Bug 1225962

Summary:	zypper list-updates no longer works rootless
Product:	[openSUSE] openSUSE Tumbleweed	Reporter:	Georg Pfuetzenreuter <georg.pfuetzenreuter>
Component:	libzypp	Assignee:	E-mail List <zypp-maintainers>
Status:	RESOLVED DUPLICATE	QA Contact:	E-mail List <qa-bugs>
Severity:	Normal
Priority:	P5 - None	CC:	bzeller, mrmazda, suse-beta
Version:	Current
Target Milestone:	---
Hardware:	x86-64
OS:	openSUSE Tumbleweed
Whiteboard:
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Georg Pfuetzenreuter 2024-06-04 19:09:46 UTC

Hi,

for our monitoring, we execute `zypper lu` without root privileges. I'm aware this does not allow for refresh, but since we regularly run `zypper ref` as root as part of another job anyways, this was never an issue for our use case.

Since some update in the last weeks (unfortunately cannot pin point which one), this no longer works.

```
discourse01 (discourse):~ # zypper ref
Repository 'darix:apps' is up to date.
Repository 'openSUSE:infrastructure' is up to date.
Repository 'openSUSE:infrastructure:discourse' is up to date.
Repository 'repo-oss' is up to date.
Repository 'repo-update' is up to date.
All repositories have been refreshed.

discourse01 (discourse):~ # sudo -u monitor zypper --no-refresh lu
Error building the cache:
[darix:apps|http://download-prg.infra.opensuse.org/repositories/home:/darix:/apps/openSUSE_Tumbleweed/] Valid metadata not found at specified URL
History:
 - Can't create /var/cache/zypp/raw/darix:apps

Warning: The metadata cache needs to be built for the 'darix:apps' repository. You can run 'zypper refresh' as root to do this.
Warning: Skipping repository 'darix:apps' because of the above error.
Error building the cache:
[openSUSE:infrastructure|http://download-prg.infra.opensuse.org/repositories/openSUSE:/infrastructure/openSUSE_Tumbleweed/] Valid metadata not found at specified URL
History:
 - Can't create /var/cache/zypp/raw/openSUSE:infrastructure

Warning: The metadata cache needs to be built for the 'openSUSE:infrastructure' repository. You can run 'zypper refresh' as root to do this.
Warning: Skipping repository 'openSUSE:infrastructure' because of the above error.
Error building the cache:
[openSUSE:infrastructure:discourse|http://download-prg.infra.opensuse.org/repositories/openSUSE:/infrastructure:/discourse/openSUSE_Tumbleweed/] Valid metadata not found at specified URL
History:
 - Can't create /var/cache/zypp/raw/openSUSE:infrastructure:discourse

Warning: The metadata cache needs to be built for the 'openSUSE:infrastructure:discourse' repository. You can run 'zypper refresh' as root to do this.
Warning: Skipping repository 'openSUSE:infrastructure:discourse' because of the above error.
Error building the cache:
[repo-oss|http://download-prg.infra.opensuse.org/tumbleweed/repo/oss] Valid metadata not found at specified URL
History:
 - Can't create /var/cache/zypp/raw/repo-oss

Warning: The metadata cache needs to be built for the 'repo-oss' repository. You can run 'zypper refresh' as root to do this.
Warning: Skipping repository 'repo-oss' because of the above error.
Error building the cache:
[repo-update|http://download-prg.infra.opensuse.org/update/tumbleweed/] Valid metadata not found at specified URL
History:
 - Can't create /var/cache/zypp/raw/repo-update

Warning: The metadata cache needs to be built for the 'repo-update' repository. You can run 'zypper refresh' as root to do this.
Warning: Skipping repository 'repo-update' because of the above error.
Some of the repositories have not been refreshed because of an error.
Loading repository data...
Reading installed packages...
No updates found.
```

Refresh with `--force` does not help either.

The directories do exist:

```
discourse01 (discourse):~ # ls -al /var/cache/zypp/raw/
total 28
drwxr-x--- 7 root root 4096 Jun  4 18:53 .
drwxr-xr-x 5 root root 4096 May 14 12:21 ..
drwxr-xr-x 3 root root 4096 Jun  4 18:50 darix:apps
drwxr-xr-x 3 root root 4096 Jun  4 18:50 openSUSE:infrastructure
drwxr-xr-x 3 root root 4096 Jun  4 18:50 openSUSE:infrastructure:discourse
drwxr-xr-x 3 root root 4096 Jun  4 18:50 repo-oss
drwxr-xr-x 3 root root 4096 Jun  4 18:50 repo-update
```

On Leap 15.5, this still works as expected:

```
falkor21 (Hypervisor):~ # sudo -u monitor zypper lu
Repository                       : Time since last refresh
openSUSE:infrastructure          : 17 h 32 min
openSUSE:infrastructure:physical : 17 h 32 min
repo-backports-update            : 17 h 32 min
repo-oss                         : 2 D 4 h
repo-sle-update                  : 17 h 32 min
repo-update-oss                  : 17 h 32 min


    Note: Running with user privileges. From time to time run 'zypper refresh' as root to make sure
    the repository metadata are complete and up-to-date.

Loading repository data...
Reading installed packages...
< list of pending updates >
```

Any ideas?
Would be great to avoid having to run our monitoring check as root on Tumbleweed now.

Cheers,
Georg

Downstream ticket for reference: https://progress.opensuse.org/issues/161777

Comment 1 Georg Pfuetzenreuter 2024-06-04 19:11:34 UTC

Same result calling `lu` with or without `--no-refresh`.

Comment 2 Benjamin Zeller 2024-06-05 06:59:36 UTC

Might be related to a bug we had which created the cache directories with wrong permissions.

Try checking /var/cache/zypp if the directories there are user readable,
if not clear the cache, refresh and it should be fixed.

Comment 3 Benjamin Zeller 2024-06-05 07:13:23 UTC

I can't reproduce with zypper 1.14.73, make sure you have the up to date version installed. We had some bugs related to repo management due to some refactorings.

Comment 4 Georg Pfuetzenreuter 2024-06-05 07:59:02 UTC

Hi Benjamin,

thanks for the input. Indeed, `/var/cache/zypp/raw` is not world readable - I did not notice that:

```
# ls -al /var/cache/zypp
total 20
drwxr-xr-x  5 root root 4096 May 14 12:21 .
drwxr-xr-x 13 root root 4096 Dec  8 10:29 ..
drwxr-xr-x  2 root root 4096 Jun  5 07:55 packages
drwxr-x---  7 root root 4096 Jun  5 07:55 raw
drwxr-xr-x  8 root root 4096 Jun  5 07:55 solv
```

`zypper cc -a` and `zypper ref -f` does not help, but manually deleting the directory and `zypper ref` does - it then gets recreated with world permissions:

```
# ls -al /var/cache/zypp
total 20
drwxr-xr-x  5 root root 4096 Jun  5 07:56 .
drwxr-xr-x 13 root root 4096 Dec  8 10:29 ..
drwxr-xr-x  2 root root 4096 Jun  5 07:55 packages
drwxr-xr-x  7 root root 4096 Jun  5 07:56 raw
drwxr-xr-x  8 root root 4096 Jun  5 07:55 solv
```

And after that, `lu` works without root again as expected.
I'll replicate that on all our Tumbleweeds.

Thank you!

Comment 5 Benjamin Zeller 2024-06-05 08:08:53 UTC

Closed as duplicate of bug 1222398

*** This bug has been marked as a duplicate of bug 1222398 ***