delivery of [nu.novell.com](http://nu.novell.com) services… ---
**Author:** ![marshsupp](https://avatars.discourse-cdn.com/v4/letter/m/b5a626/32.png) [@marshsupp](https://forums.suse.com/u/marshsupp)\ **Post date:** [October 17, 2012, 3:01pm UTC](https://forums.suse.com/t/sled11sp2-update-repository-integrity-problem/23204/9 "2012-10-17T15:01:31Z")
> [@davidharing;9541](#): > > Well, after I have checked this morning everything seems to be working OK… Maybe there was some problem with particular repo mirror(s)… I believe akamai CDN is used for delivery of [nu.novell.com](http://nu.novell.com) services… Working for me as well. ---
**Author:** ![guennov](https://avatars.discourse-cdn.com/v4/letter/g/b5e925/32.png) [@guennov](https://forums.suse.com/u/guennov)\ **Post date:** [March 25, 2013, 9:54pm UTC](https://forums.suse.com/t/sled11sp2-update-repository-integrity-problem/23204/10 "2013-03-25T21:54:05Z")
Hi, last week everything worked fine, but since today I’m running into this same problem because of a wrong checksum (2 messages): -1- Die erwartete Prüfsumme der Datei /var/cache/zypp/raw/nu\_novell\_com:SLED11-SP2-Updatesw8EMQZ/repodata/deltainfo.xml.gz ist 952fa47bfd215fc53059ff6000b2e48a2bda429d, aber die aktuelle Prüfsumme ist a4454914bff2e8af99dff7304fa0c903f31f1241. Dies bedeutet, dass die Datei versehentlich oder durch einen Angreifer geändert wurde, seit sie vom Ersteller des Repositorys signiert wurde. Die Verwendung der Datei stellt daher ein hohes Risiko für Integrität und Sicherheit des Systems dar. -2- Fehler bei der Initialisierung des Repository. [|] Keine gültigen Metadaten bei festgelegten URL(s) gefunden Verlauf: - deltainfo.xml.gz has wrong checksum * * * ---
**Author:** ![mikewillis](https://avatars.discourse-cdn.com/v4/letter/m/b2d939/32.png) [@mikewillis](https://forums.suse.com/u/mikewillis)\ **Post date:** [March 26, 2013, 3:15pm UTC](https://forums.suse.com/t/sled11sp2-update-repository-integrity-problem/23204/11 "2013-03-26T15:15:48Z")
[QUOTE=guennov;12595]Hi, last week everything worked fine, but since today I’m running into this same problem because of a wrong checksum (2 messages): -1- Die erwartete Prüfsumme der Datei /var/cache/zypp/raw/nu\_novell\_com:SLED11-SP2-Updatesw8EMQZ/repodata/deltainfo.xml.gz ist 952fa47bfd215fc53059ff6000b2e48a2bda429d, aber die aktuelle Prüfsumme ist a4454914bff2e8af99dff7304fa0c903f31f1241. Dies bedeutet, dass die Datei versehentlich oder durch einen Angreifer geändert wurde, seit sie vom Ersteller des Repositorys signiert wurde. Die Verwendung der Datei stellt daher ein hohes Risiko für Integrität und Sicherheit des Systems dar. -2- Fehler bei der Initialisierung des Repository. [|] Keine gültigen Metadaten bei festgelegten URL(s) gefunden Verlauf: - deltainfo.xml.gz has wrong checksum —[/QUOTE] Try `$ zypper clean -a $ zypper refresh ` clean removes caches of downloaded packages, -a removes repository metadata as well.