[pca] Problem downloading patches with local proxy

[Don O'Malley]

Hi Martin/Richard,

I sent this mail earlier this morning, but it didn't seem to deliver???

Anyway, in a nutshell Martin is correct. Further details:

> Hi Richard,
>
> We have identified a bug in the new Entitlement Service (i.e. in 
> getupdates2.sun.com) that is called prior to proceeding with a patch 
> download from Akamai.
> The bug usually leads to transient 403 or 500 errors from the 
> Entitlement Service, similar to what you are seeing below, though I 
> have not seen the errors persist like this on subsequent retries before.
>
> I have tested this fix in Beta over the past week now and have 
> confirmed that it will eliminate these errors (famous last words, I 
> know!).
>
> The good news is that the fix is due to be pushed to production in 
> Thursday morning (Pacific Time).
> Once this is live you should no longer see these errors (unless of 
> course you really aren't entitled to a patch, in which case you will 
> get a 403).
>
> Sorry for the inconvenience.
>
> Best,
> -Don 

To confirm the process flow is as Martin describes:
- Patch download query goes first to sunsolve as before.
- Query then gets redirected to the new download service (i.e. getupdates2).
- New download service performs an entitlement check.
- If the entitlement check is successful redirect to Akamai for patch 
download, else a 403 ereor is returned.

HTH,
-Don


Martin Paul wrote:
> Georg Schwarz wrote:
>> That's pretty much the same problem that I have. Pca is only able to
>> download patches from the akamai server. Downloads from the
>> getupdates2 server are not possible at all and fail.
>
> To be precise - the actual download will always be from the akamai 
> server. As far as I understand it:
>
> - pca/wget asks sunsolve which redirects the query to getupdates2
> - getupdates2 verifies the SOA data and the entitlement and redirects to
>   akamai if the user is allowed to get the patch.
> - the patch zip file itself is downloaded from akamai.
>
> The problem as seen in Richard's logfile is that getupdates2 denies 
> the request at first, but when it's asked often enough, it gives its 
> acknowledgement and makes the redirect to akamai. That's something 
> that must be fixed on Sun's side; actually, I was afraid that 
> splitting the sunsolve service onto three servers would end up in 
> exactly this kind of problems which are hard to track down.
>
> Martin.
>