"Security Update 2016-003 could not be verified" for Yosemite clients

[seabash]

All Yosemite clients fail to install "Security Update 2016-003" (031-51438) with the following error...

Installing Security Update 2016-003
Error downloading Security Update 2016-003: “Security Update 2016-003” could not be verified. It may have been corrupted or tampered with during downloading. Click Update to download and check the update again.
Done.

Error downloading updates.

Considerations:

• Yosemite clients get same error with NetSUS v3.0, v4.0 and 4.1.0
• All NetSUS running RHEL 7.2 (clean installs via .run; no upgrades)
• Manually remove and purge product_id (per reposado reference.md) did not resolve issue.
• Security Update 2016-003 for Mavericks installs successfully (single payload).
• Security Update 2016-003 for Yosemite includes 2 payloads (Firmware.pkg and SecUpd2016-003Yosemite.pkg).

Snippet from /var/log/install.log (showing 2 payloads and fatal error message)...
Jul 11 15:13:36 YosemiteMac.mydomain.com softwareupdated[29587]: Ramped updates marked Jul 11 15:13:36 YosemiteMac.mydomain.com installd[2606]: PackageKit: Adding client PKInstallDaemonClient pid=29587, uid=200 (/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated) Jul 11 15:13:36 YosemiteMac.mydomain.com installd[2606]: PackageKit: Removing client PKInstallDaemonClient pid=29587, uid=200 (/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated) Jul 11 15:13:36 YosemiteMac.mydomain.com softwareupdated[29587]: SoftwareUpdate: Added foreground transaction [0x9] for Security Update 2016-003-10.10.5 Jul 11 15:13:36 YosemiteMac.mydomain.com softwareupdated[29587]: SoftwareUpdate: starting download of 031-51438 (Security Update 2016-003-10.10.5) Jul 11 15:13:36 YosemiteMac.mydomain.com softwareupdated[29587]: ContentLocator: Modified URL is: http://exampleip:55936/content/downloads/15/58/031-51438/qjm273o5c0xevcf1d1t1i50xpdmg3mvofs/FirmwareUpdate.pkg?source=swcdn.apple.com Jul 11 15:13:36 YosemiteMac.mydomain.com softwareupdated[29587]: ContentLocator: Modified URL is: http://exampleip:55936/content/downloads/15/58/031-51438/qjm273o5c0xevcf1d1t1i50xpdmg3mvofs/SecUpd2016-003Yosemite.pkg?source=swcdn.apple.com Jul 11 15:13:49 YosemiteMac.mydomain.com softwareupdated[29587]: Finished downloading package FirmwareUpdate.pkg to file:///var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/com.apple.SoftwareUpdate/CFNetworkDownload_QTx7Sz.tmp (error (null)) Jul 11 15:13:50 YosemiteMac.mydomain.com suhelperd[29588]: Verifying package at path: /Library/Updates/031-51438/FirmwareUpdate.pkg Jul 11 15:14:15 YosemiteMac.mydomain.com softwareupdated[29587]: Finished downloading package SecUpd2016-003Yosemite.pkg to file:///var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/com.apple.SoftwareUpdate/CFNetworkDownload_UEgISR.tmp (error (null)) Jul 11 15:14:17 YosemiteMac.mydomain.com suhelperd[29588]: Verifying package at path: /Library/Updates/031-51438/SecUpd2016-003Yosemite.pkg Jul 11 15:14:17 YosemiteMac.mydomain.com softwareupdated[29587]: No more tasks - invalidating session now Jul 11 15:14:17 YosemiteMac.mydomain.com softwareupdated[29587]: SoftwareUpdate: finished download of 031-51438 Jul 11 15:14:17 YosemiteMac.mydomain.com installd[2606]: PackageKit: Adding client PKInstallDaemonClient pid=29587, uid=200 (/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated) Jul 11 15:14:17 YosemiteMac.mydomain.com installd[2606]: PackageKit: Removing client PKInstallDaemonClient pid=29587, uid=200 (/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated) Jul 11 15:14:18 YosemiteMac.mydomain.com installd[2606]: PackageKit: Adding client PKInstallDaemonClient pid=29587, uid=200 (/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated) Jul 11 15:14:18 YosemiteMac.mydomain.com softwareupdated[29587]: PackageKit: Enqueuing install with framework-specified quality of service (utility) Jul 11 15:14:18 YosemiteMac.mydomain.com installd[2606]: PackageKit: ----- Begin install ----- Jul 11 15:14:18 YosemiteMac.mydomain.com installd[2606]: PackageKit: request=PKInstallRequest <2 packages, destination=/> Jul 11 15:14:18 YosemiteMac.mydomain.com installd[2606]: PackageKit: packages=( "PKLeopardPackage <file:///Library/Updates/031-51438/SecUpd2016-003Yosemite.pkg>", "PKLeopardPackage <file:///Library/Updates/031-51438/FirmwareUpdate.pkg>" ) Jul 11 15:14:18 YosemiteMac.mydomain.com installd[2606]: PackageKit: Skipping component "com.apple.security.gkopaque" (48.0.0-1.0.0-48000000000000-*) because the version 86.0.0-1.0.0-86000000000000-1 is already installed at /private/var/db/gkopaque.bundle. Jul 11 15:14:18 YosemiteMac.mydomain.com installd[2606]: Package Authoring Warning: The deleteObsoleteLanguages flag is ignored. No languages will be removed. Jul 11 15:14:18 YosemiteMac.mydomain.com installd[2606]: PackageKit: Will do receipt-based obsoleting for package identifier com.apple.update.firmwareupdate (prefix path=/) Jul 11 15:14:18 YosemiteMac.mydomain.com installd[2606]: Package Authoring Warning: The deleteObsoleteLanguages flag is ignored. No languages will be removed. Jul 11 15:14:19 YosemiteMac.mydomain.com installd[2606]: PackageKit: Extracting file:///Library/Updates/031-51438/SecUpd2016-003Yosemite.pkg (destination=/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/DA7F3870-415C-4C38-8FE0-875A359E7903.activeSandbox/Root, uid=0) Jul 11 15:15:01 YosemiteMac.mydomain.com installd[2606]: PackageKit: Install Failed: Error Domain=PKInstallErrorDomain Code=110 "An error occurred while extracting files from the package “FirmwareUpdate.pkg”." UserInfo=0x7fdf71a98f80 {NSUnderlyingError=0x7fdf6df92b00 "archive verify failed", NSURL=file:///Library/Updates/031-51438/FirmwareUpdate.pkg, PKInstallPackageIdentifier=com.apple.update.firmwareupdate, NSLocalizedDescription=An error occurred while extracting files from the package “FirmwareUpdate.pkg”.} { NSLocalizedDescription = "An error occurred while extracting files from the package \U201cFirmwareUpdate.pkg\U201d."; NSURL = "file:///Library/Updates/031-51438/FirmwareUpdate.pkg"; NSUnderlyingError = "Error Domain=PKXARArchiveErrorDomain Code=101 \"archive verify failed\" UserInfo=0x7fdf6df6d620 {NSURL=file:///Library/Updates/031-51438/FirmwareUpdate.pkg#Scripts, NSFileOwnerAccountID=0, NSFileHFSTypeCode=0, NSFileSystemFileNumber=19534741, NSFileExtensionHidden=false, NSFileSystemNumber=16777224, NSFileSize=115531136, NSFileGroupOwnerAccountID=0, NSFileOwnerAccountName=root, NSFilePosixPermissions=420, NSFileHFSCreatorCode=0, NSFileCreationDate=2016-07-11 22:13:36 +0000, NSFileType=NSFileTypeRegular, NSFileGroupOwnerAccountName=wheel, NSFileReferenceCount=1, NSFileModificationDate=2016-07-11 22:13:49 +0000, NSLocalizedDescription=archive verify failed}"; PKInstallPackageIdentifier = "com.apple.update.firmwareupdate"; }

[seabash]

UPDATE: issue is related to OSX Server Caching service (running on same VLAN as NetSUS); disabling Caching service allows the NetSUS "Security Update 2016-003" to successfully install on Yosemite clients.

Since only the specified product was affected, I suspect the correlated product in Caching server was either corrupted or had different checksums, resulting in Yosemite clients failing to validate during install when CatalogURL was set to NetSUS.