Bug#870672: cdimage.debian.org: Cannot install packages from update DVD for Stretch 9.1.0

[Nicholas Dreyer]

On Sat, 5 Aug 2017 20:57:04 +0100 Steve McIntyre 
wrote:
> [ Hint: Please CC 870...@bugs.debian.org so that other people can see
>   responses in tbe BTS too... ]

Sorry, I failed to because I somehow erroneously thought you had
replied to me privately.  Am attaching (again) the logs I sent to you
before, hoping they will be visible to all.  Will see soon enough . . .Reading package lists...
Building dependency tree...
Reading state information...
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 0 not upgraded.
Need to get 0 B/1,263 kB of archives.
After this operation, 0 B of additional disk space will be used.
Get:1 cdrom://[Debian GNU/Linux 9.1.1 Update DVD 20170805: i386 DVD 1] stretch/main i386 apt i386 1.4.7 [1,263 kB]
(Reading database ... 
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 145357 files and directories currently installed.)
Preparing to unpack .../main/a/apt/apt_1.4.7_i386.deb ...
Unpacking apt (1.4.7) over (1.4.7) ...
Setting up apt (1.4.7) ...
Processing triggers for libc-bin (2.24-11+deb9u1) ...
Processing triggers for man-db (2.7.6.1-2) ...
Ign:1 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-1 20170617-14:24] stretch InRelease
Ign:2 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-2 20170617-14:24] stretch InRelease
Ign:3 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-3 20170617-14:24] stretch InRelease
Ign:4 cdrom://[Debian GNU/Linux 9.1.1 Update DVD 20170805: i386 DVD 1] stretch InRelease
Ign:5 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-1 20170617-14:24] stretch Release
Ign:6 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-2 20170617-14:24] stretch Release
Ign:7 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-3 20170617-14:24] stretch Release
Ign:8 cdrom://[Debian GNU/Linux 9.1.1 Update DVD 20170805: i386 DVD 1] stretch Release
Hit:9 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-1 20170617-14:24] stretch/main i386 Packages
Ign:10 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-1 20170617-14:24] stretch/main all Packages
Ign:11 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-1 20170617-14:24] stretch/main Translation-en_US
Hit:12 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-1 20170617-14:24] stretch/main Translation-en
Hit:13 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-2 20170617-14:24] stretch/contrib i386 Packages
Ign:14 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-2 20170617-14:24] stretch/contrib all Packages
Ign:15 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-2 20170617-14:24] stretch/contrib Translation-en_US
Hit:16 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-2 20170617-14:24] stretch/contrib Translation-en
Ign:9 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-1 20170617-14:24] stretch/main i386 Packages
Hit:17 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-2 20170617-14:24] stretch/main i386 Packages
Ign:12 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-1 20170617-14:24] stretch/main Translation-en
Ign:18 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-2 20170617-14:24] stretch/main all Packages
Ign:13 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-2 20170617-14:24] stretch/contrib i386 Packages
Ign:19 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-2 20170617-14:24] stretch/main Translation-en_US
Ign:16 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-2 20170617-14:24] stretch/contrib Translation-en
Hit:20 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-2 20170617-14:24] stretch/main Translation-en
Ign:17 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-2 20170617-14:24] stretch/main i386 Packages
Ign:21 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-3 20170617-14:24] stretch/contrib all Packages
Ign:20 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-2 20170617-14:24] stretch/main Translation-en
Hit:22 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-3 20170617-14:24] stretch/contrib i386 Packages
Ign:22 cdrom://[Debian GNU/Linux 9.0.0 _Stretch_ - Official i386 DVD Binary-3 20170617-14:24] 

Bug#870672: cdimage.debian.org: Cannot install packages from update DVD for Stretch 9.1.0

[Steve McIntyre]

[ Hint: Please CC 870...@bugs.debian.org so that other people can see
  responses in tbe BTS too... ]

On Sat, Aug 05, 2017 at 12:47:01PM -0700, Nicholas Dreyer wrote:
>Hi Steve:
>
>Your fix looks good for the i386 test I just did, the details of which
>are attached.

Cool, thanks for verifying!

>I do not understand the (apparently bogus) warnings about non-existent
>Release files, but they do not seem represent any real trouble.

ACK. AFAICS that's most likely due to the DVDs not including
signatures. That's a separate issue and a much harder change...

-- 
Steve McIntyre, Cambridge, UK.st...@einval.com
Google-bait:   http://www.debian.org/CD/free-linux-cd
  Debian does NOT ship free CDs. Please do NOT contact the mailing
  lists asking us to send them to you.

Bug#870672: cdimage.debian.org: Cannot install packages from update DVD for Stretch 9.1.0

[Steve McIntyre]

On Fri, Aug 04, 2017 at 05:51:45PM +0100, Steve McIntyre wrote:
>On Thu, Aug 03, 2017 at 04:11:23PM -0700, Nicholas Dreyer wrote:
>>
>>Built iso image, then burnt it to a DVD using jigdo information from here:
>>  
>> http://cdimage.debian.org/debian-cd/current/i386/jigdo-dvd/debian-update-9.1.0-i386-DVD-1.jigdo
>>Ran "apt-cdrom add /dev/cdrom" on the DVD
>>Ran "apt-get update"
>>Ran "apt-get upgrade"
>
>Apologies - you've found a real bug here. I need to update the
>update-cd script to use better hashes than just md5sum for the update
>images. This setup has worked for a very long time, but newer versions
>of apt won't accept it any more. Looking into a fix now...

OK, I think I have a fix now that looks good in testing locally. Could
you help test an image from

  https://get.debian.org/images/unofficial/test-update-9.1.1/

and let me know if it works better for you, please?

-- 
Steve McIntyre, Cambridge, UK.st...@einval.com
"We're the technical experts.  We were hired so that management could
 ignore our recommendations and tell us how to do our jobs."  -- Mike Andrews

Bug#870672: cdimage.debian.org: Cannot install packages from update DVD for Stretch 9.1.0

[Steve McIntyre]

On Thu, Aug 03, 2017 at 04:11:23PM -0700, Nicholas Dreyer wrote:
>Package: cdimage.debian.org
>Severity: grave
>Justification: renders package unusable
>
>Dear Maintainer,
>
>*** Reporter, please consider answering these questions, where appropriate ***
>
>   * What led up to the situation?
>Tried to upgrade to 9.1.0 from basic 9.0.0 instalation using the 9.1.0 update 
>DVD
>
>   * What exactly did you do (or not do) that was effective (or
> ineffective)?
>Built iso image, then burnt it to a DVD using jigdo information from here:
>  
> http://cdimage.debian.org/debian-cd/current/i386/jigdo-dvd/debian-update-9.1.0-i386-DVD-1.jigdo
>Ran "apt-cdrom add /dev/cdrom" on the DVD
>Ran "apt-get update"
>Ran "apt-get upgrade"
>
>   * What was the outcome of this action?
>/etc/apt/sources.list got new source line:
>deb cdrom:[Debian GNU/Linux 9.1.0 Update DVD 20170722: i386 DVD 1]/ stretch 
>contrib main non-free
>
>Package instalation for every file selected for upgrade failed with message 
>such as
>Err:0 cdrom://[Debian GNU/Linux 9.1.0 Update DVD 20170722: i386 DVD 1] 
>stretch/main i386 base-files i386 9.9+deb9u1
>  Insufficient information available to perform this download securely
>  Hashes of expected file:
>   - MD5Sum:47bf7b3f66c3f43f733724ec07ad4a26 [weak]
>   - Filesize:67180 [weak]

Hi Nicholas,

Apologies - you've found a real bug here. I need to update the
update-cd script to use better hashes than just md5sum for the update
images. This setup has worked for a very long time, but newer versions
of apt won't accept it any more. Looking into a fix now...

-- 
Steve McIntyre, Cambridge, UK.st...@einval.com
< sladen> I actually stayed in a hotel and arrived to find a post-it
  note stuck to the mini-bar saying "Paul: This fridge and
  fittings are the correct way around and do not need altering"

Bug#870672: cdimage.debian.org: Cannot install packages from update DVD for Stretch 9.1.0

[Nicholas Dreyer]

Package: cdimage.debian.org
Severity: grave
Justification: renders package unusable

Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
Tried to upgrade to 9.1.0 from basic 9.0.0 instalation using the 9.1.0 update 
DVD

   * What exactly did you do (or not do) that was effective (or
 ineffective)?
Built iso image, then burnt it to a DVD using jigdo information from here:
  
http://cdimage.debian.org/debian-cd/current/i386/jigdo-dvd/debian-update-9.1.0-i386-DVD-1.jigdo
Ran "apt-cdrom add /dev/cdrom" on the DVD
Ran "apt-get update"
Ran "apt-get upgrade"

   * What was the outcome of this action?
/etc/apt/sources.list got new source line:
deb cdrom:[Debian GNU/Linux 9.1.0 Update DVD 20170722: i386 DVD 1]/ stretch 
contrib main non-free

Package instalation for every file selected for upgrade failed with message 
such as
Err:0 cdrom://[Debian GNU/Linux 9.1.0 Update DVD 20170722: i386 DVD 1] 
stretch/main i386 base-files i386 9.9+deb9u1
  Insufficient information available to perform this download securely
  Hashes of expected file:
   - MD5Sum:47bf7b3f66c3f43f733724ec07ad4a26 [weak]
   - Filesize:67180 [weak]

A more extensive description of actions taken and resulting outcomes can be 
found here:
http://forums.debian.net/viewtopic.php?f=17=134131

   * What outcome did you expect instead?
Package installation to work


-- System Information:
Debian Release: 9.1
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 4.9.0-3-686-pae (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), 
LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)