Summary 1. wget fails to download a patch 2. wget succeeds in downloading the associated readme 3. contents of /.wgetrc 4. pca --supplevel gets stuck at "Resolving support.oracle.com... 141.146.54.16
Note that I *can* manually download patches from MOS by logging in to the web site; that means at least my support contract is still valid. Apologies for the voluminous output; that debug switch comes in handy. # /usr/sfw/bin/wget --debug --no-check-certificate --execute https_proxy=proxy "https://getupdates.oracle.com/all_unsigned/146808-01.zip"; -O 146808-01.zip --http-user=MOS_user --http-passwd=MOS_password Setting --check-certificate (checkcertificate) to 0 Setting https_proxy (httpsproxy) to proxy Setting --output-document (outputdocument) to 146808-01.zip Setting --http-user (httpuser) to MOS_user Setting --http-passwd (httppassword) to MOS_password DEBUG output created by Wget 1.12 on solaris2.10. --2011-03-17 08:27:40-- https://getupdates.oracle.com/all_unsigned/146808-01.zip Host `getupdates.oracle.com' has not issued a general basic challenge. Resolving proxy... proxy_IP Caching proxy => proxy_IP Connecting to proxy | proxy_IP|:80... connected. Created socket 5. Releasing 0x00087e98 (new refcount 1). ---request begin--- CONNECT getupdates.oracle.com:443 HTTP/1.0 User-Agent: Wget/1.12 (solaris2.10) Proxy-Authorization: Basic bm9ydGhncnVtXHMxMDIwNzE6VFNONGFsbC4= ---request end--- proxy responded with: [HTTP/1.1 200 Connection established ] Initiating SSL handshake. Handshake successful; connected socket 5 to SSL handle 0x000954c0 certificate: subject: /C=US/ST=California/L=Redwood Shores/O=Oracle Corporation/OU=Global IT/OU=Terms of use at www.verisign.com/rpa (c)10/CN=*.oracle.com issuer: /O=VeriSign Trust Network/OU=VeriSign, Inc./OU=VeriSign International Server CA - Class 3/OU=www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign WARNING: cannot verify getupdates.oracle.com's certificate, issued by `/O=VeriSign Trust Network/OU=VeriSign, Inc./OU=VeriSign International Server CA - Class 3/OU=www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign': Unable to locally verify the issuer's authority. ---request begin--- GET /all_unsigned/146808-01.zip HTTP/1.0 User-Agent: Wget/1.12 (solaris2.10) Accept: */* Host: getupdates.oracle.com ---request end--- Proxy request sent, awaiting response... ---response begin--- HTTP/1.1 401 Unauthorized Date: Thu, 17 Mar 2011 15:27:40 GMT Server: Oracle-iPlanet-Web-Server/7.0 Www-authenticate: Basic realm="Sun Update Connection Download Server" Content-length: 223 Content-type: text/html Connection: close Content-Language: en ---response end--- 401 Unauthorized Closed 5/SSL 0x000954c0 Inserted `getupdates.oracle.com' into basic_authed_hosts Found proxy in host_name_addresses_map (87e98) Connecting to proxy | proxy_IP|:80... connected. Created socket 5. Releasing 0x00087e98 (new refcount 1). ---request begin--- CONNECT getupdates.oracle.com:443 HTTP/1.0 User-Agent: Wget/1.12 (solaris2.10) Proxy-Authorization: Basic bm9ydGhncnVtXHMxMDIwNzE6VFNONGFsbC4= ---request end--- proxy responded with: [HTTP/1.1 200 Connection established ] Initiating SSL handshake. Handshake successful; connected socket 5 to SSL handle 0x000a8ec0 certificate: subject: /C=US/ST=California/L=Redwood Shores/O=Oracle Corporation/OU=Global IT/OU=Terms of use at www.verisign.com/rpa (c)10/CN=*.oracle.com issuer: /O=VeriSign Trust Network/OU=VeriSign, Inc./OU=VeriSign International Server CA - Class 3/OU=www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign WARNING: cannot verify getupdates.oracle.com's certificate, issued by `/O=VeriSign Trust Network/OU=VeriSign, Inc./OU=VeriSign International Server CA - Class 3/OU=www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign': Unable to locally verify the issuer's authority. ---request begin--- GET /all_unsigned/146808-01.zip HTTP/1.0 User-Agent: Wget/1.12 (solaris2.10) Accept: */* Host: getupdates.oracle.com Authorization: Basic c2NvdHQubmlzaGltdXJhQG5nYy5jb206SVM2LTY1WTk= ---request end--- Proxy request sent, awaiting response... ---response begin--- HTTP/1.1 403 Service Error Date: Thu, 17 Mar 2011 15:27:41 GMT Server: Oracle-iPlanet-Web-Server/7.0 Content-length: 85 Content-type: text/html;charset=UTF-8 Connection: close Content-Language: en ---response end--- 403 Service Error Closed 5/SSL 0x000a8ec0 2011-03-17 08:27:41 ERROR 403: Service Error. ======================================================== # /usr/sfw/bin/wget --debug --no-check-certificate --execute https_proxy= proxy "https://getupdates.oracle.com/readme/146808-01"; -O 146808-01.readme --http-user=MOS_user --http-passwd=MOS_password Setting --check-certificate (checkcertificate) to 0 Setting https_proxy (httpsproxy) to proxy Setting --output-document (outputdocument) to 146808-01.readme Setting --http-user (httpuser) to MOS_user Setting --http-passwd (httppassword) to MOS_password DEBUG output created by Wget 1.12 on solaris2.10. --2011-03-17 08:29:25-- https://getupdates.oracle.com/readme/146808-01 Host `getupdates.oracle.com' has not issued a general basic challenge. Resolving proxy... proxy_IP Caching proxy => proxy_IP Connecting to proxy | proxy_IP|:80... connected. Created socket 5. Releasing 0x00087f38 (new refcount 1). ---request begin--- CONNECT getupdates.oracle.com:443 HTTP/1.0 User-Agent: Wget/1.12 (solaris2.10) Proxy-Authorization: Basic bm9ydGhncnVtXHMxMDIwNzE6VFNONGFsbC4= ---request end--- proxy responded with: [HTTP/1.1 200 Connection established ] Initiating SSL handshake. Handshake successful; connected socket 5 to SSL handle 0x000954c0 certificate: subject: /C=US/ST=California/L=Redwood Shores/O=Oracle Corporation/OU=Global IT/OU=Terms of use at www.verisign.com/rpa (c)10/CN=*.oracle.com issuer: /O=VeriSign Trust Network/OU=VeriSign, Inc./OU=VeriSign International Server CA - Class 3/OU=www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign WARNING: cannot verify getupdates.oracle.com's certificate, issued by `/O=VeriSign Trust Network/OU=VeriSign, Inc./OU=VeriSign International Server CA - Class 3/OU=www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign': Unable to locally verify the issuer's authority. ---request begin--- GET /readme/146808-01 HTTP/1.0 User-Agent: Wget/1.12 (solaris2.10) Accept: */* Host: getupdates.oracle.com ---request end--- Proxy request sent, awaiting response... ---response begin--- HTTP/1.1 302 Moved Temporarily Date: Thu, 17 Mar 2011 15:29:30 GMT Server: Oracle-iPlanet-Web-Server/7.0 Location: https://a248.e.akamai.net/f/248/21808/15m/sun.download.akamai.com/21808/patches/patchroot/readme/146808-01.README?AuthParam=1300375891_ca3a2e9c005e44c4ae8209b38467892c&TicketId=BFpc%2FkiMW1Y%3D&GroupName=SWUP&FilePath=/21808/patches/patchroot/readme/146808-01.README&File=146808-01.README Content-length: 0 Connection: close Content-Type: text/plain Content-Language: en ---response end--- 302 Moved Temporarily Location: https://a248.e.akamai.net/f/248/21808/15m/sun.download.akamai.com/21808/patches/patchroot/readme/146808-01.README?AuthParam=1300375891_ca3a2e9c005e44c4ae8209b38467892c&TicketId=BFpc%2FkiMW1Y%3D&GroupName=SWUP&FilePath=/21808/patches/patchroot/readme/146808-01.README&File=146808-01.README [following] Closed 5/SSL 0x000954c0 --2011-03-17 08:29:30-- https://a248.e.akamai.net/f/248/21808/15m/sun.download.akamai.com/21808/patches/patchroot/readme/146808-01.README?AuthParam=1300375891_ca3a2e9c005e44c4ae8209b38467892c&TicketId=BFpc%2FkiMW1Y%3D&GroupName=SWUP&FilePath=/21808/patches/patchroot/readme/146808-01.README&File=146808-01.README Host `a248.e.akamai.net' has not issued a general basic challenge. Found proxy in host_name_addresses_map (87f38) Connecting to proxy | proxy_IP|:80... connected. Created socket 5. Releasing 0x00087f38 (new refcount 1). ---request begin--- CONNECT a248.e.akamai.net:443 HTTP/1.0 User-Agent: Wget/1.12 (solaris2.10) Proxy-Authorization: Basic bm9ydGhncnVtXHMxMDIwNzE6VFNONGFsbC4= ---request end--- proxy responded with: [HTTP/1.1 200 Connection established ] Initiating SSL handshake. Handshake successful; connected socket 5 to SSL handle 0x000954c0 certificate: subject: /C=US/O=Akamai Technologies, Inc./CN=a248.e.akamai.net issuer: /C=US/O=GTE Corporation/OU=GTE CyberTrust Solutions, Inc./CN=GTE CyberTrust Global Root WARNING: cannot verify a248.e.akamai.net's certificate, issued by `/C=US/O=GTE Corporation/OU=GTE CyberTrust Solutions, Inc./CN=GTE CyberTrust Global Root': Unable to locally verify the issuer's authority. ---request begin--- GET /f/248/21808/15m/sun.download.akamai.com/21808/patches/patchroot/readme/146808-01.README?AuthParam=1300375891_ca3a2e9c005e44c4ae8209b38467892c&TicketId=BFpc%2FkiMW1Y%3D&GroupName=SWUP&FilePath=/21808/patches/patchroot/readme/146808-01.README&File=146808-01.README HTTP/1.0 User-Agent: Wget/1.12 (solaris2.10) Accept: */* Host: a248.e.akamai.net ---request end--- Proxy request sent, awaiting response... ---response begin--- HTTP/1.0 200 OK Server: Apache ETag: "2e6144ca08abeb519b353e86d46dff5f:1299878596" Last-Modified: Thu, 10 Mar 2011 22:32:02 GMT Accept-Ranges: bytes Content-Length: 2229 Content-Type: text/plain Expires: Thu, 17 Mar 2011 15:29:31 GMT Cache-Control: max-age=0, no-cache Pragma: no-cache Date: Thu, 17 Mar 2011 15:29:31 GMT Connection: close ---response end--- 200 OK Length: 2229 (2.2K) [text/plain] Saving to: `146808-01.readme' 100%[===================================================================>] 2,229 --.-K/s in 0.001s Closed 5/SSL 0x000954c0 2011-03-17 08:29:30 (3.48 MB/s) - `146808-01.readme' saved [2229/2229] =================================================== # cat /.wgetrc use_proxy=on http_proxy=proxy proxy-user= user proxy-passwd=password check-certificate=off ==================================================== # ./pca --supplevel --debug Option list: 1 Option patchdir: /opt/patching/. Option supplevel: 1 Option debug: 1 Command: ./pca ARGV: missing Version: 20101221-01 CWD: /opt/patching Found /usr/sfw/bin/wget (1.12, 11200, https) Found /usr/local/bin/wget (1.12, 11200, https) Using /usr/sfw/bin/wget Found /usr/bin/uname Prerequisites for threads not met, setting threads to 0 Never update Determining MOS Support Levels Please enter My Oracle Support Account User: Please enter My Oracle Support Account Password: wgetrc: found //.wgetrc Adding to /tmp/pca.365426: header=Authorization: Basic <base64-user-passwd> /usr/sfw/bin/wget --progress=dot:binary "https://support.oracle.com/CSP/login?cmd=status"; --ca-certificate=./pca -O /tmp/pca.743040 --2011-03-17 08:32:35-- https://support.oracle.com/CSP/login?cmd=status Resolving support.oracle.com... 141.146.54.16 Connecting to support.oracle.com|141.146.54.16|:443... failed: Connection timed out. Retrying. --2011-03-17 08:36:21-- (try: 2) https://support.oracle.com/CSP/login?cmd=status -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Martin Paul Sent: Thursday, March 17, 2011 3:01 AM To: PCA (Patch Check Advanced) Discussion Subject: EXT :Re: [pca] impossible to load some patches Nishimura, Scott L (IT Solutions) wrote: > Unfortunately, I can't get *any* patches. I used to be able to, even after > the MOS transition [some time after 12/10]. My internal proxy guy says the > "403" error I'm getting is due to the remote server, not our internal one. Ok, so we'll try to rule out PCA as the problem-causer as well. Try: wget --http-user='xxx' --http-passwd='xxx' --no-check-certificate --execute https_proxy=proxy_server "https://getupdates.oracle.com/all_unsigned/146808-01.zip"; -O 146808-01.zip Replace xxx/proxy_server with your settings, of course. Also try to download a README instead of patch, using e.g. this URL with the above command: https://getupdates.oracle.com/readme/146808-01 Two more questions: What's in /.wgetrc? What does "pca --supplevel" show (if it doesn't work, run it with "--debug")? Martin.
