These VIB(s) on the host do not have the required sha-256 checksum for their payloads:.
Article ID: 409302
Updated On:
Products
Issue/Introduction
1) You try to upgrade ESXI host from 7.x to 8.x
2) You use custom image to upgrade.
3) On vCenter UI we get below error:
Baseline Cisco Custom_VMware-ESXi-8.0.U2-22380479
"These VIB(s) on the host do not have the required sha-256 checksum for their payloads: EMC_bootbank_emcjiraf_5223.m.186-1OEM.600.1.17.3657938 This will prevent VIB security verification and secure boot from functioning properly. Please remove these VIBs and check with your vendor for a replacement of these VIBs."
4) While checking esxupdate logs we see below entries
DD-MM-YYThh:mm:ss esxupdate: 2104528: root: INFO: Command = vib.get
DD-MM-YYThh:mm:ss esxupdate: 2104528: root: INFO: Options = {'depot': None, 'viburl': None, 'nameid': ['EMC_bootbank_emcjiraf_5223.m.186-1OEM.600.1.17.3657938'], 'profile': None, 'baseimageversion': None, 'addon': None, 'softwarespec': None, 'level': None, 'updateonly': False, 'noliveinstall': False, 'nomaintmode': False, 'force': False, 'dryrun': False, 'oktoremove': False, 'proxy': None, 'nosigcheck': False, 'pending':
None, 'rebooting': False, 'downgrade': None, 'nohwwarning': False}
DD-MM-YYThh:mm:ss esxupdate: 2104528: HostImage: INFO: Installers initiated are {'live': <vmware.esximage.Installer.LiveImageInstaller.LiveImageInstaller object at 0x46c94fce80>, 'boot': <vmware.esximage.Installer.BootBankInstaller.BootBankInstaller object at 0x46c97926d0>, 'locker': <vmware.esximage.Installer.LockerInstaller.LockerInstaller object at 0x46c9aa6460>}
DD-MM-YYThh:mm:ss esxupdate: 2104528: imageprofile: INFO: Adding VIB VMware_locker_tools-light_12.1.5.20735119-21422485 to ImageProfile (Updated) ESXi-7.0U3m-21686933-standard
DD-MM-YYThh:mm:ss esxupdate: 2104528: imageprofile: DEBUG: Adding Component VMware-VM-Tools_12.1.5.20735119-21422485 to ImageProfile (Updated) ESXi-7.0U3m-21686933-standard
DD-MM-YYThh:mm:ss esxupdate: 2104528: imageprofile: DEBUG: Removing reserved Component VMware-VM-Tools_12.1.5.20735119-21422485 in ImageProfile (Updated) ESXi-7.0U3m-21686933-standard
DD-MM-YYThh:mm:ss esxupdate: 2104528: root: ERROR: Traceback (most recent call last):
DD-MM-YYThh:mm:ss esxupdate: 2104528: root: ERROR: File "/usr/lib/vmware/esxcli-software", line 772, in <module>
DD-MM-YYThh:mm:ss esxupdate: 2104528: root: ERROR: main()
DD-MM-YYThh:mm:ss esxupdate: 2104528: root: ERROR: File "/usr/lib/vmware/esxcli-software", line 763, in main
DD-MM-YYThh:mm:ss esxupdate: 2104528: root: ERROR: ret = CMDTABLE[command](options)
DD-MM-YYThh:mm:ss esxupdate: 2104528: root: ERROR: File "/usr/lib/vmware/esxcli-software", line 564, in VibGetCmd
DD-MM-YYThh:mm:ss esxupdate: 2104528: root: ERROR: m = vibs.FindVibsByColonSpec(nameid, onevendor=False)
DD-MM-YYThh:mm:ss esxupdate: 2104528: root: ERROR: File "/lib64/python3.8/site-packages/vmware/esximage/VibCollection.py", line 439, in FindVibsByColonSpec
DD-MM-YYThh:mm:ss esxupdate: 2104528: root: ERROR: raise Errors.NoMatchError('',
DD-MM-YYThh:mm:ss esxupdate: 2104528: root: ERROR: vmware.esximage.Errors.NoMatchError: ('', "No VIB matching VIB search specification 'EMC_bootbank_emcjiraf_5223.m.186-1OEM.600.1.17.3657938'.")
We also see SHA 256 errors for multiple vibs
DD-MM-YYThh:mm:ss esxupdate: 2106296: BootBankInstaller.py: INFO: Verifying hash on vibid VMW_bootbank_vmkusb_0.1-8vmw.703.0.85.21424296, payload vmkusb, expected sha-256 hash c94cb24fc19cefb89c9e414d7d728ce495db41d98627507391f761b0ffa65542
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB BCM_bootbank_bnxtroce_216.0.65.0-1OEM.670.0.0.8169922 signature #1
DD-MM-YYThh:mm:ss esxupdate: 2106296: BootBankInstaller.py: INFO: Verifying hash on vibid BCM_bootbank_bnxtroce_216.0.65.0-1OEM.670.0.0.8169922, payload bnxtroce, expected sha-256 hash 23774ddead1ecf898a4a3fe2f427b0121d2741c022d9a243a833923daca52a04
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMW_bootbank_rste_2.0.2.0088-7vmw.703.0.20.19193900 signature #2
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: ERROR: Failed to verify VIB signature #2: ('VMW_bootbank_rste_2.0.2.0088-7vmw.703.0.20.19193900', 'Could not find a trusted signer: self signed certificate')
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMW_bootbank_rste_2.0.2.0088-7vmw.703.0.20.19193900 signature #1
DD-MM-YYThh:mm:ss esxupdate: 2106296: BootBankInstaller.py: INFO: Verifying hash on vibid VMW_bootbank_rste_2.0.2.0088-7vmw.703.0.20.19193900, payload rste, expected sha-256 hash f5097bdb1b24a9ef68037fbb04d5833c9bdee958b9875aa0dbe61f9045faf4ca
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMware_bootbank_lsuv2-hpv2-hpsa-plugin_1.0.0-3vmw.703.0.20.19193900 signature #2
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: ERROR: Failed to verify VIB signature #2: ('VMware_bootbank_lsuv2-hpv2-hpsa-plugin_1.0.0-3vmw.703.0.20.19193900', 'Could not find a trusted signer: self signed certificate')
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMware_bootbank_lsuv2-hpv2-hpsa-plugin_1.0.0-3vmw.703.0.20.19193900 signature #1
DD-MM-YYThh:mm:ss esxupdate: 2106296: BootBankInstaller.py: INFO: Verifying hash on vibid VMware_bootbank_lsuv2-hpv2-hpsa-plugin_1.0.0-3vmw.703.0.20.19193900, payload lsuv2-hp, expected sha-256 hash 1a13560161a505471bec428046addf5d01aa624688252ae2687e9ef875d02f32
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB QLC_bootbank_qcnic_2.0.62.0-1OEM.700.1.0.15843807 signature #1
DD-MM-YYThh:mm:ss esxupdate: 2106296: BootBankInstaller.py: INFO: Verifying hash on vibid QLC_bootbank_qcnic_2.0.62.0-1OEM.700.1.0.15843807, payload qcnic, expected sha-256 hash 80513c8b8fd8c3328ce103ecce0ded56f389a614dd0758e4774ed2545f27b498
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMW_bootbank_lsi-msgpt3_17.00.12.00-1vmw.703.0.20.19193900 signature #2
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: ERROR: Failed to verify VIB signature #2: ('VMW_bootbank_lsi-msgpt3_17.00.12.00-1vmw.703.0.20.19193900', 'Could not find a trusted signer: self signed certificate')
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMW_bootbank_lsi-msgpt3_17.00.12.00-1vmw.703.0.20.19193900 signature #1
DD-MM-YYThh:mm:ss esxupdate: 2106296: BootBankInstaller.py: INFO: Verifying hash on vibid VMW_bootbank_lsi-msgpt3_17.00.12.00-1vmw.703.0.20.19193900, payload lsi-msgp, expected sha-256 hash d23bf8261868a8757337335c24428703afc3cf0e20bb80081fd20667e24d255b
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB QLC_bootbank_qfle3f_2.1.26.0-1OEM.700.1.0.15843807 signature #1
DD-MM-YYThh:mm:ss esxupdate: 2106296: BootBankInstaller.py: INFO: Verifying hash on vibid QLC_bootbank_qfle3f_2.1.26.0-1OEM.700.1.0.15843807, payload qfle3f, expected sha-256 hash 68f708ccee24ef0abfb1279e2414fe093435323996cca342e5ff14ece7275120
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMware_bootbank_lsuv2-lsiv2-drivers-plugin_1.0.0-12vmw.703.0.50.20036589 signature #2
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: ERROR: Failed to verify VIB signature #2: ('VMware_bootbank_lsuv2-lsiv2-drivers-plugin_1.0.0-12vmw.703.0.50.20036589', 'Could not find a trusted signer: self signed certificate')
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMware_bootbank_lsuv2-lsiv2-drivers-plugin_1.0.0-12vmw.703.0.50.20036589 signature #1
DD-MM-YYThh:mm:ss esxupdate: 2106296: BootBankInstaller.py: INFO: Verifying hash on vibid VMware_bootbank_lsuv2-lsiv2-drivers-plugin_1.0.0-12vmw.703.0.50.20036589, payload lsuv2-ls, expected sha-256 hash 655bdd5ec980740af93f36ecbbbf8bcfe069d412586a4e75e99e0c0a1648d868
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMware_bootbank_lsuv2-oem-hp-plugin_1.0.0-1vmw.703.0.20.19193900 signature #2
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: ERROR: Failed to verify VIB signature #2: ('VMware_bootbank_lsuv2-oem-hp-plugin_1.0.0-1vmw.703.0.20.19193900', 'Could not find a trusted signer: self signed certificate')
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMware_bootbank_lsuv2-oem-hp-plugin_1.0.0-1vmw.703.0.20.19193900 signature #1
DD-MM-YYThh:mm:ss esxupdate: 2106296: BootBankInstaller.py: INFO: Verifying hash on vibid VMware_bootbank_lsuv2-oem-hp-plugin_1.0.0-1vmw.703.0.20.19193900, payload lsuv2-oe, expected sha-256 hash 86d3e12a17d1a370e62bfb1f52676f3f98cf4b80c35ede2c88fa6bc446664b9f
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB BCM_bootbank_bnxtnet_216.0.72.0-1OEM.670.0.0.8169922 signature #1
DD-MM-YYThh:mm:ss esxupdate: 2106296: BootBankInstaller.py: INFO: Verifying hash on vibid BCM_bootbank_bnxtnet_216.0.72.0-1OEM.670.0.0.8169922, payload bnxtnet, expected sha-256 hash 1830b01763faab7fe7f50ecc3cf5e31cadeaaeb22f9d97273dd51e40efa457e8
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMware_bootbank_vdfs_7.0.3-0.95.21930508 signature #2
DD-MM-YYThh:mm:ss esxupdate: 2106296: BootBankInstaller.py: INFO: Verifying hash on vibid VMware_bootbank_vdfs_7.0.3-0.95.21930508, payload vdfs, expected sha-256 hash ad944c10e6ceb5be84e25e1db4f2b9f16a10e3bfa933ed3d489449041d57c935
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMware_bootbank_trx_7.0.3-0.95.21930508 signature #2
DD-MM-YYThh:mm:ss esxupdate: 2106296: BootBankInstaller.py: INFO: Verifying hash on vibid VMware_bootbank_trx_7.0.3-0.95.21930508, payload trx, expected sha-256 hash 3811d732f3e6e20bc1c0357646fe731ae4e6b901d9a08932f5ed4c1a49afb0e7
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB Cisco_bootbank_nenic-ens_1.0.6.0-1OEM.700.1.0.15843807 signature #1
DD-MM-YYThh:mm:ss esxupdate: 2106296: BootBankInstaller.py: INFO: Verifying hash on vibid Cisco_bootbank_nenic-ens_1.0.6.0-1OEM.700.1.0.15843807, payload nenicens, expected sha-256 hash c9f29c3d06abe7d58fe7d0c319c4a10b4fe8692b3da8ad93ef5f4bd6449fb58b
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMW_bootbank_ionic-en_16.0.0-16vmw.703.0.20.19193900 signature #2
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: ERROR: Failed to verify VIB signature #2: ('VMW_bootbank_ionic-en_16.0.0-16vmw.703.0.20.19193900', 'Could not find a trusted signer: self signed certificate')
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMW_bootbank_ionic-en_16.0.0-16vmw.703.0.20.19193900 signature #1
DD-MM-YYThh:mm:ss esxupdate: 2106296: BootBankInstaller.py: INFO: Verifying hash on vibid VMW_bootbank_ionic-en_16.0.0-16vmw.703.0.20.19193900, payload ionic-en, expected sha-256 hash d820c1dd119b796ac20e35c23b9602103d04501115a5e20a98a6f749d0356c00
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMW_bootbank_mtip32xx-native_3.9.8-1vmw.703.0.20.19193900 signature #2
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: ERROR: Failed to verify VIB signature #2: ('VMW_bootbank_mtip32xx-native_3.9.8-1vmw.703.0.20.19193900', 'Could not find a trusted signer: self signed certificate')
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMW_bootbank_mtip32xx-native_3.9.8-1vmw.703.0.20.19193900 signature #1
DD-MM-YYThh:mm:ss esxupdate: 2106296: BootBankInstaller.py: INFO: Verifying hash on vibid _bootbank_emcjiraf_5223.m.186-1OEM.600.1.17.3657938, payload mtip32xx, expected sha-256 hash e44327288302e36e575fdc89d3390cc76f1b513a314951a765152ddab92a0eb6
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB EMC_bootbank_emcjiraf_5223.m.186-1OEM.600.1.17.3657938 signature #2
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: ERROR: Failed to verify VIB signature #2: ('EMC_bootbank_emcjiraf_5223.m.186-1OEM.600.1.17.3657938', 'Could not find a trusted signer: self signed certificate')
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMW_bootbank_irdman_1.3.1.22-1vmw.703.0.50.20036589 signature #1
DD-MM-YYThh:mm:ss esxupdate: 2106296: BootBankInstaller.py: INFO: Verifying hash on vibid VMW_bootbank_irdman_1.3.1.22-1vmw.703.0.50.20036589, payload irdman, expected sha-256 hash 8364563c9f8ff0fe01947ce3f7acce8d002752cae1d11f9e629872219869fc10
DD-MM-YYThh:mm:ss esxupdate: 2106296: vmware.esximage.Vib: DEBUG: Verifying VIB VMW_bootbank_ntg3_4.1.9.0-5vmw.703.0.90.21686933 signature #2
Environment
ESXI 7.X
ESXI 8.X
Cause
This issue occurs when a wrong image is installed previously.
So in this scenario, hardware is CISCO. Currently, image which we are using is:- Cisco Custom_VMware-ESXi
VIBs for which we are getting errors are EMC_bootbank_emcjiraf_5223.m.186-1OEM.600.1.17.3657938
Resolution
Please list the VIBs that are installed in ESXI host and identify the VIB that belong to different vendor.
We can use keywords as 'dell', 'emc', 'hpe' etc
For example
1) ssh to ESXI host
2) Run esxcli software vib list
Name Version Vendor Acceptance Level Install Date
----------------------------- ------------------------------------- ------ ---------------- ------------
emcjiraf 5223.m.186-1OEM.600.1.17.3657938 EMC PartnerSupported 2020-07-13
3) We need to remove all those VIBs which are wrongly installed.
For verification of thos VIBs vendor can be involved.
4) Place the ESXI host in maintenance mode.
5) Run below command to remove VIB.
esxcli software vib remove --vibname=emcjiraf
6) Reboot the ESXI host post removing all such VIBs
Feedback
