[pca] Problem downloading patches with local proxy

[Don O'Malley]

Trying to resend again; third time lucky maybe... :)

Don O'Malley wrote:
> Hi Martin/Richard,
>
> I sent this mail earlier this morning, but it didn't seem to deliver???
>
> Anyway, in a nutshell Martin is correct. Further details:
>
>> Hi Richard,
>>
>> We have identified a bug in the new Entitlement Service (i.e. in 
>> getupdates2.sun.com) that is called prior to proceeding with a patch 
>> download from Akamai.
>> The bug usually leads to transient 403 or 500 errors from the 
>> Entitlement Service, similar to what you are seeing below, though I 
>> have not seen the errors persist like this on subsequent retries before.
>>
>> I have tested this fix in Beta over the past week now and have 
>> confirmed that it will eliminate these errors (famous last words, I 
>> know!).
>>
>> The good news is that the fix is due to be pushed to production in 
>> Thursday morning (Pacific Time).
>> Once this is live you should no longer see these errors (unless of 
>> course you really aren't entitled to a patch, in which case you will 
>> get a 403).
>>
>> Sorry for the inconvenience.
>>
>> Best,
>> -Don 
>
> To confirm the process flow is as Martin describes:
> - Patch download query goes first to sunsolve as before.
> - Query then gets redirected to the new download service (i.e. 
> getupdates2).
> - New download service performs an entitlement check.
> - If the entitlement check is successful redirect to Akamai for patch 
> download, else a 403 ereor is returned.
>
> HTH,
> -Don
>
>
> Martin Paul wrote:
>> Georg Schwarz wrote:
>>> That's pretty much the same problem that I have. Pca is only able to
>>> download patches from the akamai server. Downloads from the
>>> getupdates2 server are not possible at all and fail.
>>
>> To be precise - the actual download will always be from the akamai 
>> server. As far as I understand it:
>>
>> - pca/wget asks sunsolve which redirects the query to getupdates2
>> - getupdates2 verifies the SOA data and the entitlement and redirects to
>>   akamai if the user is allowed to get the patch.
>> - the patch zip file itself is downloaded from akamai.
>>
>> The problem as seen in Richard's logfile is that getupdates2 denies 
>> the request at first, but when it's asked often enough, it gives its 
>> acknowledgement and makes the redirect to akamai. That's something 
>> that must be fixed on Sun's side; actually, I was afraid that 
>> splitting the sunsolve service onto three servers would end up in 
>> exactly this kind of problems which are hard to track down.
>>
>> Martin.
>>
>