gliderlabs / gliderlabs/docker-alpine

rabbitmq apks have bad signatures in alpine/latest-stable

Open
#555 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
5.7k
Forks
530
PR merge metrics
No merged PRs in 30d

Description

I'm getting the following issue when using `http://dl-cdn.alpinelinux.org/alpine/latest-stable/main`:

```bash
Step 7/19 : RUN apk add --allow-untrusted --no-cache --repository http://dl-cdn.alpinelinux.org/alpine/latest-stable/main rabbitmq-c-dev
---> Running in e85209db649a
fetch http://dl-cdn.alpinelinux.org/alpine/latest-stable/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.12/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.12/community/x86_64/APKINDEX.tar.gz
(1/6) Installing pkgconf (1.7.3-r0)
(2/6) Installing popt (1.18-r0)
(3/6) Installing popt-dev (1.18-r0)
(4/6) Installing openssl-dev (1.1.1i-r0)
(5/6) Installing rabbitmq-c (0.10.0-r1)
ERROR: rabbitmq-c-0.10.0-r1: BAD signature
(6/6) Installing rabbitmq-c-dev (0.10.0-r1)
ERROR: rabbitmq-c-dev-0.10.0-r1: BAD signature
```

Switching to `http://dl-cdn.alpinelinux.org/alpine/v3.13/main` seems to fix the problem:

```bash
Step 7/19 : RUN apk add --allow-untrusted --no-cache --repository http://dl-cdn.alpinelinux.org/alpine/v3.13/main rabbitmq-c-dev
---> Running in a81d79e58d1d
fetch http://dl-cdn.alpinelinux.org/alpine/v3.13/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.12/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.12/community/x86_64/APKINDEX.tar.gz
(1/6) Installing pkgconf (1.7.3-r0)
(2/6) Installing popt (1.18-r0)
(3/6) Installing popt-dev (1.18-r0)
(4/6) Installing openssl-dev (1.1.1i-r0)
(5/6) Installing rabbitmq-c (0.10.0-r1)
(6/6) Installing rabbitmq-c-dev (0.10.0-r1)
```

This doesn't seem possible as latest-stable should be the same as 3.13. The indexes [here (latest)](http://dl-cdn.alpinelinux.org/alpine/latest-stable/main/x86_64/) and [here (3.13)](http://dl-cdn.alpinelinux.org/alpine/v3.13/main/x86_64/) shows the same files with the same dates and sizes, that is:

![image](https://user-images.githubusercontent.com/525726/104637832-2869cd80-565a-11eb-9a92-6a8b4a2a19bc.png)

But when I actually download both files I get this:

```bash
-rw-rw-r-- 1 trappar trappar 37599 Jan 14 11:05 'FROM 3.13 rabbitmq-c-0.10.0-r1.apk'
-rw-rw-r-- 1 trappar trappar 37515 Jan 14 11:06 'FROM latest rabbitmq-c-0.10.0-r1.apk'

```

As you can see the file from latest has the incorrect size - thus the bad signature.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.