CI apt "Hash Sum mismatch" - Corrupted/Stale Index Download

By Kaveh Alemi·Latchkey

apt downloaded a package index whose checksum did not match what the release file promised. Almost always a mirror caught mid-sync or a stale cached list - not a real integrity attack - and it clears once a consistent copy is fetched.

What this error means

apt-get update fails with Hash Sum mismatch, listing the index file and the expected vs received hashes. Re-running after clearing the apt lists, or once the mirror finishes syncing, succeeds.

E: Failed to fetch http://archive.ubuntu.com/.../Packages.gz  Hash Sum mismatch
   Hashes of expected file:
    - SHA256:...
   Hashes of received file:
    - SHA256:...
E: Some index files failed to download.

Common causes

The mirror was mid-sync

A mirror updating its repository can briefly serve a release file and package indexes that are out of step, so the downloaded index does not match the advertised hash.

A stale or partial cached index

A proxy/CDN serving a stale Packages file, or a partially-downloaded index in /var/lib/apt/lists, produces a checksum that no longer matches the current release.

How to fix it

Clear the apt lists and update again

Drop the cached indexes so apt fetches a fresh, consistent set.

rm -rf /var/lib/apt/lists/*
apt-get -o Acquire::Retries=5 update

Avoid a flapping mirror

1. Retry the step - once the mirror finishes syncing, the hashes line up.
2. Point at a different or internal pull-through mirror that is not mid-sync.
3. If a CDN/proxy is caching stale indexes, bypass or invalidate it for apt.

How to prevent it

• Use an internal/pull-through apt mirror for consistent indexes.
• Clear /var/lib/apt/lists before update on reused runners with cached lists.
• Enable apt retries so a transient mismatch self-corrects.

Frequently asked questions

Related guides

References

• GitHub Actions documentation