[Bug]: Verifying integrity fails on update from 31.0.10 to 31.0.12

[piiskop]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

I let Nextcloud update from 31.0.10 to 31.0.12 and the step Verifying integrity broke the update process.

Steps to reproduce

1. Start the update from 31.0.10.
2. See that Verifying integrity fails.

Expected behavior

Verifying integrity does not fail.

Nextcloud Server version

31

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "https:\/\/nextcloud.ons.ee\/",
        "overwriteprotocol": "https",
        "htaccess.RewriteBase": "\/",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "nextcloud.ons.ee"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "31.0.12.3",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "memcache.local": "\\OC\\Memcache\\Redis",
        "filelocking.enabled": true,
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "timeout": 0,
            "dbindex": 0
        },
        "default_phone_region": "EE",
        "app_install_overwrite": {
            "0": "weather",
            "3": "multiboards",
            "4": "health",
            "5": "gpxmotion",
            "6": "gpxedit",
            "7": "drawio"
        },
        "maintenance": false,
        "theme": "",
        "loglevel": 2,
        "default_timezone": "Europe\/Tallinn",
        "auth.bruteforce.protection.enabled": false,
        "debug": false,
        "spreed": {
            "signaling_server": "http:\/\/127.0.0.1:8080",
            "shared_secret": "supersecret"
        },
        "collaboration.server.websocket.url": "wss:\/\/ons.ee\/ws"
    }
}
Cannot write into "config" directory!
This can usually be fixed by giving the web server write access to the config directory.

But, if you prefer to keep config.php file read only, set the option "config_is_read_only" to true in it.
See https://docs.nextcloud.com/server/31/go.php?to=admin-config
-bash: ./occ: Permission denied

List of activated Apps

Enabled:
  - activity: 4.0.0
  - admin_audit: 1.21.0
  - app_api: 5.0.2
  - bruteforcesettings: 4.0.0
  - calendar: 5.5.10
  - circles: 31.0.0
  - cloud_federation_api: 1.14.0
  - comments: 1.21.0
  - contacts: 7.3.9
  - contactsinteraction: 1.12.1
  - dashboard: 7.11.0
  - dav: 1.33.0
  - deck: 1.15.6
  - drawio: 3.1.2
  - federatedfilesharing: 1.21.0
  - federation: 1.21.0
  - files: 2.3.1
  - files_downloadlimit: 4.0.0
  - files_emailviewer: 0.1.5
  - files_pdfviewer: 4.0.0
  - files_reminders: 1.4.0
  - files_sharing: 1.23.2
  - files_trashbin: 1.21.0
  - files_versions: 1.24.0
  - firstrunwizard: 4.0.0
  - forms: 5.2.3
  - gpxpod: 7.2.1
  - groupfolders: 19.1.12
  - health: 2.2.2
  - integration_openproject: 2.10.1
  - logreader: 4.0.0
  - lookup_server_connector: 1.19.0
  - mail: 5.6.5
  - nextcloud_announcements: 3.0.0
  - notes: 4.12.4
  - notifications: 4.0.0
  - oauth2: 1.19.1
  - onlyoffice: 9.11.0
  - password_policy: 3.0.0
  - photos: 4.0.0
  - privacy: 3.0.0
  - profile: 1.0.0
  - provisioning_api: 1.21.0
  - recommendations: 4.0.0
  - registration: 2.8.0
  - related_resources: 2.0.0
  - serverinfo: 3.0.0
  - settings: 1.14.0
  - sharebymail: 1.21.0
  - spreed: 21.1.7
  - support: 3.0.0
  - survey_client: 3.0.0
  - systemtags: 1.21.1
  - tables: 1.0.2
  - tasks: 0.17.1
  - text: 5.0.2
  - theming: 2.6.1
  - twofactor_backupcodes: 1.20.0
  - updatenotification: 1.21.0
  - user_status: 1.11.0
  - viewer: 4.0.0
  - weather_status: 1.11.0
  - webhook_listeners: 1.2.0
  - workflowengine: 2.13.0
Disabled:
  - encryption: 2.19.0
  - files_external: 1.23.0
  - files_rightclick: 0.15.1 (installed 1.6.0)
  - maps: 1.6.0 (installed 1.6.0)
  - recognize: 9.0.9 (installed 9.0.9)
  - suspicious_login: 9.0.1
  - twofactor_nextcloud_notification: 5.0.0
  - twofactor_totp: 13.0.0-dev.0
  - user_ldap: 1.22.0
  - weather: 1.7.7
  - whiteboard: 1.5.0 (installed 1.5.0)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

Veaotsing (debug)
no app in context
Exception
dirty table reads: SELECT `filecache`.`fileid`, `storage`, `path`, `path_hash`, `filecache`.`parent`, `filecache`.`name`, `mimetype`, `mimepart`, `size`, `mtime`, `storage_mtime`, `encrypted`, `filecache`.`etag`, `filecache`.`permissions`, `checksum`, `unencrypted_size`, `metadata_etag`, `creation_time`, `upload_time`, `meta`.`json` AS `meta_json`, `meta`.`sync_token` AS `meta_sync_token` FROM `*PREFIX*filecache` `filecache` LEFT JOIN `*PREFIX*filecache_extended` `fe` ON `filecache`.`fileid` = `fe`.`fileid` LEFT JOIN `*PREFIX*files_metadata` `meta` ON `filecache`.`fileid` = `meta`.`file_id` WHERE (`path_hash` = :dcValue1) AND (`storage` = :dcValue2)

21. dets 2025, 17:47:29

Veaotsing (debug)
no app in context
Exception
dirty table reads: SELECT `filecache`.`fileid`, `storage`, `path`, `path_hash`, `filecache`.`parent`, `filecache`.`name`, `mimetype`, `mimepart`, `size`, `mtime`, `storage_mtime`, `encrypted`, `filecache`.`etag`, `filecache`.`permissions`, `checksum`, `unencrypted_size`, `metadata_etag`, `creation_time`, `upload_time`, `meta`.`json` AS `meta_json`, `meta`.`sync_token` AS `meta_sync_token` FROM `*PREFIX*filecache` `filecache` LEFT JOIN `*PREFIX*filecache_extended` `fe` ON `filecache`.`fileid` = `fe`.`fileid` LEFT JOIN `*PREFIX*files_metadata` `meta` ON `filecache`.`fileid` = `meta`.`file_id` WHERE (`path_hash` = :dcValue1) AND (`storage` = :dcValue2)

21. dets 2025, 17:47:29

Veaotsing (debug)
no app in context
Exception
dirty table reads: SELECT `path` FROM `*PREFIX*filecache` WHERE (`storage` = :dcValue1) AND (`fileid` = :dcValue2)

21. dets 2025, 17:47:29

Veaotsing (debug)
no app in context
Exception
dirty table reads: SELECT `fileid` FROM `*PREFIX*filecache` WHERE (`storage` = :dcValue1) AND (`path_hash` = :dcValue2)

21. dets 2025, 17:47:29

Veaotsing (debug)
no app in context
Exception
dirty table reads: SELECT `filecache`.`fileid`, `storage`, `path`, `path_hash`, `filecache`.`parent`, `filecache`.`name`, `mimetype`, `mimepart`, `size`, `mtime`, `storage_mtime`, `encrypted`, `filecache`.`etag`, `filecache`.`permissions`, `checksum`, `unencrypted_size`, `metadata_etag`, `creation_time`, `upload_time`, `meta`.`json` AS `meta_json`, `meta`.`sync_token` AS `meta_sync_token` FROM `*PREFIX*filecache` `filecache` LEFT JOIN `*PREFIX*filecache_extended` `fe` ON `filecache`.`fileid` = `fe`.`fileid` LEFT JOIN `*PREFIX*files_metadata` `meta` ON `filecache`.`fileid` = `meta`.`file_id` WHERE (`path_hash` = :dcValue1) AND (`storage` = :dcValue2)

21. dets 2025, 17:47:29

Veaotsing (debug)
no app in context
Exception
dirty table reads: SELECT `filecache`.`fileid`, `storage`, `path`, `path_hash`, `filecache`.`parent`, `filecache`.`name`, `mimetype`, `mimepart`, `size`, `mtime`, `storage_mtime`, `encrypted`, `filecache`.`etag`, `filecache`.`permissions`, `checksum`, `unencrypted_size`, `metadata_etag`, `creation_time`, `upload_time`, `meta`.`json` AS `meta_json`, `meta`.`sync_token` AS `meta_sync_token` FROM `*PREFIX*filecache` `filecache` LEFT JOIN `*PREFIX*filecache_extended` `fe` ON `filecache`.`fileid` = `fe`.`fileid` LEFT JOIN `*PREFIX*files_metadata` `meta` ON `filecache`.`fileid` = `meta`.`file_id` WHERE (`path_hash` = :dcValue1) AND (`storage` = :dcValue2)

21. dets 2025, 17:47:29

Veaotsing (debug)
no app in context
Exception
dirty table reads: SELECT `filecache`.`fileid`, `storage`, `path`, `path_hash`, `filecache`.`parent`, `filecache`.`name`, `mimetype`, `mimepart`, `size`, `mtime`, `storage_mtime`, `encrypted`, `filecache`.`etag`, `filecache`.`permissions`, `checksum`, `unencrypted_size`, `metadata_etag`, `creation_time`, `upload_time`, `meta`.`json` AS `meta_json`, `meta`.`sync_token` AS `meta_sync_token` FROM `*PREFIX*filecache` `filecache` LEFT JOIN `*PREFIX*filecache_extended` `fe` ON `filecache`.`fileid` = `fe`.`fileid` LEFT JOIN `*PREFIX*files_metadata` `meta` ON `filecache`.`fileid` = `meta`.`file_id` WHERE (`filecache`.`parent` = :dcValue1) AND (`storage` = :dcValue2) ORDER BY `name` ASC

21. dets 2025, 17:47:29

Veaotsing (debug)
no app in context
Exception
dirty table reads: SELECT `filecache`.`fileid`, `storage`, `path`, `path_hash`, `filecache`.`parent`, `filecache`.`name`, `mimetype`, `mimepart`, `size`, `mtime`, `storage_mtime`, `encrypted`, `filecache`.`etag`, `filecache`.`permissions`, `checksum`, `unencrypted_size`, `metadata_etag`, `creation_time`, `upload_time`, `meta`.`json` AS `meta_json`, `meta`.`sync_token` AS `meta_sync_token` FROM `*PREFIX*filecache` `filecache` LEFT JOIN `*PREFIX*filecache_extended` `fe` ON `filecache`.`fileid` = `fe`.`fileid` LEFT JOIN `*PREFIX*files_metadata` `meta` ON `filecache`.`fileid` = `meta`.`file_id` WHERE (`filecache`.`parent` = :dcValue1) AND (`storage` = :dcValue2) ORDER BY `name` ASC

21. dets 2025, 17:47:29

Veaotsing (debug)
no app in context
Exception
dirty table reads: SELECT `filecache`.`fileid`, `storage`, `path`, `path_hash`, `filecache`.`parent`, `filecache`.`name`, `mimetype`, `mimepart`, `size`, `mtime`, `storage_mtime`, `encrypted`, `filecache`.`etag`, `filecache`.`permissions`, `checksum`, `unencrypted_size`, `metadata_etag`, `creation_time`, `upload_time`, `meta`.`json` AS `meta_json`, `meta`.`sync_token` AS `meta_sync_token` FROM `*PREFIX*filecache` `filecache` LEFT JOIN `*PREFIX*filecache_extended` `fe` ON `filecache`.`fileid` = `fe`.`fileid` LEFT JOIN `*PREFIX*files_metadata` `meta` ON `filecache`.`fileid` = `meta`.`file_id` WHERE (`path_hash` = :dcValue1) AND (`storage` = :dcValue2)

21. dets 2025, 17:47:29

Info
updater
OC\Repair\Events\RepairInfoEvent: Repair info: Image cache cleared

21. dets 2025, 17:47:29

Info
updater
OC\Repair\Events\RepairStepEvent: Repair step: Clear frontend caches

21. dets 2025, 17:47:29

Veaotsing (debug)
no app in context
Exception
dirty table reads: SELECT `id` FROM `*PREFIX*jobs` WHERE (`class` = :dcValue1) AND (`argument_hash` = :dcValue2) LIMIT 1

21. dets 2025, 17:47:29

Info
updater
OC\Repair\Events\RepairStepEvent: Repair step: Add log rotate job

21. dets 2025, 17:47:29

Info
updater
OC\Repair\Events\RepairStepEvent: Repair step: Repair language codes

21. dets 2025, 17:47:29

Info
updater
OC\Repair\Events\RepairInfoEvent: Repair info: Delete clients (and their related access tokens) with the redirect_uri starting with oc:// or ending with *

21. dets 2025, 17:47:29

Info
updater
OC\Repair\Events\RepairInfoEvent: Repair info: Update the oauth2_clients table schema.

21. dets 2025, 17:47:28

Info
updater
OC\Repair\Events\RepairInfoEvent: Repair info: Update the oauth2_access_tokens table schema.

21. dets 2025, 17:47:28

Info
updater
OC\Repair\Events\RepairStepEvent: Repair step: Migrate oauth2_clients table to nextcloud schema

21. dets 2025, 17:47:27

Info
updater
OC\Repair\Events\RepairStepEvent: Repair step: Add preview cleanup background jobs

21. dets 2025, 17:47:27

Info
updater
OC\Repair\Events\RepairInfoEvent: Repair info: Repair step already executed

21. dets 2025, 17:47:27

Info
updater
OC\Repair\Events\RepairStepEvent: Repair step: Add move avatar background job

21. dets 2025, 17:47:27

Additional info

No response

[joshtrichards]

I don't see any integrity related output in your report?

[susnux]

The integrity section of the report is missing, likely because of this:

-bash: ./occ: Permission denied

[GrokNot]

I encountered a very similar issue when updating last night from 30.0.14.1 to 30.0.17 using https://download.nextcloud.com/server/releases/nextcloud-30.0.17.tar.bz2 on Ubuntu 24.04.3 LTS. I reverted to my pre-upgrade snapshot (Hyper-V checkpoint with matching NetApp snapshot) and ran the update manually. That is when I verified that the extra files were not on disk before I started, and that they came from the tarball AND were not in the apps' manifest files (signature.json). When I got the warnings about EXTRA_FILE (306 files across 26 apps) I tried "occ integrity:check-app' (among other things). The base issue is that there is no signed entries for those files.

I can upload the ".../index.php/settings/integrity/failed" output if you would like. OR should I start a new ticket since this is for a different release?

[susnux]

@GrokNot Nextcloud 30 is end of life since 2025-10-23, so its recommended to update to Nextcloud 31 or later.

[GrokNot]

@susnux Agreed, and I will upgrade to 31 shortly. But, the fact that the manifests (signature.json) files are not being updated in both streams (30 and 31) suggests either a breakdown in the build and packaging process, or worse, someone injected something into the github or tarballs.

[joshtrichards]

But, the fact that the manifests (signature.json) files are not being updated in both streams (30 and 31) suggests either a breakdown in the build and packaging process, or worse, someone injected something into the github or tarballs.

That's pure speculation until someone provides the actual output. Given no other reports, I find this unlikely.

[GrokNot]

That's why I asked if you wanted the upload here or in a different ticket. I'll add mine here ... (sorry to OP for hijacking the ticket)

nextcloud_extra_files.txt