[Solved] Opkg error: Signature check failed. Remove wrong Signature file

alex1452 · September 21, 2021, 4:41pm

I have compiled OpenWrt 21.02.0 from source. Unfortunately I get the following error message when I try to do

# opkg update
Downloading https://downloads.openwrt.org/releases/21.02.0/targets/bcm27xx/bcm27                                              11/packages/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_core
Downloading https://downloads.openwrt.org/releases/21.02.0/targets/bcm27xx/bcm27                                              11/packages/Packages.sig
Signature check failed.
Remove wrong Signature file.
Downloading https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cort                                              ex-a72/base/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_base
Downloading https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cort                                              ex-a72/base/Packages.sig
Signature check failed.
...

Did I miss to compile a packages that is required for the signature check? Any tips on how to resolve the error?

vgaetera · September 21, 2021, 5:20pm

ubus call system board; cat /etc/openwrt_release

alex1452 · September 21, 2021, 5:21pm

{
        "kernel": "5.4.143",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 3",
        "model": "Raspberry Pi 4 Model B Rev 1.1",
        "board_name": "raspberrypi,4-model-b",
        "release": {
                "distribution": "OpenWrt",
                "version": "21.02.0",
                "revision": "r16279-5cc0535800",
                "target": "bcm27xx/bcm2711",
                "description": "OpenWrt 21.02.0 r16279-5cc0535800"
        }
}
DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='21.02.0'
DISTRIB_REVISION='r16279-5cc0535800'
DISTRIB_TARGET='bcm27xx/bcm2711'
DISTRIB_ARCH='aarch64_cortex-a72'
DISTRIB_DESCRIPTION='OpenWrt 21.02.0 r16279-5cc0535800'
DISTRIB_TAINTS='busybox'

vgaetera · September 21, 2021, 5:26pm

sha256sum /etc/opkg/keys/*; \
opkg list-installed openwrt-keyring; \
grep -v -e "^#" -e "^$" /etc/opkg.conf /etc/opkg/*.conf

alex1452 · September 21, 2021, 5:28pm

d102bdd75421c62490b97f520f9db06aadb44ad408b244755d26e96ea5cd3b7f  /etc/opkg/keys/2f8b0b98e08306bf
openwrt-keyring - 2021-02-20-49283916-2
/etc/opkg.conf:dest root /
/etc/opkg.conf:dest ram /tmp
/etc/opkg.conf:lists_dir ext /var/opkg-lists
/etc/opkg.conf:option overlay_root /overlay
/etc/opkg.conf:option check_signature
/etc/opkg/distfeeds.conf:src/gz openwrt_core https://downloads.openwrt.org/releases/21.02.0/targets/bcm27xx/bcm2711/packages
/etc/opkg/distfeeds.conf:src/gz openwrt_base https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/base
/etc/opkg/distfeeds.conf:src/gz openwrt_luci https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/luci
/etc/opkg/distfeeds.conf:src/gz openwrt_packages https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/packages
/etc/opkg/distfeeds.conf:src/gz openwrt_routing https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/routing
/etc/opkg/distfeeds.conf:src/gz openwrt_telephony https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/telephony

vgaetera · September 21, 2021, 5:46pm

The firmware and package versions, keys, configs and repos look fine.
So, try restarting the device to clean its caches and check again.

alex1452 · September 21, 2021, 5:51pm

unfortunately same error after restart. do you have any other idea that could help?

vgaetera · September 21, 2021, 7:43pm

Check if this works for you:
https://openwrt.org/docs/guide-user/additional-software/opkg#verbose_opkg_update

alex1452 · September 23, 2021, 10:12am

I used that code. It is downloading the new signature file. However, I still get the same error when doing opkg update after that.

root@OpenWrt:/# rm -f -R /tmp/opkg-lists
root@OpenWrt:/# mkdir -p /tmp/opkg-lists
root@OpenWrt:/# cd /tmp/opkg-lists
root@OpenWrt:/tmp/opkg-lists# while read TYPE REPO URL
> do
> uclient-fetch -O "${REPO}.gz" "${URL}/Packages.gz"
> uclient-fetch -O "${REPO}.sig" "${URL}/Packages.sig"
> gunzip -k "${REPO}.gz"
> usign -V -P /etc/opkg/keys -m "${REPO}" 2>&1 \
> | grep -e "^OK$" && mv -f "${REPO}.gz" "${REPO}"
> done < /etc/opkg/distfeeds.conf
Downloading 'https://downloads.openwrt.org/releases/21.02.0/targets/bcm27xx/bcm2711/packages/Packages.gz'
Connecting to 168.119.138.211:443
Writing to 'openwrt_core.gz'
openwrt_core.gz      100% |*******************************| 90090   0:00:00 ETA
Download completed (90090 bytes)
Downloading 'https://downloads.openwrt.org/releases/21.02.0/targets/bcm27xx/bcm2711/packages/Packages.sig'
Connecting to 168.119.138.211:443
Writing to 'openwrt_core.sig'
openwrt_core.sig     100% |*******************************|   142   0:00:00 ETA
Download completed (142 bytes)
OK
Downloading 'https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/base/Packages.gz'
Connecting to 168.119.138.211:443
Writing to 'openwrt_base.gz'
openwrt_base.gz      100% |*******************************| 60862   0:00:00 ETA
Download completed (60862 bytes)
Downloading 'https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/base/Packages.sig'
Connecting to 168.119.138.211:443
Writing to 'openwrt_base.sig'
openwrt_base.sig     100% |*******************************|   142   0:00:00 ETA
Download completed (142 bytes)
OK
Downloading 'https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/luci/Packages.gz'
Connecting to 168.119.138.211:443
Writing to 'openwrt_luci.gz'
openwrt_luci.gz      100% |*******************************|   168k  0:00:00 ETA
Download completed (173035 bytes)
Downloading 'https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/luci/Packages.sig'
Connecting to 168.119.138.211:443
Writing to 'openwrt_luci.sig'
openwrt_luci.sig     100% |*******************************|   142   0:00:00 ETA
Download completed (142 bytes)
OK
Downloading 'https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/packages/Packages.gz'
Connecting to 168.119.138.211:443
Writing to 'openwrt_packages.gz'
openwrt_packages.gz  100% |*******************************|   446k  0:00:00 ETA
Download completed (457273 bytes)
Downloading 'https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/packages/Packages.sig'
Connecting to 168.119.138.211:443
Writing to 'openwrt_packages.sig'
openwrt_packages.sig 100% |*******************************|   142   0:00:00 ETA
Download completed (142 bytes)
OK
Downloading 'https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/routing/Packages.gz'
Connecting to 168.119.138.211:443
Writing to 'openwrt_routing.gz'
openwrt_routing.gz   100% |*******************************| 12076   0:00:00 ETA
Download completed (12076 bytes)
Downloading 'https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/routing/Packages.sig'
Connecting to 168.119.138.211:443
Writing to 'openwrt_routing.sig'
openwrt_routing.sig  100% |*******************************|   142   0:00:00 ETA
Download completed (142 bytes)
OK
Downloading 'https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/telephony/Packages.gz'
Connecting to 168.119.138.211:443
Writing to 'openwrt_telephony.gz'
openwrt_telephony.gz 100% |*******************************| 70840   0:00:00 ETA
Download completed (70840 bytes)
Downloading 'https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/telephony/Packages.sig'
Connecting to 168.119.138.211:443
Writing to 'openwrt_telephony.sig'
openwrt_telephony.si 100% |*******************************|   142   0:00:00 ETA
Download completed (142 bytes)
OK
root@OpenWrt:/tmp/opkg-lists# sha256sum /tmp/opkg-lists/*
066c97db1b39a35044d64fde85b507762caabe1b70b83f16c0ac3a37f8444e4c  /tmp/opkg-lists/openwrt_base
76832e985c9d63e1c60a1191d75f74cdff5e1466cf8081ac98d6b45afe363ab0  /tmp/opkg-lists/openwrt_base.sig
e9245d6e77e1cb1b26cb1342f6cb5ff94e426d0bc6099ae38f4ec69aa9ee93d2  /tmp/opkg-lists/openwrt_core
2975a3708fbcc485b07cffa55aa56c2b310c57f5158a716201e5b9bb1e212611  /tmp/opkg-lists/openwrt_core.sig
aa6068295885ba948492bbde0f1e6dc7e774dd3a7d70227aee46c684869416f8  /tmp/opkg-lists/openwrt_luci
a01004d04ac880aec5dc11de79b984bd829f660b3a02ef9b12abfcd142541b20  /tmp/opkg-lists/openwrt_luci.sig
2154dc520f901bfe396f0f8e8c72b28b995ade86436a73f14ad70284190296f6  /tmp/opkg-lists/openwrt_packages
96b3f888bbe13dd9de55e4974bfd0b7142ca31ef314c49f83b9c0995c9c14122  /tmp/opkg-lists/openwrt_packages.sig
b45918cc4c38e6ba6f511701265f683c43fe284aab7d1497c0aa49d84c91de0d  /tmp/opkg-lists/openwrt_routing
d58df3d9b3a274940616574fce2c9f5b6dfda11525c10ab044e2b8fb95bddae3  /tmp/opkg-lists/openwrt_routing.sig
aaa6981a2d5c65adb5bfe0fbc10c7a8d63012fdf1dfcac05f6743c152b5468e3  /tmp/opkg-lists/openwrt_telephony
fd43010bd9630277f82e37a76a9ea96dd27d900d4ea4dbb5d51dc8b50598304a  /tmp/opkg-lists/openwrt_telephony.sig

root@OpenWrt:/tmp/opkg-lists# opkg update
Downloading https://downloads.openwrt.org/releases/21.02.0/targets/bcm27xx/bcm2711/packages/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_core
Downloading https://downloads.openwrt.org/releases/21.02.0/targets/bcm27xx/bcm2711/packages/Packages.sig
Signature check failed.
Remove wrong Signature file.
Downloading https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/base/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_base
Downloading https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/base/Packages.sig
Signature check failed.
Remove wrong Signature file.
Downloading https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/luci/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_luci
Downloading https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/luci/Packages.sig
Signature check failed.
Remove wrong Signature file.
Downloading https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/packages/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_packages
Downloading https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/packages/Packages.sig
Signature check failed.
Remove wrong Signature file.
Downloading https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/routing/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_routing
Downloading https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/routing/Packages.sig
Signature check failed.
Remove wrong Signature file.
Downloading https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/telephony/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_telephony
Downloading https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/telephony/Packages.sig
Signature check failed.
Remove wrong Signature file.
Collected errors:
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/21.02.0/packages/aarch64_cortex-a72/alexpackage/Packages.gz, wget returned 8.
root@OpenWrt:/tmp/opkg-lists#

vgaetera · September 27, 2021, 8:57pm

The script downloads the lists and verifies the signatures by itself.
So, it can serve as a complete replacement for opkg update.

This is really weird that opkg update fails while the script works.
I expected the script to catch the same error to analyze it in detail.

hnyman · September 27, 2021, 9:35pm

Well, looks like the script explicitly uses uclient-fetch, while opkg seems to use gnu wget (that is apparently installed and gets automatically preference)

vgaetera · September 27, 2021, 9:44pm

Try this:

opkg remove wget\*
readlink -f $(type -p wget)
opkg update

alex1452 · September 30, 2021, 11:03am

OK, will try. Thank you!

alex1452 · October 5, 2021, 9:21am

the problem is solved. Thank you very much for your help!

tmomas · October 5, 2021, 9:29am

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.

system · October 15, 2021, 9:29am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.