Bug 440593 - Failed to update metadata for lvfs: checksum failure
Summary: Failed to update metadata for lvfs: checksum failure
Status: RESOLVED UPSTREAM
Alias: None
Product: Discover
Classification: Applications
Component: discover (show other bugs)
Version: 5.22.4
Platform: Other Linux
: NOR normal
Target Milestone: ---
Assignee: Dan Leinir Turthra Jensen
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-08-04 16:02 UTC by tjxaires
Modified: 2023-01-18 16:42 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments
attachment-19425-0.html (1.37 KB, text/html)
2023-01-17 17:20 UTC, tjxaires
Details
attachment-17695-0.html (885 bytes, text/html)
2023-01-18 16:36 UTC, tjxaires
Details
attachment-18140-0.html (1.41 KB, text/html)
2023-01-18 16:39 UTC, tjxaires
Details

Note You need to log in before you can comment on or make changes to this bug.
Description tjxaires 2021-08-04 16:02:42 UTC
Seeing these messages in .xsession-errors.  Checksum error is about halfway down:

plasma-discover 
qrc:/qml/Feedback.qml:2:1: module "org.kde.userfeedback" is not installed
adding empty sources model QStandardItemModel(0x557ef317c470)
kdeinit5: preparing to launch '/usr/lib/x86_64-linux-gnu/libexec/kf5/klauncher'
kdeinit5: Launched KLauncher, pid = 1521, result = 0
Connecting to deprecated signal QDBusConnectionInterface::serviceOwnerChanged(QString,QString,QString)
kdeinit5: opened connection to :0
kdeinit5: Got EXEC_NEW '/usr/lib/x86_64-linux-gnu/qt5/plugins/kf5/kio/http.so' from launcher.
kdeinit5: preparing to launch '/usr/lib/x86_64-linux-gnu/qt5/plugins/kf5/kio/http.so'
org.kde.plasma.libdiscover: Couldn't find a category for  "fwupd-backend"
kdeinit5: Got EXEC_NEW '/usr/lib/x86_64-linux-gnu/qt5/plugins/kf5/kio/file.so' from launcher.
kdeinit5: preparing to launch '/usr/lib/x86_64-linux-gnu/qt5/plugins/kf5/kio/file.so'
kdeinit5: Got EXEC_NEW '/usr/lib/x86_64-linux-gnu/qt5/plugins/kf5/kio/http.so' from launcher.
kdeinit5: preparing to launch '/usr/lib/x86_64-linux-gnu/qt5/plugins/kf5/kio/http.so'
Fwupd Info: saving new firmware metadata to: "/home/tom/.cache/fwupd/remotes.d/lvfs/metadata.xml.gz"
kf5.kio.kio_http: Can't communicate with kded_kcookiejar!
kf5.kio.kio_http: Can't communicate with kded_kcookiejar!
Fwupd Error 0 Failed to update metadata for lvfs: checksum failure: failed to verify data, expected a77f1d8fddce2c3a64d3a8435bed70900ba70fb6
qml: message: Failed to update metadata for lvfs: checksum failure: failed to verify data, expected a77f1d8fddce2c3a64d3a8435bed70900ba70fb6
KNS error in "Kate Snippets" : KNSCore::NetworkError "Network error 2: Connection closed" QVariant(int, 2)
invalid kns backend! "/usr/share/knsrcfiles/discover_ktexteditor_codesnippets_core.knsrc" because: "Network error in backend Kate Snippets: 2"
org.kde.plasma.libdiscover: Discarding invalid backend "discover_ktexteditor_codesnippets_core.knsrc"
kns error "/usr/share/knsrcfiles/discover_ktexteditor_codesnippets_core.knsrc" "Network error in backend Kate Snippets: 2"
org.kde.plasma.libdiscover: Couldn't find a category for  "fwupd-backend"
took really long to fetch KNSBackend(0x557ef2f64270, name = "/usr/share/knsrcfiles/k3btheme.knsrc")
took really long to fetch PackageKitBackend(0x557ef303d670)
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/private/globaltoolbar/ToolBarPageHeader.qml:44:9: QML ActionToolBar: Binding loop detected for property "actions"
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/private/globaltoolbar/ToolBarPageHeader.qml:44:9: QML ActionToolBar: Binding loop detected for property "actions"
[2154:2154:0804/101738.369567:ERROR:sandbox_linux.cc(374)] InitializeSandbox() called with multiple threads in process gpu-process.
dbus-daemon[1308]: Activating service name='org.a11y.atspi.Registry' requested by ':1.11' (uid=1000 pid=2109 comm="/opt/google/chrome/chrome --incognito --enable-cra" label="unconfined")
dbus-daemon[1308]: Successfully activated service 'org.a11y.atspi.Registry'
SpiRegistry daemon is running with well-known name - org.a11y.atspi.Registry
Comment 1 Nate Graham 2021-08-04 18:11:57 UTC
Seems like this is a problem with the fwupd payload itself.
Comment 2 tjxaires 2021-08-05 15:32:34 UTC
I'm not sure how urgent this issue is.  Can this issue be forwarded to the correct team?
Comment 3 Jaz-z 2021-08-23 15:13:31 UTC
SUMMARY

Failed to update metadata for lvfs: checksum failure: failed to verify data, expected 98261db7124c8026fb88f77768787efc2fc2f8344c3

The above message is seen upon opening discover for updates after restart of computer since a month or two ago


-----------------

STEPS TO REPRODUCE
1. Opening discover
2. Search for updates
3. 

OBSERVED RESULT
as explained in summary

EXPECTED RESULT


SOFTWARE/OS VERSIONS
Operating System: Kubuntu 20.04
KDE Plasma Version: 5.18.5
KDE Frameworks Version: 5.68.0
Qt Version: 5.12.8
Kernel Version: 5.4.0-81-generic
OS Type: 64-bit
Processors: 4 × Intel® Core™ i5 CPU 660 @ 3.33GHz
Memory: 5.7 GiB of RAM


ADDITIONAL INFORMATION
Error message last seen today 23 August 2021
Comment 4 Nate Graham 2023-01-12 18:05:36 UTC
As I mentioned, this is an issue with the Firmware update itself. You'd want to report it at https://github.com/fwupd/fwupd/issues
Comment 5 tjxaires 2023-01-17 17:20:17 UTC
Created attachment 155385 [details]
attachment-19425-0.html

Please forward to the appropriate party.

On Thu, Jan 12, 2023 at 12:05 PM Nate Graham <bugzilla_noreply@kde.org>
wrote:

> https://bugs.kde.org/show_bug.cgi?id=440593
>
> Nate Graham <nate@kde.org> changed:
>
>            What    |Removed                     |Added
>
> ----------------------------------------------------------------------------
>              Status|REOPENED                    |RESOLVED
>          Resolution|---                         |UPSTREAM
>
> --- Comment #4 from Nate Graham <nate@kde.org> ---
> As I mentioned, this is an issue with the Firmware update itself. You'd
> want to
> report it at https://github.com/fwupd/fwupd/issues
>
> --
> You are receiving this mail because:
> You reported the bug.
Comment 6 Nate Graham 2023-01-17 17:25:57 UTC
That's up to you. :)
Comment 7 tjxaires 2023-01-18 16:36:48 UTC
Created attachment 155408 [details]
attachment-17695-0.html

When you say this is an issue with the "firmware update itself", are you
implying that I potentially have malicious firmware on my machine?

On Tue, Jan 17, 2023 at 11:25 AM Nate Graham <bugzilla_noreply@kde.org>
wrote:

> https://bugs.kde.org/show_bug.cgi?id=440593
>
> --- Comment #6 from Nate Graham <nate@kde.org> ---
> That's up to you. :)
>
> --
> You are receiving this mail because:
> You reported the bug.
Comment 8 tjxaires 2023-01-18 16:39:45 UTC
Created attachment 155409 [details]
attachment-18140-0.html

Also, when I use

sudo apt update && sudo apt full-upgrade

from the command line, I don't get any error messages.

On Wed, Jan 18, 2023 at 10:36 AM Tom Harris <tjxaires@gmail.com> wrote:

> When you say this is an issue with the "firmware update itself", are you
> implying that I potentially have malicious firmware on my machine?
>
> On Tue, Jan 17, 2023 at 11:25 AM Nate Graham <bugzilla_noreply@kde.org>
> wrote:
>
>> https://bugs.kde.org/show_bug.cgi?id=440593
>>
>> --- Comment #6 from Nate Graham <nate@kde.org> ---
>> That's up to you. :)
>>
>> --
>> You are receiving this mail because:
>> You reported the bug.
>
>
Comment 9 Nate Graham 2023-01-18 16:42:43 UTC
(In reply to tjxaires from comment #7)
> When you say this is an issue with the "firmware update itself", are you
> implying that I potentially have malicious firmware on my machine?
I don't know why there might be a checksum failure for this firmware update. It might be evidence of malicious software, it might have been a mix-up on the update server, or it might have been an error from the vendor.

KDE isn't involved in any of those things though; you'd need to get into contact with the firmware vendor or the owners of the update server (https://fwupd.org/).


(In reply to tjxaires from comment #8)
> Also, when I use
> 
> sudo apt update && sudo apt full-upgrade
> 
> from the command line, I don't get any error messages.
That makes sense, since apt doesn't handle firmware upgrades and therefore won't show you this problem.