search

arduino / Arduino

Arduino IDE 1.x
https://www.arduino.cc/en/software
Other
14.16k stars 7.02k forks source link

package_index.json file signature verification failure for some users #8988

Open per1234 opened 5 years ago

per1234 commented 5 years ago

We have had four reports of this error on the forum in the last two days. The usual trick of clearing out the data folder and trying again didn't work for any of them. One of the users, Cheetor, provided the package_index.json and package_index.json.sig files they get from https://downloads.arduino.cc/packages/package_index.json and https://downloads.arduino.cc/packages/package_index.json.sig:

I compared these to the files I download from the same URLs and found that their package_index.json file was missing the entries for Arduino SAMD Boards 1.8.1 and avrdude 6.3.0-arduino17, but no differences other than that. The checksum of their .sig file matches mine.

Cheetor is in New Zealand and one of the other reporting users (DavidBMason) is as well. The other two haven't provided their location. The problem stopped occurring for DavidBMason before I could get the bad package_index.json and package_index.json.sig files from them: https://forum.arduino.cc/index.php?topic=621637.msg4212584#msg4212584

My hypothesis is that there was a recent update to package_index.json but the new .json file didn't make it to a server that provides the files to people in NZ. However, the new .sig file did make it to that server. So they are getting the old .json file but the new .sig file, thus the signature verification. Further evidence of this is that when Cheetor used TOR with an exit node in the USA they got the new version of package_index.json: https://forum.arduino.cc/index.php?topic=621811.msg4212512#msg4212512

It would be nice if there was some way to make sure that the .json and .sig files will always hit the servers at the same time. I suspect this delay of days on the .json file is a rare glitch but if we regularly have a delay of even minutes that still is going to cause problems for people, more so because of https://github.com/arduino/Arduino/issues/8936.

Forum threads:

Xerusial commented 4 years ago

Bump for Arduino IDE 1.8.10 on Ubuntu 18.04 and Location Germany. Got the same issue today.

kevteg commented 4 years ago

I was having this issue with Arduino IDE V 1.812. I was able to solve it changing the Additional Boards Manager URLs to https://downloads.arduino.cc/packages/package_index.json

stpatrick2016 commented 4 years ago

Got the same error today (freshly installed Arduino IDE 1.8.12). Here are headers, location is Israel json.headers.txt json.sig.headers.txt

Thanks :)

UPD (2020-05-02): working properly now, thank you :)

erwinbonsma commented 4 years ago

Today I also got this error on a fresh Arduino 1.8.12 install. Here are the headers: package_index.json.header.txt package_index.json.sig.header.txt

My location is the Netherlands.

henriquelino commented 4 years ago

Update 12hrs later, now IDE works and problem is solved, in our facebook group many realated same issue, not sure if all of then are solved now. New and working jsons and headers: package_index - Copy.json.txt package_index.json - Copy.sig.txt working header - sig.txt working header.txt

Old and was not working, crashing package_index.json.sig.txt package_index.json.txt application.log.txt

I'm in Brazil, this issue started today, deleting files in Arduino15 get me to open IDE again, but as soon as those files are created, my IDE dont even open anymore.

Already reinstalled arduino IDE and java.

Header of https://downloads.arduino.cc/packages/package_index.json HTTP/2 304 Not Modified date: Tue, 09 Jun 2020 19:53:08 GMT cf-ray: 5a0d65a46a9ef677-GRU age: 659 cache-control: max-age=3600 etag: "bdfb8b1354c75cd2be921c41cd39763c" last-modified: Tue, 09 Jun 2020 15:41:23 GMT vary: Accept-Encoding via: 1.1 2e9033da1cf7b64ac622ab535b39a267.cloudfront.net (CloudFront) cf-cache-status: HIT cf-request-id: 033c3ddac10000f677d70b7200000001 expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-amz-cf-id: BRNl8Z41ZGNem4Ze19gghkfl-4TlGjBMdK2esfb2DKyzwm7UHZ2sjA== x-amz-cf-pop: MIA3-C3 x-amz-id-2: mLwSJyc1q3puS52zNu7YBQYgUmXmVuBWWeEtKd4MLnZtOKK2YDJ73rtK/J1ebfh8ooI2vhy2zrY= x-amz-replication-status: PENDING x-amz-request-id: 4630B42FB314822F x-amz-version-id: dCcX8rEv_jnZcFRzEksIFUXBQK3JRI4q x-cache: RefreshHit from cloudfront server: cloudflare alt-svc: h3-27=":443"; ma=86400 X-Firefox-Spdy: h2

And https://downloads.arduino.cc/packages/package_index.json.sig

HTTP/2 200 OK date: Tue, 09 Jun 2020 19:55:13 GMT content-type: application/pgp-signature content-length: 543 cf-ray: 5a0d68b09934f677-GRU accept-ranges: bytes age: 783 cache-control: max-age=3600 etag: "117c06a2897e79ad384744c67b2c89f3" last-modified: Tue, 09 Jun 2020 15:41:23 GMT vary: Accept-Encoding via: 1.1 52e2243a8168629f98bb0607016f7225.cloudfront.net (CloudFront) cf-cache-status: HIT cf-request-id: 033c3fc2620000f677d720f200000001 expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-amz-cf-id: rIY35Z0doDB7jG6KGeZzlavTAwNL2feJD7dG4144Gj_Pm29drqkzkg== x-amz-cf-pop: ATL51-C1 x-amz-id-2: aqOzcZTCLWsBXbkQk7lX90W/Hqs0aFKblTUshVgtox+UV9Qx1RF2qAmUfbqjC/yk4EJqSK/pK6I= x-amz-replication-status: COMPLETED x-amz-request-id: F990AA05464FF915 x-amz-version-id: gvUGiZJxSQ2dzeBeLwv_Nt_TVJceWtsN x-cache: RefreshHit from cloudfront server: cloudflare alt-svc: h3-27=":443"; ma=86400 X-Firefox-Spdy: h2

absalom-muc commented 4 years ago

Same issue in Germany

package_index.json.sig.header.txt package_index.json.header.txt

package_index.json.sig.txt package_index.json.txt

Thank you

kuba989898 commented 4 years ago

Also in Poland, run Board Manager killing Arduino installation, not starting again, version trough 1.8.8, 1.8.9, 1.8.12, in Windows and in Linux. In Ubuntu:

jakub@jakub-F7F:~/arduino-1.8.8$ ./arduino Picked up JAVA_TOOL_OPTIONS: java.lang.NullPointerException at cc.arduino.contributions.packages.ContributionsIndexer.parseIndex(ContributionsIndexer.java:124) at processing.app.BaseNoGui.initPackages(BaseNoGui.java:484) at processing.app.Base.(Base.java:268) at processing.app.Base.main(Base.java:151) jakub@jakub-F7F:~/arduino-1.8.8$

jfduhart commented 4 years ago

Same issue here in Chile (Arduino IDE 1.8.12 for Mac) Deleting package_index.json and library_index.json from Arduino15 folder is the only way to get the IDE to start without crashing, files are created every time and IDE works fine until it is closed.

package_index.json.txt library_index.json.txt

facchinm commented 4 years ago

We had a problem on our package_index.json that caused the error and prevented the IDE to start. Now the package_index has been fixed, but to recover a working installation you must delete once again the package_index.json with the cache folder and restart the IDE as usual.

Windows:

Mac:

Linux:

Please note that the problem that prevents the IDE to start has already been fixed and it's ready for the next release, that's the reason why the Nightly/Beta Builds are not affected, and also the reason why we did not detect this problem earlier, sorry about that!

giulianovaraschin commented 2 years ago

I have the same problem:

age: 2650 alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control: public, max-age=3600 cf-cache-status: HIT cf-ray: 6e11d25969564d4e-GRU content-encoding: gzip content-type: application/json date: Mon, 21 Feb 2022 17:51:15 GMT etag: W/"6a5d5920c8c262abac717297873088a2" expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" expires: Mon, 21 Feb 2022 18:51:15 GMT last-modified: Mon, 21 Feb 2022 09:00:48 GMT server: cloudflare vary: Accept-Encoding via: 1.1 978d7ccfdbed8c0e3015142e29dd5c5c.cloudfront.net (CloudFront) x-amz-cf-id: EQwmbudsNAceY0VEt1T1LcSUZ6-wX2beCnFVuVRjsY4w-OE0PcuKWg== x-amz-cf-pop: EWR53-P1 x-amz-id-2: S3szxnxMyZUi0v4pAdFCt5xd7FHRmj/6H5/hh5nZ3YI8Ap9GhFLTpwGIxwuZaaGtmBHuh0c2mpQ= x-amz-replication-status: COMPLETED x-amz-request-id: KHVD6F97T1A1JDBG x-amz-version-id: N6O__NNMoIEb.89NO8mU8Zwv3QYpjPgm x-cache: Miss from cloudfront

rsora commented 2 years ago

@giulianovaraschin can you tell us

It would be nice if you could follow this guide and report here your findings to have a clear understanding of what's going on your side

Thanks!

rsora commented 2 years ago

FYI we forced a cleanup on the CDN Arduino side, this should help to resolve your issue @giulianovaraschin