App Store failyres (10403) (not found)

[JF Mezei]

This is more of a FYI in case others have this problem.

Apple was Suggesting security update 2018-001 and a couple other
updates. Trying to install them failed with a 10403 error code fairly
quickly after clicking on "update".



73JqJF.tmp (error Error Domain=SUNetErrorDomain Code=10403 "not found"
UserInfo={NSLocalizedDescription=not found,
NSErrorFailingURLKey=http://swcdn.apple.com/content/downloads/58/56/091-80382/j2c656ptc4ujigs8a5j5qsfy5sb7p1cqi5/macOSBrain.pkg})
from peer: 17.253.15.205

And indeed, trying that URL in firefox woudl result in a "domain not found"

Changing the DNS for that computyer to 8.8.8.8 magically solved this.


Interestingly, my DNS server (recent version of BIND built locally (not
apple supplied) sseems to resolve it:

Non-authoritative answer:
swcdn.apple.com canonical name = swcdn.apple.com.akadns.net.
swcdn.apple.com.akadns.net canonical name = swcdn.g.aaplimg.com.
Name: swcdn.g.aaplimg.com
Address: 17.253.15.203
Name: swcdn.g.aaplimg.com
Address: 17.253.15.207


So, looking at /var/log/install.log is what provided clues on the error
message (what it couldn't find).

And I need to investigate why when my desktop is configured to use my
server's BIND server, it can't seem to resolve this.


Interestingly, the App Store had not been suggesting newer updates for
apps and the OS since I upgraded BIND (apparently) without any
complaints so until I tried to install something, I had no clue there
was a problem, just figured Apple hasn't released much new stuff for
10.13.4. (changing DNS now offered plenty of new app updates, and OS
updates as well).

[David Empson]

My best guess given the symptoms is that your server's BIND is
misconfigured in some way, e.g. it might be indefinitely caching DNS
entries received from other DNS servers and not obeying expiry and
refresh timeouts, so you were working with outdated A or CNAME records.

Apple's swcdn server was no longer at the IP address returned by your
DNS server.

Note that those domain names are supposed to be dynamic: the Akamai
and/or Apple CDN should pick the server "closest" to your DNS server. I
get different answers from `dig swcdn.apple.com` if I use my personal
hotspot vs my home broadband connection (neither of which give the same
answer as you saw).

> Interestingly, the App Store had not been suggesting newer updates for
> apps and the OS since I upgraded BIND (apparently) without any
> complaints so until I tried to install something,

There are two domains involved in the software update mechanisms (for
both system updates and apps): swscan.apple.com and swcdn.apple.com.

swscan.apple.com delivers the update catalogue. swcdn.apple.com delivers
the payload for the updates.

You were working from an outdated update catalog and wrong DNS entries,
so software update (for system updates) may have been getting errors
trying to fetch a new update catalogue and kept using an old one, or it
was actually talking to a server with an out of date catalogue and
therefore no problem was evident while checking for updates.

App updates were also not found, probably due to a server communication
error with the wrong swscan.apple.com, but App Store doesn't tell you
that.

swcdn.apple.com had definitely moved, so the problem became obvious when
you tried to install system updates, because software update couldn't
download them from the server at the old IP address.

> I had no clue there was a problem, just figured Apple hasn't released much
> new stuff for 10.13.4. (changing DNS now offered plenty of new app
> updates, and OS updates as well).

I hope that included the update to 10.13.6.

--
David Empson
dem...@actrix.gen.nz

[JF Mezei]

On 2018-09-05 02:21, David Empson wrote:

> I hope that included the update to 10.13.6.

Yep. Went from offering Security Update 2008-001 to offering 10.13.6
(no no patches/updates to it, so I assume the kit includes them or they
are not applicable).


So now I need to test my DSN server, at least I have something which I
think I can reproduce, even if it requires checking the install.log for
errors.

[David Empson]

JF Mezei <jfmezei...@vaxination.ca> wrote:

> On 2018-09-05 02:21, David Empson wrote:
>
> > I hope that included the update to 10.13.6.
>
> Yep. Went from offering Security Update 2008-001 to offering 10.13.6
> (no no patches/updates to it, so I assume the kit includes them or they
> are not applicable).

There have been two supplementary updates to 10.13.6, but both are only
for 2018 MacBook Pro models (they aren't offered to other models via
Software Update, and the manual updates from support.apple.com refuse to
install on other models).

We should expect security updates for 10.13.6 starting at the same time
or soon after 10.14 is released.

--
David Empson
dem...@actrix.gen.nz

[Lewis]

In message <tZIjD.80346$YL3....@fx48.iad> JF Mezei <jfmezei...@vaxination.ca> wrote:
> This is more of a FYI in case others have this problem.

> Apple was Suggesting security update 2018-001 and a couple other
> updates. Trying to install them failed with a 10403 error code fairly
> quickly after clicking on "update".



> 73JqJF.tmp (error Error Domain=SUNetErrorDomain Code=10403 "not found"
> UserInfo={NSLocalizedDescription=not found,
> NSErrorFailingURLKey=http://swcdn.apple.com/content/downloads/58/56/091-80382/j2c656ptc4ujigs8a5j5qsfy5sb7p1cqi5/macOSBrain.pkg})
> from peer: 17.253.15.205

> And indeed, trying that URL in firefox woudl result in a "domain not found"

> Changing the DNS for that computyer to 8.8.8.8 magically solved this.

Changing it from WHAT?

If you were using your ISPs DNS, that is generally a bad idea. If you
are using your own DNS, this is generally a terrible idea.

1.1.1.1 and 9.9.9.9 and 8.8.8.8 an 8.8.4.4 and whatever OpenDNS's
servers are are all reasonable choices.

> And I need to investigate why when my desktop is configured to use my
> server's BIND server, it can't seem to resolve this.

Because whoever you use for upstream DNS is not resolving it?

> Interestingly, the App Store had not been suggesting newer updates for
> apps and the OS since I upgraded BIND (apparently) without any
> complaints so until I tried to install something, I had no clue there
> was a problem, just figured Apple hasn't released much new stuff for
> 10.13.4. (changing DNS now offered plenty of new app updates, and OS
> updates as well).

You should probably not run your own Bind server unless you really
really need to (like you have fixed IPs and domain names that are hosted
on your Mac). It is much better to run something lightly that is just a
caching DNS server.


--
'What is this thing, anyway?' said the Dean, inspecting the implement in
his hands. 'It's called a shovel', said the Senior Wrangler. 'I've seen
the gardeners use them. You stick the sharp end in the ground. Then it
gets a bit technical.' --Reaper Man