Host remediation fails with "esxupdate returned with exit status: 32"

Products

• VMware vSphere ESXi
• VMware vCenter Server

Issue/Introduction

• When attempting to remediate an ESXi host using vLCM or VUM (using baseline), the task fails with the following error:
  
  An error occurred during host configuration: /usr/sbin/esxupdate returned with exit status: 32.
  
  

• Entries from /var/log/vmware/vmware-updatemgr/vum-server/vmware-vum-server.log on vCenter server:

  
  YYYY-MM-DDTHH:MM:SS.891Z info vmware-vum-server[12053] [Originator@6876 sub=VciRemediateTask.RemediateTask{1523}] [vciTaskBase 1496] SerializeToVimFault fault:
--> (integrity.fault.VcIntegrityFault) {
-->    faultCause = (vmodl.MethodFault) null,
-->    faultMessage = <unset>
-->    msg = "Install error on host: hostname.domain.com, error details: Platform Configuration Error: /usr/sbin/esxupdate returned with exit status: 32"
--> }
--> Converted fault:
--> (vim.fault.ExtendedFault) {
-->    faultCause = (vmodl.MethodFault) null,
-->    faultMessage = <unset>,
-->    faultTypeId = "com.vmware.vcIntegrity.VcIntegrityFault",
-->    data = (vim.KeyValue) [
-->       (vim.KeyValue) {
-->          key = "faultCause",
-->          value = ""
-->       },
-->       (vim.KeyValue) {
-->          key = "faultMessage",
-->          value = ""
-->       }
-->    ]
-->    msg = "Install error on host: hostname.domain.com, error details: Platform Configuration Error: /usr/sbin/esxupdate returned with exit status: 32"
--> }
  
  

• Entries from /var/run/log/esxupdate.log from the ESXi host:
  
  YYYY-MM-DDTHH:MM:SS:52Z Er(11) esxupdate[2263566]: An esxupdate error exception was caught:
YYYY-MM-DDTHH:MM:SS:52Z Er(11) esxupdate[2263566]: Traceback (most recent call last):
YYYY-MM-DDTHH:MM:SS:52Z Er(11) esxupdate[2263566]: File "/usr/sbin/esxupdate", line 378, in main
YYYY-MM-DDTHH:MM:SS:52Z Er(11) esxupdate[2263566]: cmd.Run()
YYYY-MM-DDTHH:MM:SS:52Z Er(11) esxupdate[2263566]: File "/tmp/esx-update-2263566/lib64/python3.11/site-packages/vmware/esx5update/Cmdline.py", line 161, in Run
  ..........
  YYYY-MM-DDTHH:MM:SS:52Z Er(11) esxupdate[2263566]: esximage.Errors.ProfileValidationError: In ImageProfile (Updated) ESXi-8.0U3-24022510-standard, the payload(s) in VIB CVT_bootbank_cvtblrt_1.17.1-1OEM.600.2.34.3657939 does not have sha-256 gunzip checksum. This will prevent VIB security verification and secure boot from functioning properly. Please remove this VIB or please check with your vendor for a replacement of this VIB
YYYY-MM-DDTHH:MM:SS:52Z Er(11) esxupdate[2263566]: In ImageProfile (Updated) ESXi-8.0U3-24022510-standard, the payload(s) in VIB CVT_bootbank_cvtblrh_1.17.1-1OEM.600.2.34.3657939 does not have sha-256 gunzip checksum. This will prevent VIB security verification and secure boot from functioning properly. Please remove this VIB or please check with your vendor for a replacement of this VIB

Environment

• vCenter Server 8.x
• ESXi 8.x

Cause

• The failure is typically caused by inconsistent or corrupted metadata within the vLCM or VUM database and patch repository.
• Third-party VIBs (e.g., CVT_bootbank_cvtblrt) missing SHA-256 gunzip checksums are incompatible with the secure boot and profile integrity requirements of ESXi 8.0.

Resolution

• 1. Take a snapshot of the vCenter Server Appliance (vCSA) without memory.
  2. Log in to the vCSA via SSH.
  3. Follow the steps in Resetting VMware Update Manager database (316581) to reset the depot.
  4. Navigate to Lifecycle Manager in the vSphere Client.
  5. Trigger a fresh Synchronization of the patch repository.
  6. Re-import any necessary third-party offline bundles that were removed during the reset.
  7. Attempt host remediation again.

  To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.

•  

Additional Information

Reset VMware Lifecycle Manager depot in vCenter Server Appliance 6.5/6.7/7.0/8.0/9.x