[ISSUE] binutils-doc rsa signature

[ISSUE] binutils-doc rsa signature

[paigeadelethompson]

[-- Attachment #1: Type: text/plain, Size: 1228 bytes --]

New issue by paigeadelethompson on void-packages repository

https://github.com/void-linux/void-packages/issues/55066

Description:
### Is this a new report?

Yes

### System Info

x86_64 musl 

### Package(s) Affected

binutils-doc

### Does a report exist for this bug with the project's home (upstream) and/or another distro?

binutils-doc-2.44_1.x86_64-musl.xbps.sig2: 512B [avg rate: 20MB/s]
binutils-doc-2.44_1.x86_64-musl.xbps: 724KB [avg rate: 1290KB/s]
binutils-doc-2.44_1: verifying RSA signature...
ERROR: binutils-doc-2.44_1: the RSA signature is not valid!
ERROR: binutils-doc-2.44_1: removed pkg archive and its signature.


### Expected behaviour

binutils-doc-2.44_1.x86_64-musl.xbps.sig2: 512B [avg rate: 20MB/s]
binutils-doc-2.44_1.x86_64-musl.xbps: 724KB [avg rate: 1290KB/s]
binutils-doc-2.44_1: verifying RSA signature...


### Actual behaviour

binutils-doc-2.44_1.x86_64-musl.xbps.sig2: 512B [avg rate: 20MB/s]
binutils-doc-2.44_1.x86_64-musl.xbps: 724KB [avg rate: 1290KB/s]
binutils-doc-2.44_1: verifying RSA signature...
ERROR: binutils-doc-2.44_1: the RSA signature is not valid!
ERROR: binutils-doc-2.44_1: removed pkg archive and its signature.


### Steps to reproduce

xbps-install bintutils-doc 

Re: binutils-doc rsa signature

[paigeadelethompson]

[-- Attachment #1: Type: text/plain, Size: 273 bytes --]

New comment by paigeadelethompson on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2803845428

Comment:
possibly related https://github.com/void-linux/void-packages/commit/2a265ac724c986e4299a751d53318eba695accff @oreo639 

Re: binutils-doc rsa signature

[o-zig]

[-- Attachment #1: Type: text/plain, Size: 787 bytes --]

New comment by o-zig on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2804075607

Comment:
Also have this issue with `binutils`, though that's likely related:
~~~
binutils-2.44_1: verifying RSA signature...
ERROR: binutils-2.44_1: the RSA signature is not valid!
ERROR: binutils-2.44_1: removed pkg archive and its signature.
Transaction failed! see above for errors.
~~~

This is also on `x86_64-musl` system, my `x86_64` chroot environment for glibc applications, see [Voidlinux Chroot](https://docs.voidlinux.org/config/containers-and-vms/chroot.html), could update both `binutils` and `binutils-doc` without issue.

I've also tried changing all the Tier 1 Mirrors according to [xmirror](https://xmirror.voidlinux.org/) with no luck.

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 331 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2804169677

Comment:
gcc and friends are currently being rebuilt: https://build.voidlinux.org/
If the issue persists after that, then @void-linux/void-ops should be able to look at it when they are available.

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 395 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2804169677

Comment:
gcc and friends are currently being rebuilt: https://build.voidlinux.org/ (generally, the musl repo gets synched after the build is done)
If the issue persists after that, then @void-linux/void-ops should be able to look at it when they are available.

Re: binutils-doc rsa signature

[paigeadelethompson]

[-- Attachment #1: Type: text/plain, Size: 159 bytes --]

New comment by paigeadelethompson on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2804798477

Comment:
o.o 

Re: binutils-doc rsa signature

[Crank-Git]

[-- Attachment #1: Type: text/plain, Size: 277 bytes --]

New comment by Crank-Git on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2806024000

Comment:
@oreo639 seems to be failing repeatedly.

![Image](https://github.com/user-attachments/assets/daa721a9-6f20-4e83-9f1b-9a9e75677460)

Re: binutils-doc rsa signature

[Crank-Git]

[-- Attachment #1: Type: text/plain, Size: 339 bytes --]

New comment by Crank-Git on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2806636673

Comment:
@oreo639 looks like the build keeps failing, and the main build is error code 2 as well after 9+ hours

![Image](https://github.com/user-attachments/assets/17ebbb05-bf47-45cb-bb0d-7fd493a8f053)

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 276 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2806704981

Comment:
Okay, sorry, I missed the fact that the repo is staged rn (unfortunate timing) and it will unstage when the build is fully finished.

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 278 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2806704981

Comment:
Okay, sorry, I missed the fact that the repos are staged rn (unfortunate timing) and it will unstage when the build is fully finished.

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 300 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2806704981

Comment:
Okay, sorry, I missed the fact that the repos are staged rn (unfortunate timing) and it will unstage when the build is fully finished. (and ghdl is rebuilt)

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 294 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2806704981

Comment:
Sorry, I missed the fact that the repos are staged rn (unfortunate timing) and it will unstage when the build is fully finished. (and ghdl is rebuilt)

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 264 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2804169677

Comment:
gcc and friends are currently being rebuilt: https://build.voidlinux.org/ and it should be fixed when the build is done.

Re: binutils-doc rsa signature

[paigeadelethompson]

[-- Attachment #1: Type: text/plain, Size: 512 bytes --]

New comment by paigeadelethompson on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2807498606

Comment:
```
binutils-doc-2.44_1.x86_64-musl.xbps.sig2: 512B [avg rate: 27MB/s]
binutils-doc-2.44_1.x86_64-musl.xbps: 724KB [avg rate: 1296KB/s]
binutils-doc-2.44_1: verifying RSA signature...
ERROR: binutils-doc-2.44_1: the RSA signature is not valid!
ERROR: binutils-doc-2.44_1: removed pkg archive and its signature.
Transaction failed! see above for errors.

```

Re: binutils-doc rsa signature

[cplir-c]

[-- Attachment #1: Type: text/plain, Size: 412 bytes --]

New comment by cplir-c on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2807505727

Comment:
As a workaround because I don't need to compile anything right now, I removed binutils and its docs temporarily using `xbps-remove -F binutils binutils-doc`. I had to use force revdeps because both a regular force and recursive removal didn't work?
Is this a bad idea?

Re: [ISSUE] [CLOSED] binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 1231 bytes --]

Closed issue by paigeadelethompson on void-packages repository

https://github.com/void-linux/void-packages/issues/55066

Description:
### Is this a new report?

Yes

### System Info

x86_64 musl 

### Package(s) Affected

binutils-doc

### Does a report exist for this bug with the project's home (upstream) and/or another distro?

binutils-doc-2.44_1.x86_64-musl.xbps.sig2: 512B [avg rate: 20MB/s]
binutils-doc-2.44_1.x86_64-musl.xbps: 724KB [avg rate: 1290KB/s]
binutils-doc-2.44_1: verifying RSA signature...
ERROR: binutils-doc-2.44_1: the RSA signature is not valid!
ERROR: binutils-doc-2.44_1: removed pkg archive and its signature.


### Expected behaviour

binutils-doc-2.44_1.x86_64-musl.xbps.sig2: 512B [avg rate: 20MB/s]
binutils-doc-2.44_1.x86_64-musl.xbps: 724KB [avg rate: 1290KB/s]
binutils-doc-2.44_1: verifying RSA signature...


### Actual behaviour

binutils-doc-2.44_1.x86_64-musl.xbps.sig2: 512B [avg rate: 20MB/s]
binutils-doc-2.44_1.x86_64-musl.xbps: 724KB [avg rate: 1290KB/s]
binutils-doc-2.44_1: verifying RSA signature...
ERROR: binutils-doc-2.44_1: the RSA signature is not valid!
ERROR: binutils-doc-2.44_1: removed pkg archive and its signature.


### Steps to reproduce

xbps-install bintutils-doc 

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 206 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2807536735

Comment:
Should be fixed now, might take some time to propagate though.

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 225 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2807536735

Comment:
Should be fixed now, might take some time to propagate to all the mirrors though.

Re: binutils-doc rsa signature

[classabbyamp]

[-- Attachment #1: Type: text/plain, Size: 228 bytes --]

New comment by classabbyamp on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2807546408

Comment:
> Is this a bad idea?

yes, it is always a bad idea to break a dependency chain

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 347 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2806704981

Comment:
Sorry, I missed the fact that the repos are staged rn (unfortunate timing that it happened before binutils-doc could be signed) and it will unstage when the build is fully finished. (and ghdl is rebuilt)

Re: binutils-doc rsa signature

[paigeadelethompson]

[-- Attachment #1: Type: text/plain, Size: 2070 bytes --]

New comment by paigeadelethompson on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2807701999

Comment:
I would like to understand a few things:

- What actually precipitated this?
- Why did it take so long for the problem to be addressed?
- What will be done (if anything) to avoid making such an impactful mistake again? 

Among the things that I've been letting slide that I would like to understand are: 

- Who are the people who actually have write access to this repository; what actually endorses their trustworthiness and sets them apart from for example a state sponsored actor who's intention is to distribute malware? To be perfectly fair, I've made pull requests myself but who I am is pretty up front and I've been nothing short of generous in making available a means to reach me for professional inquiries. I don't really see that in the accounts that actually maintain Void. I suppose I'd just take somebody at their word that there's some level of discretion but who's word would that be? Who is actually willing to endorse this?

- I've been exceptionally polite all things considered but I feel like most if not all of my inquiries have just been met with passive aggression. If I'm being honest with you the only reason that Void matters to me at all is because a friend of mine likes it, and it just makes things easier if I can use it for projects that we collaborate on (I'm personally satisfied with SystemD/Debian and could really care less what libc I'm using especially if having a preference just makes things more complicated which it does.) As a matter of fact, I don't even like Linux, my preference is to FreeBSD. I like that there are some similarities here, with Void particularly in the package management system but in FreeBSD there is a very clear distinction between base and ports. I can practically guarantee you that you will not commit anything to base if nobody knows who you are. 

But anyway yeah just close the ticket and pretend like nothing happened like you usually do 

Re: binutils-doc rsa signature

[the-maldridge]

[-- Attachment #1: Type: text/plain, Size: 855 bytes --]

New comment by the-maldridge on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2807722915

Comment:
Seems like we have a lot of new folks in the thread who haven't been around Void long enough to experience a staged repo.  This happens from time to time when we need to make changes to core packages deep in the dependency tree.  Its not super often, but it does happen.

Are there ways to hide this kind of build breakage from the mirrors? Yes.  Is the effort to actually hide the packages shifting worth it? No, usually not.   We really will only lock and pin repos during rebuilds when there's a risk that an unresolved shlib update would break a downstream system.  When you see `xbps-install` stopping you from running an update due to an unresolved dependency, that's the system working as designed.

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 455 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2806704981

Comment:
Sorry, I missed the fact that the repos are staged rn (~~unfortunate timing that it happened before binutils-doc could be signed~~) and it will unstage when the build is fully finished. (and ghdl is rebuilt)

Edit: the signing issue was because the 2.44_1 package was removed due to a build order issue on glibc

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 487 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2806704981

Comment:
Sorry, I missed the fact that the repos are staged rn (~~unfortunate timing that it happened before binutils-doc could be signed~~) and it will unstage when the build is fully finished. (and ghdl is rebuilt)

Edit: the signing issue was because the 2.44_1 package was removed due to a build order issue on glibc (which was resolved for 2.44_2)

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 486 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2806704981

Comment:
Sorry, I missed the fact that the repos are staged rn (~~unfortunate timing that it happened before binutils-doc could be signed~~) and it will unstage when the build is fully finished. (and ghdl is rebuilt)

Edit: the signing issue was because the 2.44_1 package was removed due to a build order issue on glibc (which was resolved on 2.44_2)

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 533 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2806704981

Comment:
Sorry, I missed the fact that the repos are staged rn (~~unfortunate timing that it happened before binutils-doc could be signed~~) and it will unstage when the build is fully finished. (and ghdl is rebuilt)

Edit: the signing issue was because the 2.44_1 package was removed due to a build order issue on glibc (which was resolved on 2.44_2 which wasn't available until the repo unstaged)

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 538 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2806704981

Comment:
Sorry, I missed the fact that the repos are staged rn (~~unfortunate timing that it happened before binutils-doc could be signed~~) and it will unstage when the build is fully finished. (and ghdl is rebuilt)

Edit: the signing issue was because the 2.44_1 package was removed due to a build order issue on glibc (which was resolved on 2.44_2 which wasn't made available until the repo unstaged)

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 539 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2806704981

Comment:
Sorry, I missed the fact that the repos are staged rn (~~unfortunate timing that it happened before binutils-doc could be signed~~) and it will unstage when the build is fully finished. (and ghdl is rebuilt)

Edit: the signing issue was because the 2.44_1 package was removed due to a build order issue on glibc (which was resolved on 2.44_2, which wasn't made available until the repo unstaged)

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 347 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2806704981

Comment:
Sorry, I missed the fact that the repos are staged rn (unfortunate timing that it happened before binutils-doc could be signed) and it will unstage when the build is fully finished. (and ghdl is rebuilt)

Re: binutils-doc rsa signature

[oreo639]

[-- Attachment #1: Type: text/plain, Size: 273 bytes --]

New comment by oreo639 on void-packages repository

https://github.com/void-linux/void-packages/issues/55066#issuecomment-2806704981

Comment:
Sorry, I missed the fact that the repos are staged rn and it will unstage when the build is fully finished. (and ghdl is rebuilt)