How to identify which RPM package is associated with a specific Pulp artifact file on Red Hat Satellite 6.x?

Solution Verified - Updated

Environment

  • Red Hat Satellite 6.10 and later

Issue

  • How to identify which RPM package is associated with a specific Pulp artifact file when the artifact file no longer exists on Red Hat Satellite 6.x?

  • Our antivirus detected and deleted the following suspicious file on the Satellite server:

    /var/lib/pulp/media/artifact/4b/ddfa6a7832634a0c425e0c2db1b19eff11f9e04fa6604492c42f7f8a092092

    How to identify the RPM package which is associated with this file?

Resolution

The easiest check is running file (until the file is already deleted):

# file /var/lib/pulp/media/artifact/4b/ddfa6a7832634a0c425e0c2db1b19eff11f9e04fa6604492c42f7f8a092092
/var/lib/pulp/media/artifact/4b/ddfa6a7832634a0c425e0c2db1b19eff11f9e04fa6604492c42f7f8a092092: RPM v3.0 bin noarch efi-filesystem-6-4.el9
#

.. optionally followed by sha256sum (should match the filename and its dir, i.e. 4b concatenated with ddf..092 here) and in case the artifact comes from Red Hat, double-check it in This content is not included.portal.

If the file is really gone, use below PostgreSQL queries:

# su - postgres -c "psql pulpcore -c \"SELECT cc.relative_path FROM core_contentartifact AS cc INNER JOIN core_artifact AS ca ON cc.artifact_id = ca.pulp_id WHERE ca.file ~ '4b/ddfa6a7832634a0c425e0c2db1b19eff11f9e04fa6604492c42f7f8a092092';\""
           relative_path           
-----------------------------------
 efi-filesystem-6-4.el9.noarch.rpm
(1 row)

#

.. or to get also the affected repository and URI path within it:

# su - postgres -c "psql pulpcore -c \"SELECT DISTINCT cr.name,cpa.relative_path FROM core_repository AS cr INNER JOIN core_repositoryversion AS crv ON crv.repository_id = cr.pulp_id INNER JOIN core_publication AS cp ON cp.repository_version_id = crv.pulp_id INNER JOIN core_publishedartifact AS cpa ON cpa.publication_id = cp.pulp_id INNER JOIN core_contentartifact AS cca ON cpa.content_artifact_id = cca.pulp_id INNER JOIN core_artifact AS ca ON cca.artifact_id = ca.pulp_id WHERE ca.file ~ '4b/ddfa6a7832634a0c425e0c2db1b19eff11f9e04fa6604492c42f7f8a092092';\""
                            name                             |                relative_path                 
-------------------------------------------------------------+----------------------------------------------
 Red_Hat_Enterprise_Linux_9_for_x86_64_-_BaseOS_RPMs_9-13531 | Packages/e/efi-filesystem-6-4.el9.noarch.rpm
(1 row)

#

For more KB articles/solutions related to Red Hat Satellite 6.x Pulp 3.0 Issues, please refer to the Consolidated Troubleshooting Article for Red Hat Satellite 6.x Pulp 3.0-related Issues

Root Cause

An antivirus software installed on the Satellite server identified a pulpcore artifact file as a suspicious file and automatically deleted it.

SBR
Product(s)
Components
Category
Tags

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.