Got “Authentication failed” while running do-release-upgrade from 19.10 to 20.04 LTS with proxy configured

Bug #1888058 reported by Norbert
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
ubuntu-release-upgrader (Ubuntu)
Invalid
Undecided
Unassigned

Bug Description

I'm running `squid-deb-proxy` server in my local network. It works well for all package downloads while running all APT commands. It is configured for all possible known URLs of the mirrors including *old-releases*. The Ubuntu 19.10 client has installed client side - the `squid-deb-proxy-client` package.

```
$ dpkg -l squid-deb-proxy-client | tail -n1
ii squid-deb-proxy-client 0.8.14+nmu2 all automatic proxy discovery for APT based on Avahi

$ sudo apt update
Hit:1 http://archive.ubuntu.com/ubuntu eoan InRelease
Hit:2 http://archive.ubuntu.com/ubuntu eoan-updates InRelease
Hit:3 http://archive.ubuntu.com/ubuntu eoan-backports InRelease
Hit:4 http://security.ubuntu.com/ubuntu eoan-security InRelease
Reading package lists... Done
Building dependency tree
Reading state information... Done
All packages are up to date.
```

But when I try to start upgrade process to get 20.04 LTS - using `sudo do-release-upgrade` in the terminal I got the following error message:

```
$ sudo do-release-upgrade
Checking for a new Ubuntu release
Your Ubuntu release is not supported anymore.
For upgrade information, please visit:
http://www.ubuntu.com/releaseendoflife

Get:1 Upgrade tool signature [1 554 B]
Get:2 Upgrade tool [1 342 kB]
Fetched 1 343 kB in 0s (0 B/s)
authenticate 'focal.tar.gz' against 'focal.tar.gz.gpg'
Authentication failed
Authenticating the upgrade failed. There may be a problem with the network or with the server.
```

I do not see anything special in the logs on `squid-deb-proxy` server side:

```
==> /var/log/squid-deb-proxy/access.log <==
1595069772.862 212 192.168.3.47 TCP_MISS/200 3349 CONNECT changelogs.ubuntu.com:443 - HIER_DIRECT/91.189.95.15 -
1595069774.726 2 192.168.3.47 TCP_MEM_HIT/200 1950 GET http://archive.ubuntu.com/ubuntu/dists/focal-updates/main/dist-upgrader-all/current/focal.tar.gz.gpg - HIER_NONE/- application/x-gzip
1595069775.410 681 192.168.3.47 TCP_HIT/200 1342082 GET http://archive.ubuntu.com/ubuntu/dists/focal-updates/main/dist-upgrader-all/current/focal.tar.gz - HIER_NONE/- application/x-gzip
```

How should I fix the problem with *Authentication failed* to run the upgrade through proxy server normally? I do not want to switch proxy server (or exclude its configuration from the client) off to fix the problem.

---

The results does not depend on proxy configuration method - the "Authentication failed" message is shown for both `squid-deb-proxy-client` avahi-based package and for `Acquire::http::Proxy` in `apt.conf`.

Note: previous versions do not suffer from this bug. I have successfully upgraded 16.04 LTS to 18.04 LTS with enabled proxy. But the upgrade from 18.04 LTS to 19.10 and from 18.04 LTS to 20.04 LTS is now impossible because of the "Authentication failed" message.

ProblemType: Bug
DistroRelease: Ubuntu 19.10
Package: ubuntu-release-upgrader-core 1:19.10.15.4
ProcVersionSignature: Ubuntu 5.3.0-62.56-generic 5.3.18
Uname: Linux 5.3.0-62-generic x86_64
ApportVersion: 2.20.11-0ubuntu8.9
Architecture: amd64
CrashDB: ubuntu
CurrentDesktop: MATE
Date: Sat Jul 18 16:53:01 2020
InstallationDate: Installed on 2019-10-19 (273 days ago)
InstallationMedia: Ubuntu-MATE 19.10 "Eoan Ermine" - Release amd64 (20191017)
PackageArchitecture: all
SourcePackage: ubuntu-release-upgrader
UpgradeStatus: No upgrade log present (probably fresh install)

Revision history for this message
Norbert (nrbrtx) wrote :
Revision history for this message
Norbert (nrbrtx) wrote :

For 18.04 LTS -> 20.04 LTS:

```
$ sudo apt update
Hit:1 http://security.ubuntu.com/ubuntu bionic-security InRelease
Hit:2 http://archive.ubuntu.com/ubuntu bionic InRelease
Hit:3 http://archive.ubuntu.com/ubuntu bionic-updates InRelease
Hit:4 http://archive.ubuntu.com/ubuntu bionic-backports InRelease
Reading package lists... Done
Building dependency tree
Reading state information... Done
All packages are up to date.

There is no development version of an LTS available.
To upgrade to the latest non-LTS develoment release
set Prompt=normal in /etc/update-manager/release-upgrades.

mate@bionic:~$ sudo do-release-upgrade -d
Checking for a new Ubuntu release
Get:1 Upgrade tool signature [1 554 B]
Get:2 Upgrade tool [1 342 kB]
Fetched 1 343 kB in 0s (0 B/s)
authenticate 'focal.tar.gz' against 'focal.tar.gz.gpg'
Authentication failed
Authenticating the upgrade failed. There may be a problem with the network or with the server.

```

So it fails.

Revision history for this message
Ubuntu QA Website (ubuntuqa) wrote :

This bug has been reported on the Ubuntu ISO testing tracker.

A list of all reports related to this bug can be found here:
http://iso.qa.ubuntu.com/qatracker/reports/bugs/1888058

tags: added: iso-testing
Revision history for this message
Haw Loeung (hloeung) wrote :

I'm not sure why this is a problem now as the old archive servers were doing the same thing. In any case, I've added the following to apache2 configs:

| AddType application/pgp-signature .gpg

Testing without:

> GET /ubuntu/dists/focal-updates/main/dist-upgrader-all/current/focal.tar.gz.gpg HTTP/1.1
> Host: archive.ubuntu.com
> ...
< Last-Modified: Thu, 16 Jul 2020 08:58:10 GMT
< ETag: "612-5aa8b3d596c80"
< Accept-Ranges: bytes
< Content-Length: 1554
< Content-Type: application/x-gzip

Testing with:

> GET /ubuntu/dists/focal-updates/main/dist-upgrader-all/current/focal.tar.gz.gpg HTTP/1.1
> Host: archive.ubuntu.com
>...
< Last-Modified: Thu, 16 Jul 2020 08:58:10 GMT
< ETag: "612-5aa8b3d596c80"
< Accept-Ranges: bytes
< Content-Length: 1554
< Content-Type: application/pgp-signature

Norbert (nrbrtx)
Changed in ubuntu-release-upgrader (Ubuntu):
status: New → Invalid
Revision history for this message
Norbert (nrbrtx) wrote :
Download full text (3.3 KiB)

There is something wrong with archive.ubuntu.com. But ru.archive.ubuntu.com works normally.

You can compare command outputs below:

```
http_proxy=http://192.168.3.222:8000 wget --server-response --no-cache -c http://archive.ubuntu.com/ubuntu/dists/focal-updates/main/dist-upgrader-all/current/focal.tar.gz
--2020-07-23 19:26:27-- http://archive.ubuntu.com/ubuntu/dists/focal-updates/main/dist-upgrader-all/current/focal.tar.gz
Connecting to 192.168.3.222:8000... connected.
Proxy request sent, awaiting response...
  HTTP/1.1 416 Requested Range Not Satisfiable
  Date: Thu, 23 Jul 2020 16:26:27 GMT
  Server: Apache/2.4.29 (Ubuntu)
  Content-Type: text/html; charset=iso-8859-1
  X-Cache: MISS from squid-deb-proxy
  X-Cache-Lookup: HIT from squid-deb-proxy:8000
  Transfer-Encoding: chunked
  Via: 1.1 squid-deb-proxy (squid/3.4.8)
  Connection: keep-alive

    The file is already fully retrieved; nothing to do.

http_proxy=http://192.168.3.222:8000 wget --server-response -c http://archive.ubuntu.com/ubuntu/dists/focal-updates/main/dist-upgrader-all/current/focal.tar.gz
--2020-07-23 19:30:08-- http://archive.ubuntu.com/ubuntu/dists/focal-updates/main/dist-upgrader-all/current/focal.tar.gz
Connecting to 192.168.3.222:8000... connected.
Proxy request sent, awaiting response...
  HTTP/1.1 200 OK
  Date: Thu, 23 Jul 2020 16:23:16 GMT
  Server: Apache/2.4.29 (Ubuntu)
  Last-Modified: Thu, 16 Jul 2020 08:58:10 GMT
  ETag: "1464d5-5aa8b3d596c80"
  Accept-Ranges: bytes
  Content-Length: 1336533
  Content-Type: application/x-gzip
  Age: 412
  X-Cache: HIT from squid-deb-proxy
  X-Cache-Lookup: HIT from squid-deb-proxy:8000
  Via: 1.1 squid-deb-proxy (squid/3.4.8)
  Connection: keep-alive

    The file is already fully retrieved; nothing to do.

---

http_proxy=http://192.168.3.222:8000 wget --server-response --no-cache -c http://ru.archive.ubuntu.com/ubuntu/dists/focal-updates/main/dist-upgrader-all/current/focal.tar.gz
--2020-07-23 19:27:11-- http://ru.archive.ubuntu.com/ubuntu/dists/focal-updates/main/dist-upgrader-all/current/focal.tar.gz
Connecting to 192.168.3.222:8000... connected.
Proxy request sent, awaiting response...
  HTTP/1.1 416 Requested Range Not Satisfiable
  Server: nginx/1.14.2
  Date: Thu, 23 Jul 2020 16:27:11 GMT
  Content-Type: text/html; charset=utf-8
  Content-Length: 213
  Content-Range: bytes */1336533
  X-Cache: MISS from squid-deb-proxy
  X-Cache-Lookup: HIT from squid-deb-proxy:8000
  Via: 1.1 squid-deb-proxy (squid/3.4.8)
  Connection: keep-alive

    The file is already fully retrieved; nothing to do.

http_proxy=http://192.168.3.222:8000 wget --server-response -c http://ru.archive.ubuntu.com/ubuntu/dists/focal-updates/main/dist-upgrader-all/current/focal.tar.gz
--2020-07-23 19:29:49-- http://ru.archive.ubuntu.com/ubuntu/dists/focal-updates/main/dist-upgrader-all/current/focal.tar.gz
Connecting to 192.168.3.222:8000... connected.
Proxy request sent, awaiting response...
  HTTP/1.1 200 OK
  Server: nginx/1.14.2
  Date: Thu, 23 Jul 2020 15:15:37 GMT
  Content-Type: application/octet-stream
  Content-Length: 1336533
  Last-Modified: Thu, 16 Jul 2020 08:58:10 GMT
  ETag: "5f1016a2-1464d5"
  Accept-Ranges: bytes
  Age: 4452
 ...

Read more...

Revision history for this message
Norbert (nrbrtx) wrote :

After refreshing Squid cache by the commands above the upgrade works normally on both archive.ubuntu.com and ru.archive.ubuntu.com .
So it was my personal problems with my squid-deb-proxy server.

I'm sorry for the buzz.

no longer affects: apache2 (Ubuntu)
Revision history for this message
Haw Loeung (hloeung) wrote :

Good to hear it isn't something on our end. Thanks for the update.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.