Bug 13069

Summary:	mirror API return a list including cauldron repos if URL misses arch
Product:	Websites	Reporter:	jim l <jiml>
Component:	mirrors.mageia.org	Assignee:	Sysadmin Team <sysadmin-bugs>
Status:	NEW ---	QA Contact:
Severity:	critical
Priority:	High	CC:	doktor5000, marja11, nanardon, sysadmin-bugs
Version:	trunk
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:
Source RPM:		CVE:
Status comment:

Description jim l 2014-03-22 20:24:40 CET

Description of problem:
When performing online update from mga3 to mga4, error in the urpmi.addmedia line (syntax error) resulted in cauldron repos being added rather than command failure.  This resulted in an upgrade to mga5, which had to be removed by using backups.

Version-Release number of selected component (if applicable):
experienced with urpmi-7.27.3-2.

How reproducible:
I haven't tried to reproduce it

Steps to Reproduce:
1. from this page: https://wiki.mageia.org/en/Mageia_4_Release_Notes copy/paste the line urpmi.addmedia --distrib --mirrorlist http://mirrors.mageia.org/api/mageia.4.$ARCH.list into shell window as written, without substituting $ARCH with x86_64 or i586 (which you are told to do on the next line).

2.continue with upgrade.

3.enjoy pre-alpha mga5

Command should return a syntax error, or in some other way fail to select repositories.


Reproducible: 

Steps to Reproduce:

Manuel Hiebel 2014-03-30 11:15:17 CEST

Component: BuildSystem => RPM Packages
Version: unspecified => 3
Product: Infrastructure => Mageia

Comment 1 Manuel Hiebel 2014-03-30 11:15:34 CEST

it works fine on mga4

Florian Hubold 2014-04-01 21:10:32 CEST

CC: (none) => doktor5000

Comment 2 Manuel Hiebel 2014-04-01 21:12:32 CEST

but it looks like someone was affected too on irc, wiki was a bit updated, 

thierry, if you want to take a look,

Assignee: sysadmin-bugs => thierry.vignaud

Comment 3 Florian Hubold 2014-04-01 22:28:32 CEST

IIRC since Mageia 2 or 3, at least when using only --distrib one needs to escape the URL to mirror with single quotes when using either $RELEASE or $ARCH otherwise those are not expanded.

E.g. 
urpmi.addmedia --distrib --wget ftp://ftp.nluug.nl/pub/os/Linux/distr/mageia/distrib/$RELEASE/$ARCH
would fail but
urpmi.addmedia --distrib --wget 'ftp://ftp.nluug.nl/pub/os/Linux/distr/mageia/distrib/$RELEASE/$ARCH'
would work.

Comment 4 Thierry Vignaud 2014-04-03 03:32:24 CEST

WRONG!

That's not a syntax error. Urpmi is just expecting an URL.
You did provide a valid URL (though not actually pointing to what you though)

urpmi expand $ARCH, ... if found.
Of course, if you don't quote them, the shell will first try to expand them.

The doc was wrong and has been fixed.

The real bug regarding upgrade to cauldron instead of mga4 is that the server wrongly reports the content of http://mirrors.mageia.org/api/mageia.4.list when requesting http://mirrors.mageia.org/api/mageia.4..list

Status: NEW => ASSIGNED
Component: RPM Packages => mirrors.mageia.org
Version: 3 => trunk
Product: Mageia => Websites
Source RPM: urpmi-7.27.3-2.mga3.src.rpm => (none)

Thierry Vignaud 2014-04-03 03:33:37 CEST

Priority: Normal => High
Assignee: thierry.vignaud => sysadmin-bugs
Summary: urpmi.addmedia does not fail on syntax error, instead adds cauldron repos => mirror API return a list including instead adds cauldron repos
Severity: normal => critical

Comment 5 Thierry Vignaud 2014-04-03 03:36:21 CEST

Actually both these 2 URLs return bogus results.
The results are not good when arch is missed.
It should return an empty list in that case.

Compare:
- OK:
http://mirrors.mageia.org/api/mageia.4.i586.list
- KO:
http://mirrors.mageia.org/api/mageia.4..list
http://mirrors.mageia.org/api/mageia.4.list
http://mirrors.mageia.org/api/mageia..list
http://mirrors.mageia.org/api/mageia.list
http://mirrors.mageia.org/api/mageia.40.list

Summary: mirror API return a list including instead adds cauldron repos => mirror API return a list including cauldron repos if URL misses arch

Manuel Hiebel 2014-04-03 16:00:57 CEST

CC: (none) => nanardon

Comment 6 Marja Van Waes 2015-10-02 17:32:14 CEST

setting status back from ASSIGNED to NEW, because the current assignee (Sysadmin Team) did not set the ASSIGNED status.

Status: ASSIGNED => NEW
CC: (none) => marja11

Comment 7 Aurelien Oudelet 2020-09-19 18:09:01 CEST

Hi,
This is High priority bug for a good reason.

Making Mageia even better than ever is best direction.
In order to do right thing, this bug should be examined and fixed as soon as possible.

Packagers, please make the status to Assigned when you are working on this.
Feel free to reassign the bug if bad-triaged. Also, if bug is old, please close it.

On October 1st 2020, we will drop priority to normal.