openSUSE admin

Any news? :-)

If you can add a list of which mirrors are returning 404, that would help.

Sadly I can't. This was reported by one of the members of the QAM team, but when I tried to reproduce (several times), it seems I could not hit the same mirror. I guess because Europe has more than US.

I will change our CI to point again to http://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2, and if we can't reproduce in a few days, we'll assume it was "automagically" fixed, as the US mirror.

Just for self-reference, in case we need to rollback again if we find issues: https://github.com/uyuni-project/sumaform/pull/934

juliogonzalezgil wrote:

If you can add a list of which mirrors are returning 404, that would help.

Sadly I can't. This was reported by one of the members of the QAM team, but when I tried to reproduce (several times), it seems I could not hit the same mirror. I guess because Europe has more than US.

The mirrorlist will always show you all of the available mirrors.

Yes, but when we had the problem, download.opensuse.org was offering as a mirror one of the mirrors that didn't have the file. So I guess the mirror was present at the mirrorlist file?

Anyway, I used curl for all the European mirrors and:

https://ftp.halifax.rwth-aachen.de/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 403
https://opensuse.ipacct.com/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 403
https://ftp.byfly.by/pub/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> I fail to connect from my location
http://mirror.hostsuisse.com/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 403
https://ftp.sh.cvut.cz/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404
https://quantum-mirror.hu/mirrors/pub/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404
https://opensuse.mirror.garr.it/mirrors/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404
https://opensuse.mirror.liteserver.nl//distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404
https://fastmirror.pp.ua/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404

So it seems quite a few mirrors are still not working, and my guess was correct? downloading.opensuse.org offers the mirrors even if they don't have the file?

As for the rest of the world:

http://mirrors.ustc.edu.cn/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> I fail to connect from my location (normal, I guess)
https://mirror.bjtu.edu.cn/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> I fail to connect from my location (normal, I guess)
https://mirrors.bfsu.edu.cn/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> I fail to connect from my location (normal, I guess)
https://mirrors.tuna.tsinghua.edu.cn/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> I fail to connect from my location (normal, I guess)
https://mirror.cedia.org.ec/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> I fail to connect from my location (normal, I guess)
https://mirror.telkomuniversity.ac.id/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404
https://ftp.kddilabs.jp/Linux/packages/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 403
https://opensuse.mirrors.theom.nz/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404
https://mirror.csclub.uwaterloo.ca/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404
https://suse.mobile-central.org//distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404

juliogonzalezgil wrote:

Yes, but when we had the problem, download.opensuse.org was offering as a mirror one of the mirrors that didn't have the file. So I guess the mirror was present at the mirrorlist file?

That could be a problem with the mirror scanner (olaf), if it has not picked up that a mirror does not have a file.

https://ftp.halifax.rwth-aachen.de/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 403
https://opensuse.ipacct.com/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 403
https://ftp.byfly.by/pub/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> I fail to connect from my location
https://mirror.hostsuisse.com/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 403
https://ftp.sh.cvut.cz/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404
https://quantum-mirror.hu/mirrors/pub/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404
https://opensuse.mirror.garr.it/mirrors/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404
https://opensuse.mirror.liteserver.nl//distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404
https://fastmirror.pp.ua/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404
http://mirrors.ustc.edu.cn/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> I fail to connect from my location (normal, I guess)
https://mirror.bjtu.edu.cn/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> I fail to connect from my location (normal, I guess)
https://mirrors.bfsu.edu.cn/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> I fail to connect from my location (normal, I guess)
https://mirrors.tuna.tsinghua.edu.cn/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> I fail to connect from my location (normal, I guess)
https://mirror.cedia.org.ec/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> I fail to connect from my location (normal, I guess)
https://mirror.telkomuniversity.ac.id/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404
https://ftp.kddilabs.jp/Linux/packages/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 403
https://opensuse.mirrors.theom.nz/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404
https://mirror.csclub.uwaterloo.ca/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404
https://suse.mobile-central.org//distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404

Normally mirrors don't block anyone outright, but a connection to Indonesia might be very slow from outside Indonesia.
Most of our mirrors do not support https, but when I use http, except http://mirror.telkomuniversity.ac.id/, all of the above worked.

pjessen wrote:

Most of our mirrors do not support https, but when I use http, except http://mirror.telkomuniversity.ac.id/, all of the above worked.

I suggest you use http when accessing download.o.o/mirrors, then there should be no issue. If that works, we can close this as resolved.

I don't really understand your suggestion. We don't call the mirrors directly. We called https://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2

In fact https://get.opensuse.org/leap#download points to https://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 if you review the source code, so users could be having this very same problem. If that's wrong, then all links everywhere to download.opensuse.org should change to http.

But anyway, shouldn't https://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 redirect to the mirror according to http://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2.mirrorlist and therefore use http or https according to the information there?

But anyway, some mirrors are still broken even on HTTP.

For example:

http://mirror.telkomuniversity.ac.id/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404
https://mirror.telkomuniversity.ac.id/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404

And this mirror is still at https://mirrorcache.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2.mirrorlist and listed as https (and not as http).

As far as I can tell by using curl -L against all URLs, that's the only one broken as of today.

juliogonzalezgil wrote:

I don't really understand your suggestion. We don't call the mirrors directly. We called https://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2

Use http://download.opensuse.org/ instead of https://download.opensuse.org/

In fact https://get.opensuse.org/leap#download points to https://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 if you review the source code, so users could be having this very same problem. If that's wrong, then all links everywhere to download.opensuse.org should change to http.

There is some or other reason why get.opensuse.org has https://download.opensuse.org, I can't remember why. Something to do with chrome/ium.

But anyway, shouldn't https://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 redirect to the mirror according to http://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2.mirrorlist and therefore use http or https according to the information there?

Well, https://download.opensuse.org is redirected to mirrorcache, some bolt-on solution that is supposed to handle https. I don't know how well that currently works.

But anyway, some mirrors are still broken even on HTTP.

Yeah, that is always a possibility, but it should not upset your downloads.

For example:

http://mirror.telkomuniversity.ac.id/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404

That is a weird one, the file is listed in the directory, but still gives a 404. The scanner will not know that.

pjessen wrote:

juliogonzalezgil wrote:

I don't really understand your suggestion. We don't call the mirrors directly. We called https://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2

Use http://download.opensuse.org/ instead of https://download.opensuse.org/

Yes, I could understand that. What I don't understand is why that should make a difference. The mirrordirector should point to the right URL for the mirror (HTTP or HTTPS) according to the lists.

In fact https://get.opensuse.org/leap#download points to https://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 if you review the source code, so users could be having this very same problem. If that's wrong, then all links everywhere to download.opensuse.org should change to http.

There is some or other reason why get.opensuse.org has https://download.opensuse.org, I can't remember why. Something to do with chrome/ium.

HTTPS is becoming mandatory on chromium, if you don't want to get a security alert. And there's a very good reason for that: even if credentials are not being exchanged, the connection happens in clear text and anyone can see what you are doing (even if that only means you are downloading openSUSE Leap)

But anyway, shouldn't https://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 redirect to the mirror according to http://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2.mirrorlist and therefore use http or https according to the information there?

Well, https://download.opensuse.org is redirected to mirrorcache, some bolt-on solution that is supposed to handle https. I don't know how well that currently works.

Ok, but anyway: how can be possible that I get 404 for a mirror that doesn't support HTTPS? In that case the connection should just fail because connecting to port 443 does not work.

But anyway, some mirrors are still broken even on HTTP.

Yeah, that is always a possibility, but it should not upset your downloads.

Well, if I call http://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 and the mirrordirector points me to a mirror that causes 404, the download will fail. How is it that it will not upset the downloads?

For example:

http://mirror.telkomuniversity.ac.id/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404

That is a weird one, the file is listed in the directory, but still gives a 404. The scanner will not know that.

No idea. I saw so many strange things with the syncing to mirrors at this point, that could be a problem with a mirror failing to sync a rebuild of the same filename, or who knows what else. But looks to me like the indonesian users (and I guess people from Indian/Pacific oceans area) will hit this. Not sure if you can talk to the mirror, or at least remove it from the mirror director.

As for us, OK, we'll use http. But not sure if you want to keep the issue open. This should work transparently for the users, regardless of HTTP or HTTPS being used :-)

juliogonzalezgil wrote:

pjessen wrote:

juliogonzalezgil wrote:

I don't really understand your suggestion. We don't call the mirrors directly. We called https://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2

Use http://download.opensuse.org/ instead of https://download.opensuse.org/

Yes, I could understand that. What I don't understand is why that should make a difference. The mirrordirector should point to the right URL for the mirror (HTTP or HTTPS) according to the lists.

In a nutshell - our Mirrorbrain does not support https. We do not keep track of which mirrors support https and which don't. Mirrorcache may or may not help, I don't know. The best solution is to revert to http.

But anyway, shouldn't https://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 redirect to the mirror according to http://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2.mirrorlist and therefore use http or https according to the information there?

Well, https://download.opensuse.org is redirected to mirrorcache, some bolt-on solution that is supposed to handle https. I don't know how well that currently works.

Ok, but anyway: how can be possible that I get 404 for a mirror that doesn't support HTTPS? In that case the connection should just fail because connecting to port 443 does not work.

In principle yes, but in practice it is not quite so simple - it depends on the mirror setup on the other end. As far as we are concerned, https is not supported, but a mirror may still have it, or maybe it doesn't work or maybe is isn't quite finished.

But anyway, some mirrors are still broken even on HTTP.

Yeah, that is always a possibility, but it should not upset your downloads.

Well, if I call http://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 and the mirrordirector points me to a mirror that causes 404, the download will fail. How is it that it will not upset the downloads?

Your client will pick the next mirror instead, I expect? That is what zypper does.

For example:

http://mirror.telkomuniversity.ac.id/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404

That is a weird one, the file is listed in the directory, but still gives a 404. The scanner will not know that.

No idea. I saw so many strange things with the syncing to mirrors at this point, that could be a problem with a mirror failing to sync a rebuild of the same filename, or who knows what else. But looks to me like the indonesian users (and I guess people from Indian/Pacific oceans area) will hit this. Not sure if you can talk to the mirror, or at least remove it from the mirror director.

Yeah, see #96687.

As for us, OK, we'll use http. But not sure if you want to keep the issue open. This should work transparently for the users, regardless of HTTP or HTTPS being used :-)

I agree completely, but I'm afraid it's not my issue. As far as I am concerned, our mirroring infrastructure only supports http. Anyone trying https is diverted to "mirrorcache", maybe it works.

pjessen wrote:

juliogonzalezgil wrote:

pjessen wrote:

juliogonzalezgil wrote:

I don't really understand your suggestion. We don't call the mirrors directly. We called https://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2

Use http://download.opensuse.org/ instead of https://download.opensuse.org/

Yes, I could understand that. What I don't understand is why that should make a difference. The mirrordirector should point to the right URL for the mirror (HTTP or HTTPS) according to the lists.

In a nutshell - our Mirrorbrain does not support https. We do not keep track of which mirrors support https and which don't. Mirrorcache may or may not help, I don't know. The best solution is to revert to http.

I don't understand. Then how is it that the .mirrorlist file actually has mirrors with http (some) and mirrors with https (most)?

For example https://mirrorcache.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2.mirrorlist

But anyway, shouldn't https://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 redirect to the mirror according to http://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2.mirrorlist and therefore use http or https according to the information there?

Well, https://download.opensuse.org is redirected to mirrorcache, some bolt-on solution that is supposed to handle https. I don't know how well that currently works.

Ok, but anyway: how can be possible that I get 404 for a mirror that doesn't support HTTPS? In that case the connection should just fail because connecting to port 443 does not work.

In principle yes, but in practice it is not quite so simple - it depends on the mirror setup on the other end. As far as we are concerned, https is not supported, but a mirror may still have it, or maybe it doesn't work or maybe is isn't quite finished.

But I guess you are aware that some of the mirrors are actually enforcing HTTPS even if you call http://download.opensuse.org just happened right now.

`$ curl -L -v http://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2

• Trying 2001:67c:2178:8::13...
• TCP_NODELAY set
• Expire in 149996 ms for 3 (transfer 0x55f79f70ae20)
• Expire in 200 ms for 4 (transfer 0x55f79f70ae20)
• Trying 195.135.221.134...
• TCP_NODELAY set
• Expire in 149996 ms for 3 (transfer 0x55f79f70ae20)
• Connected to download.opensuse.org (195.135.221.134) port 80 (#0) > GET /distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 HTTP/1.1 > Host: download.opensuse.org > User-Agent: curl/7.64.0 > Accept: / > < HTTP/1.1 302 Found < Date: Mon, 09 Aug 2021 20:40:15 GMT < Server: Apache/2.4.43 (Linux/SUSE) < X-MirrorBrain-Mirror: twrepo.opensuse.id < X-MirrorBrain-Realm: AS < Link: http://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2.meta4; rel=describedby; type="application/metalink4+xml" < Link: http://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2.torrent; rel=describedby; type="application/x-bittorrent" < Link: http://twrepo.opensuse.id/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-15.3-OpenStack-Cloud-Build9.161.qcow2; rel=duplicate; pri=1; geo=sg < Link: http://opensuse.mirrors.proxad.net/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-15.3-OpenStack-Cloud-Build9.161.qcow2; rel=duplicate; pri=2; geo=fr < Link: http://fr2.rpmfind.net/linux/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-15.3-OpenStack-Cloud-Build9.161.qcow2; rel=duplicate; pri=3; geo=fr < Link: http://mirrors.coreix.net/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-15.3-OpenStack-Cloud-Build9.161.qcow2; rel=duplicate; pri=4; geo=gb < Link: http://ftp.halifax.rwth-aachen.de/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-15.3-OpenStack-Cloud-Build9.161.qcow2; rel=duplicate; pri=5; geo=de < Digest: MD5=ZCJOebi7HAqIy0gKXsbc6w== < Digest: SHA=mqzIySnaYpyrtEgEJioshtWLeG0= < Digest: SHA-256=M12piE/jkvw/3gZCyjRmPB5tpbwqwHlj+4HIL5HZYWg= < Location: http://twrepo.opensuse.id/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-15.3-OpenStack-Cloud-Build9.161.qcow2 < Content-Length: 403 < Content-Type: text/html; charset=iso-8859-1 <
• Ignoring the response-body
• Connection #0 to host download.opensuse.org left intact
• Issue another request to this URL: 'http://twrepo.opensuse.id/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-15.3-OpenStack-Cloud-Build9.161.qcow2
• Trying 45.84.58.26...
• TCP_NODELAY set
• Expire in 200 ms for 4 (transfer 0x55f79f70ae20)
• Connected to twrepo.opensuse.id (45.84.58.26) port 80 (#1) > GET /distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-15.3-OpenStack-Cloud-Build9.161.qcow2 HTTP/1.1 > Host: twrepo.opensuse.id > User-Agent: curl/7.64.0 > Accept: / > < HTTP/1.1 301 Moved Permanently < Server: nginx < Date: Mon, 09 Aug 2021 20:40:16 GMT < Content-Type: text/html < Content-Length: 162 < Connection: keep-alive < Location: https://twrepo.opensuse.id/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-15.3-OpenStack-Cloud-Build9.161.qcow2 <
• Ignoring the response-body
• Connection #1 to host twrepo.opensuse.id left intact
• Issue another request to this URL: 'https://twrepo.opensuse.id/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-15.3-OpenStack-Cloud-Build9.161.qcow2' `

But anyway, some mirrors are still broken even on HTTP.

Yeah, that is always a possibility, but it should not upset your downloads.

Well, if I call http://download.opensuse.org/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 and the mirrordirector points me to a mirror that causes 404, the download will fail. How is it that it will not upset the downloads?

Your client will pick the next mirror instead, I expect? That is what zypper does.

No, zypper does that, but it doesn't happen if you are using any browser to download an image, and doesn't happen when using terraform + libvirt provider (which in the end just calls libvirt for the image download AFAIK). Still, even if we could fix this on libvirt or the libvirt provider, it will not fix the issues for any user downloading images using a browser.

For example:

http://mirror.telkomuniversity.ac.id/opensuse/distribution/leap/15.3/appliances/openSUSE-Leap-15.3-JeOS.x86_64-OpenStack-Cloud.qcow2 -> 404

That is a weird one, the file is listed in the directory, but still gives a 404. The scanner will not know that.

No idea. I saw so many strange things with the syncing to mirrors at this point, that could be a problem with a mirror failing to sync a rebuild of the same filename, or who knows what else. But looks to me like the indonesian users (and I guess people from Indian/Pacific oceans area) will hit this. Not sure if you can talk to the mirror, or at least remove it from the mirror director.

Yeah, see #96687.

As for us, OK, we'll use http. But not sure if you want to keep the issue open. This should work transparently for the users, regardless of HTTP or HTTPS being used :-)

I agree completely, but I'm afraid it's not my issue. As far as I am concerned, our mirroring infrastructure only supports http. Anyone trying https is diverted to "mirrorcache", maybe it works.

I admit I am a complete ignorant, but I understand http://download.opensuse.org = "our mirroring infrastructure", while "https://download.opensuse.org" is mirrorcache?

In any case, I already raised the issue that could happen for users downloading images via https://get.opensuse.org/leap#download (not to mention a lot of places such as https://en.opensuse.org/KDE3 mention https://download.opensuse.org).

As for us, I will just change our terraform code to always use http, so the issue can be closed :-)