Installing from yum repo fails with HTTP 403 error

[ncraike]

Description

Attempting to follow Installation using the Apache CouchDB convenience binary packages on a RedHat/CentOS system fails to install the package with a HTTP 403 Forbidden error from the package repository.

Steps to Reproduce

yum install -y yum-utils
yum-config-manager --add-repo https://couchdb.apache.org/repo/couchdb.repo
yum install -y couchdb

Expected Behaviour

CouchDB is installed from an RPM downloaded from the repository.

Your Environment

• Operating system and version: CentOS 7.9

Additional Context

Full output from commands:

[root@45ae2b263cc5 /]# yum install -y yum-utils
Loaded plugins: ovl
There are no enabled repos.
 Run "yum repolist all" to see the repos you have.
 To enable Red Hat Subscription Management repositories:
     subscription-manager repos --enable <repo>
 To enable custom repositories:
     yum-config-manager --enable <repo>
[root@45ae2b263cc5 /]# yum-config-manager --add-repo https://couchdb.apache.org/repo/couchdb.repo
Loaded plugins: ovl
adding repo from: https://couchdb.apache.org/repo/couchdb.repo
grabbing file https://couchdb.apache.org/repo/couchdb.repo to /etc/yum.repos.d/couchdb.repo
repo saved to /etc/yum.repos.d/couchdb.repo
[root@45ae2b263cc5 /]# cat /etc/yum.repos.d/couchdb.repo 
[couchdb]
name=couchdb
baseurl=https://apache.jfrog.io/artifactory/couchdb-rpm/el$releasever/$basearch/
gpgkey=https://couchdb.apache.org/repo/keys.asc https://couchdb.apache.org/repo/rpm-package-key.asc
gpgcheck=1
repo_gpgcheck=1
enabled=1
[root@45ae2b263cc5 /]# yum install -y couchdb
Loaded plugins: ovl
https://apache.jfrog.io/artifactory/couchdb-rpm/el7/x86_64/repodata/repomd.xml: [Errno 14] HTTPS Error 403 - Forbidden
Trying other mirror.
To address this issue please refer to the below wiki article

https://wiki.centos.org/yum-errors

If above article doesn't help to resolve this issue please use https://bugs.centos.org/.



 One of the configured repositories failed (couchdb),
 and yum doesn't have enough cached data to continue. At this point the only
 safe thing yum can do is fail. There are a few ways to work "fix" this:

     1. Contact the upstream for the repository and get them to fix the problem.

     2. Reconfigure the baseurl/etc. for the repository, to point to a working
        upstream. This is most often useful if you are using a newer
        distribution release than is supported by the repository (and the
        packages for the previous distribution release still work).

     3. Run the command with the repository temporarily disabled
            yum --disablerepo=couchdb ...

     4. Disable the repository permanently, so yum won't use it by default. Yum
        will then just ignore the repository until you permanently enable it
        again or use --enablerepo for temporary usage:

            yum-config-manager --disable couchdb
        or
            subscription-manager repos --disable=couchdb

     5. Configure the failing repository to be skipped, if it is unavailable.
        Note that yum will try to contact the repo. when it runs most commands,
        so will have to try and fail each time (and thus. yum will be be much
        slower). If it is a very temporary problem though, this is often a nice
        compromise:

            yum-config-manager --save --setopt=couchdb.skip_if_unavailable=true

failure: repodata/repomd.xml from couchdb: [Errno 256] No more mirrors to try.
https://apache.jfrog.io/artifactory/couchdb-rpm/el7/x86_64/repodata/repomd.xml: [Errno 14] HTTPS Error 403 - Forbidden

[zamb3zi]

I'm having the same issue on Debian Buster:

#  apt update
Hit:1 https://security.debian.org/debian-security buster/updates InRelease
Hit:2 https://cdn-fastly.deb.debian.org/debian buster InRelease
Err:3 https://apache.jfrog.io/artifactory/couchdb-deb buster InRelease
  403  Forbidden [IP: 13.32.80.86 443]
Reading package lists... Done
E: Failed to fetch https://apache.jfrog.io/artifactory/couchdb-deb/dists/buster/InRelease  403  Forbidden [IP: 13.32.80.86 443]
E: The repository 'https://apache.jfrog.io/artifactory/couchdb-deb buster InRelease' is no longer signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

and Debian Stretch:

# apt update
Hit:1 https://security.debian.org/debian-security stretch/updates InRelease
Ign:2 https://cdn-fastly.deb.debian.org/debian stretch InRelease
Hit:4 https://deb.nodesource.com/node_8.x stretch InRelease
Hit:3 https://cdn-fastly.deb.debian.org/debian stretch Release
Ign:6 https://apache.jfrog.io/artifactory/couchdb-deb stretch InRelease
Err:7 https://apache.jfrog.io/artifactory/couchdb-deb stretch Release
  403  Forbidden
Reading package lists... Done
E: The repository 'https://apache.jfrog.io/artifactory/couchdb-deb stretch Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

[ncraike]

This seems to be resolved now, and it's possible again to install from the package repository on CentOS.

@zamb3zi I'm not sure if the Debian package repository is still having issues?

If possible, it would be good to know the underlying issue and if it's likely to happen again.

[zamb3zi]

@ncraike looks good to me now. Working in both debian stretch and buster.

[handerpeder]

Not resolved on ubuntu 21.10

$ sudo apt update
...
Ign:6 https://apache.jfrog.io/artifactory/couchdb-deb impish InRelease
Get:7 https://us.archive.ubuntu.com/ubuntu impish-security InRelease [110 kB]
Err:8 https://apache.jfrog.io/artifactory/couchdb-deb impish Release
  404   [IP: 34.210.158.172 443]
Reading package lists... Done
E: The repository 'https://apache.jfrog.io/artifactory/couchdb-deb impish Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

[nickva]

@handerpeder It's a different issue. We don't support impish Ubuntu 21.10. Try using the Ubuntu 20.04 package

https://apache.jfrog.io/ui/native/couchdb-deb/dists/

[nickva]

I verified CentOS 7 and Debian 10. After the JFrog artifactory probably was updated or had some maintenance done and was unavailable for a bit. Now it seems to be back up. Closing the issue. Thanks for reaching out, everyone!

[zamb3zi]

A similar issue has started happening today:

Get:1 https://security.debian.org/debian-security buster/updates InRelease [34.8 kB]
Hit:2 https://deb.debian.org/debian buster InRelease
Get:3 https://security.debian.org/debian-security buster/updates/contrib Sources [1,084 B]
Get:5 https://security.debian.org/debian-security buster/updates/main Sources [373 kB]
Get:6 https://security.debian.org/debian-security buster/updates/main amd64 Packages [589 kB]
Get:7 https://security.debian.org/debian-security buster/updates/main Translation-en [319 kB]
Get:8 https://security.debian.org/debian-security buster/updates/contrib amd64 Packages [3,460 B]
Get:9 https://security.debian.org/debian-security buster/updates/contrib Translation-en [1,488 B]
Get:4 https://apache.jfrog.io/artifactory/couchdb-deb buster InRelease [11.5 kB]
Err:4 https://apache.jfrog.io/artifactory/couchdb-deb buster InRelease
  Clearsigned file isn't valid, got 'NOSPLIT' (does the network require authentication?)
Reading package lists... Done
E: Failed to fetch https://apache.jfrog.io/artifactory/couchdb-deb/dists/buster/InRelease  Clearsigned file isn't valid, got 'NOSPLIT' (does the network require authentication?)
E: The repository 'https://apache.jfrog.io/artifactory/couchdb-deb buster InRelease' is no longer signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

[zamb3zi]

Note: this exactly 2 years to the day to the original issue. Certificate expiry?

[big-r81]

Thank you for the report. We are aware of the problem. The ASF Infra team is already working on it, unfortunately there is nothing we can do from our side.

[maiya22]

i am facing this issue couchdb is failing due to below error

etrieving key from https://couchdb.apache.org/repo/keys.asc
Importing GPG key 0x7A00258D:
Userid : "The Apache Software Foundation (Package repository signing key) [email protected]"
Fingerprint: 390e f70b b1ea 12b2 7739 6295 0ee6 2fb3 7a00 258d
From : https://couchdb.apache.org/repo/keys.asc
Is this ok [y/N]: y
Retrieving key from https://couchdb.apache.org/repo/rpm-package-key.asc
couchdb/7/x86_64/signature | 11 kB 00:00:03
https://apache.jfrog.io/artifactory/couchdb-rpm/el7/x86_64/repodata/repomd.xml: [Errno -1] repomd.xml signature could not be verified for couchdb
Trying other mirror.

One of the configured repositories failed (couchdb),
and yum doesn't have enough cached data to continue. At this point the only
safe thing yum can do is fail. There are a few ways to work "fix" this:

 1. Contact the upstream for the repository and get them to fix the problem.

 2. Reconfigure the baseurl/etc. for the repository, to point to a working
    upstream. This is most often useful if you are using a newer
    distribution release than is supported by the repository (and the
    packages for the previous distribution release still work).

 3. Run the command with the repository temporarily disabled
        yum --disablerepo=couchdb ...

 4. Disable the repository permanently, so yum won't use it by default. Yum
    will then just ignore the repository until you permanently enable it
    again or use --enablerepo for temporary usage:

        yum-config-manager --disable couchdb
    or
        subscription-manager repos --disable=couchdb

 5. Configure the failing repository to be skipped, if it is unavailable.
    Note that yum will try to contact the repo. when it runs most commands,
    so will have to try and fail each time (and thus. yum will be be much
    slower). If it is a very temporary problem though, this is often a nice
    compromise:

        yum-config-manager --save --setopt=couchdb.skip_if_unavailable=true

failure: repodata/repomd.xml from couchdb: [Errno 256] No more mirrors to try.
https://apache.jfrog.io/artifactory/couchdb-rpm/el7/x86_64/repodata/repomd.xml: [Errno -1] repomd.xml signature could not be verified for couchdb