Bug 23588 - $MIRRORLIST offering mirror with hdlists that are 3 years out of date!
Summary: $MIRRORLIST offering mirror with hdlists that are 3 years out of date!
Status: REOPENED
Alias: None
Product: Infrastructure
Classification: Unclassified
Component: Others (show other bugs)
Version: unspecified
Hardware: All Linux
Priority: High critical
Target Milestone: ---
Assignee: Sysadmin Team
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-09-17 00:12 CEST by katnatek
Modified: 2020-09-19 18:08 CEST (History)
7 users (show)

See Also:
Source RPM:
CVE:
Status comment:


Attachments

Description katnatek 2018-09-17 00:12:15 CEST
Description of problem:

After the great uodate i decide to test the mirrorlist system
Usually i use distrib-coffe

Only few days ago i noticed some weird thinks when try to install
some package (see the bug#23572)

I know you not have direct control in the mirrors, but you have to
remove very outdated mirrors like http://mirrors-usa.go-parts.com/ 
from urpmi's mirrorlist
David Walser 2018-09-17 02:36:47 CEST

CC: (none) => sysadmin-bugs
Assignee: bugsquad => sysadmin-bugs
Version: 6 => unspecified
Component: Security => Others
QA Contact: security => (none)
Product: Mageia => Infrastructure

Comment 1 katnatek 2019-03-23 23:21:03 CET
Other report with other mirror https://ml.mageia.org/l/arc/dev/2019-03/msg00289.html
Comment 2 Thomas Andrews 2020-06-03 21:04:34 CEST
Three years later, the still-defunct mirror from Comment 0 is STILL on the list. In the last few days, a user has reported errors on the discuss ml from MIRRORLIST picking that mirror for him. 

This needs to be fixed. It should have been fixed three years ago.

CC: (none) => andrewsfarm
Severity: normal => critical
Priority: Normal => High

Comment 3 Jess Neri 2020-06-04 01:25:17 CEST
This bug has begun interfering with updates for me in Vancouver, Canada.

CC: (none) => jneri

Comment 4 Jess Neri 2020-06-04 02:02:44 CEST
(In reply to Jess Neri from comment #3)
> This bug has begun interfering with updates for me in Vancouver, Canada.


### For reference:  

* lost media.cfg for unknown reason  
* needed to manually reconstruct media.cfg  
* resumed updates succeedfully  

Messages proving lost file:  

$urpmi.update -a
invalid MD5SUM file (downloaded from http://mirrors-usa.go-parts.com/mageia/distrib/7/x86_64/media/core/release/media_info)
invalid MD5SUM file (downloaded from http://mirrors-usa.go-parts.com/mageia/distrib/7/x86_64/media/core/updates/media_info)
invalid MD5SUM file (downloaded from http://mirrors-usa.go-parts.com/mageia/distrib/7/x86_64/media/nonfree/release/media_info)
^C

$sudo urpmi.addmedia --distrib --mirrorlist '$MIRRORLIST'
unable to parse media.cfg
unable to add medium


### Existing notes from 2011, 2016

[Tried](https://github.com/juanluisbaptiste/docker-brew-mageia/issues/6)
[Successful](https://forums.mageia.org/en/viewtopic.php?f=8&t=8788)
[Also Referred](https://forums.mageia.org/en/viewtopic.php?t=4739)
Comment 5 andré blais 2020-06-06 05:33:50 CEST
Just an idea, but if the mirrorlist used is on the mageia site (and not kept on the user's system), maybe a long term solution is to daily verify each site in the mirrorlist, and if more than x days (say 3) after an update is available, the site still hasn't updated, the site is marked as inactive.
Of course urpm* would have to be modified to only use sites not marked as inactive.
This would be useful for sites no longer active, but also for sites that temporarily have a problem.

CC: (none) => andre999mga

Comment 6 Johnny A. Solbu 2020-06-06 08:42:23 CEST
(In reply to andré blais from comment #5)
> Just an idea, but if the mirrorlist used is on the mageia site (and not kept
> on the user's system), maybe a long term solution is to daily verify each
> site in the mirrorlist, and if more than x days (say 3) after an update is
> available, the site still hasn't updated, the site is marked as inactive.

No, this is the wrong approach in my opinion
If the mirror checked is X days too old or if it no longer exist like in the «usa carparts» mirror, the mirror needs to be /removed/ from the mirrorlist, not just marked as inactive.


> Of course urpm* would have to be modified to only use sites not marked as
> inactive.

We need to keep in mind that we have users running old/End of Life releases of Mageia. Some do this because the hardware can't support newer versions. (Nvidia is known to remove support for X year old cards.)

By /removing/ old or none existant mirrors we don't need to change how urpm works on the users systems.
And depending on how the mirrorlist system works or how this removing is done, old Mageia releases will benefit from this as well.

CC: (none) => cooker

Comment 7 Johnny A. Solbu 2020-06-06 08:56:26 CEST
By the way, we already do have a working check for old or broken mirrors:
https://mirrors.mageia.org/status

We should have this check remove old or broken mirrors from the mirrorlist.

It could also keep checking them, as long as it is still listed on the mirrors page, in case they are fixed and becomes up to date – like distrib coffee did when it had disk problems. Then it could be reinstated.
Comment 8 Thomas Andrews 2020-06-06 14:39:37 CEST
(In reply to Johnny A. Solbu from comment #6)
> (In reply to andré blais from comment #5)
> > Just an idea, but if the mirrorlist used is on the mageia site (and not kept
> > on the user's system), maybe a long term solution is to daily verify each
> > site in the mirrorlist, and if more than x days (say 3) after an update is
> > available, the site still hasn't updated, the site is marked as inactive.
> 
> No, this is the wrong approach in my opinion
> If the mirror checked is X days too old or if it no longer exist like in the
> «usa carparts» mirror, the mirror needs to be /removed/ from the mirrorlist,
> not just marked as inactive.
> 
> 
> > Of course urpm* would have to be modified to only use sites not marked as
> > inactive.
> 
> We need to keep in mind that we have users running old/End of Life releases
> of Mageia. Some do this because the hardware can't support newer versions.
> (Nvidia is known to remove support for X year old cards.)
> 
> By /removing/ old or none existant mirrors we don't need to change how urpm
> works on the users systems.
> And depending on how the mirrorlist system works or how this removing is
> done, old Mageia releases will benefit from this as well.

Completely removing a mirror (sounds permanent) doesn't address the very possible problem of a temporary shutdown. Recently, the Tier 1 math.princeton site stopped syncing, and it was at least 3 days before anyone (me) noticed and brought it to somebody's attention. Consequently, all of the mirrors that sync from that mirror were also out of date. That means that in a case like that, we'd be removing several mirrors.

We'd need some automatic way of restoring the mirror to the list when (if) they come back up.
Comment 9 Thomas Andrews 2020-06-06 14:43:11 CEST
(In reply to Johnny A. Solbu from comment #7)
> By the way, we already do have a working check for old or broken mirrors:
> https://mirrors.mageia.org/status
> 
That site isn't perfect, either. It only checks http connections. See Bug 26546.
Comment 10 andré blais 2020-06-06 20:27:05 CEST
(In reply to Johnny A. Solbu from comment #6)
> (In reply to andré blais from comment #5)

[...]

> > Of course urpm* would have to be modified to only use sites not marked as
> > inactive.
> 
> We need to keep in mind that we have users running old/End of Life releases
> of Mageia. Some do this because the hardware can't support newer versions.
> (Nvidia is known to remove support for X year old cards.)
> 
> By /removing/ old or none existant mirrors we don't need to change how urpm
> works on the users systems.
> And depending on how the mirrorlist system works or how this removing is
> done, old Mageia releases will benefit from this as well.

OK, a somewhat different approach would be to keep a base list of mirrors, and to generate mirrorlist each day from those sites which have been updated in the last X days.
I suggested X = 3 days, but maybe another value would be preferred.
It seems to me that at least 2 days is appropriate, since some sites may usually not update every day.
We could even make X vary according to the tier of the mirror.

This way urpm* doesn't have to be changed.

Dead sites would never be in mirrorlist, and those sites temporarily unavailable would return automatically to mirrorlist when available.

We could even send a notice to sysadmin for sites not available.
That way we would more quickly remove dead sites from the base list,
and could contact sites with problems to help assure they become available sooner.
Comment 11 Dave Hodgins 2020-06-06 21:44:37 CEST
I finally figured out how to remove a mirror from the list and have now removed
mirrors-usa.go-parts.com

Closing as fixed though the mirror selection process does need improving.

I've explained to neoclust on irc how I removed it.

Resolution: (none) => FIXED
CC: (none) => davidwhodgins
Status: NEW => RESOLVED

Comment 12 andré blais 2020-06-07 01:29:55 CEST
Wait a minute.
The issue was about out of date sites on the mirror list.
Removing one site doesn't correct the essence of the problem.
We should keep this open until the process is improved.
Unless we open an essentially identical bug for the same problem.
Comment 13 Dave Hodgins 2020-06-07 02:54:14 CEST
Re-opening till the process can be fixed. At least now we know how to remove
a mirror from the list.

Status: RESOLVED => REOPENED
Resolution: FIXED => (none)

Comment 14 Dave Hodgins 2020-06-11 20:59:09 CEST
*** Bug 26769 has been marked as a duplicate of this bug. ***

CC: (none) => estellnb

Comment 15 Aurelien Oudelet 2020-09-19 18:08:56 CEST
Hi,
This is High priority bug for a good reason.

Making Mageia even better than ever is best direction.
In order to do right thing, this bug should be examined and fixed as soon as possible.

Packagers, please make the status to Assigned when you are working on this.
Feel free to reassign the bug if bad-triaged. Also, if bug is old, please close it.

On October 1st 2020, we will drop priority to normal.

Note You need to log in before you can comment on or make changes to this bug.