Windows update catalog file

[negg]

Hi im constantly getting this...... anyone else .......??????

Code: Select all

Downloading/validating most recent Windows Update catalog file...
--2016-11-03 12:52:59--  http://download.windowsupdate.com/microsoftupdate/v6/wsusscan/wsusscn2.cab
Resolving download.windowsupdate.com... 8.254.199.78, 8.254.191.46, 8.253.82.126, ...
Connecting to download.windowsupdate.com|8.254.199.78|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 193261086 (184M) [application/vnd.ms-cab-compressed]
Saving to: `../client/wsus/wsusscn2.cab'

100%[==============================================================================>] 193,261,086 2.25M/s   in 97s

2016-11-03 12:55:00 (1.90 MB/s) - `../client/wsus/wsusscn2.cab' saved [193261086/193261086]

FINISHED --2016-11-03 12:55:00--
Downloaded: 1 files, 184M in 1m 37s (1.90 MB/s)
Verifying digital file signatures of Windows Update catalog file...
Warning: Deleted unsigned file "I:\Stuff\wsusoffline\client\wsus\wsusscn2.cab".

ERROR: Catalog file ..\client\wsus\wsusscn2.cab signature verification failure.

Note: To better help understanding this error, you can select and copy the last messages from this window using the context menu (right mouse click in the window).
Press any key to continue . . .

[aker]

MS currently serves an unsigned version of wsusscn2.cab. You'll have to wait, until they provide a signed one again. [unsigned ones get rejected by the Windows Update Agent and aren't useful in any way for wsusou]

If you've got the one last changed 2016-10-25 18:55 and signed about 03:35 (all times are GMT+1), use that one.

[boco]

Mine is signed 2016-10-27, 06:23:17AM.

Edit: Just tried a re-download and still got the signed file above.

[aker]

I just get this unsigned one:

Last changed: Freitag, ‎28. ‎Oktober ‎2016, ‏‎00:19:00

sigcheck:

Code: Select all

        Verified:       Es handelt sich nicht um eine kryptografische Meldung, oder die kryptografische Meldung hat ein falsches Format.
        File date:      23:19 27.10.2016
        Publisher:      n/a
        Company:        n/a
        Description:    n/a
        Product:        n/a
        Prod version:   n/a
        File version:   n/a
        MachineType:    n/a


hashdeep

Code: Select all

size: 193261086
md5: 1d5598a5ca0ab89d1415db40835f4e01
sha1: 18f85008091672755e84e5912789ccc9f291a5dd
sha256: 854dd0162586a99ce2385384c2ab07f5d364be2b78e3b8b14d406f18b0c10163


[boco]

Code: Select all

   Verified:   Signed
   Signing date:   06:23 AM 2016-10-27
   Publisher:   Microsoft Corporation
   Company:   n/a
   Description:   n/a
   Product:   n/a
   Prod version:   n/a
   File version:   n/a
   MachineType:   n/a

Code: Select all

size: 193261086
MD5: d5a51f11f5f77f4977abad1808402433
SHA1: ba83578f422925c7bbc020ad154e9251d5a71049
SHA256: 279be2fca08ff9c060eaacc3ba00eb1c6f19c7ec426ceaebb27fdde05d472c7b

[wgblondel]

Hi,

As aker said, MS currently serves an unsigned version of wsusscn2.cab.

You can either wait or remove the command that checks the cab signature.
The command is in the cmd\DownloadUpdates.cmd files.

Just look for

Code: Select all

for /F "skip=1 tokens=1 delims=," %%i in ('%SIGCHK_PATH% %SIGCHK_COPT% -s ..\client\wsus ^| %SystemRoot%\System32\findstr.exe /I /V "\"Signed\""') do (

and remove what's inside inside the loop.

That's what I have now :

Code: Select all

for /F "skip=1 tokens=1 delims=," %%i in ('%SIGCHK_PATH% %SIGCHK_COPT% -s ..\client\wsus ^| %SystemRoot%\System32\findstr.exe /I /V "\"Signed\""') do (
  echo Warning: NOT Deleted unsigned file %%i.
)

Of course this method is not recommended and you should only do that if you really are in a hurry.

[aker]

Removing the signature check doesn't help. The Windows Update Agent refuses to use unsigned files. wsusou won't detect any update, if wsusscn2.cab isn't aigned correctly.

[wgblondel]

Removing the signature check doesn't help. The Windows Update Agent refuses to use unsigned files. wsusou won't detect any update, if wsusscn2.cab isn't aigned correctly.

Yep, installing updates won't work, but at least you can download the updates.

[aker]

I don't see the reason for downloading updates, I can't install. But that's my opinion...

[psloss]

There's a cloud / load balancing problem: some servers are returning a properly signed wsusscn2.cab file, some are not. It appears to depend on at least time and location, as I've seen different responses depending on both of those.

Same file size of 193261086, but different Server and Last-Modified headers. The current bad file server response is unfortunately propagated through their "Footprint Distributor" network.

I was able to snag the good file and "touch" the local last write timestamp; another unfortunate detail here is that the borked file has a "newer" timestamp than the good one, so one probably has to force the good file to have a newer last write/last mod time -- at least until the next CAB is pushed out into the distribution network.

Here's the HTTP response headers with the borked file that I get almost all of the time on my primary connection:

Code: Select all

HTTP/1.1 200 OK
Cache-Control: max-age=0
Connection: close
Date: Mon, 07 Nov 2016 13:34:31 GMT
Pragma: no-cache
Content-Length: 193261086
Content-Type: application/vnd.ms-cab-compressed
Expires: Mon, 07 Nov 2016 13:34:31 GMT
Last-Modified: Thu, 27 Oct 2016 21:19:00 GMT
Accept-Ranges: bytes
Age: 0
ETag: W/"f09b56bc9730d21:0"
Server: Footprint Distributor V4.11
MSRegion: N. America
x-ccc: US
x-cid: 3
X-Powered-By: ASP.NET


When doing HTTP HEAD requests either on a metered connection or via other web services, I have seen this response:

Code: Select all

HTTP/1.1 200 OK
Cache-Control: max-age=0
Connection: close
Date: Mon, 07 Nov 2016 13:15:01 GMT
Pragma: no-cache
Content-Length: 193261086
Content-Type: application/vnd.ms-cab-compressed
Last-Modified: Thu, 27 Oct 2016 11:07:23 GMT
Accept-Ranges: bytes
ETag: "8027ea4a4230d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
X-CID: 7
X-CCC: US
X-MSEdge-Ref: Ref A: 9E98F49D74724C3A98ADF33762DDF456 Ref B: 4DC795DBF173D1E42B69D894D0C52DF0 Ref C: Mon Nov  7 05:15:02 2016 PST


The lesson going forward for me is that Microsoft's security update distribution service remains unreliable, unproductive, and I will have to more frequently download and archive verified versions of this CAB file.