Resolving ‘Hash Sum mismatch’ on Ubuntu 22.04 LTS apt-get update

Fix 'Hash Sum mismatch' errors on Ubuntu 22.04 LTS apt-get update. This guide covers common causes like corrupted caches, mirror issues, and network problems.

When managing Ubuntu systems, especially servers in web hosting environments, apt-get update is a fundamental command used to synchronize the local package index with the upstream repositories. Encountering a "Hash Sum mismatch" error can be a significant roadblock, preventing you from installing security updates, new software, or essential system patches. This guide provides a deep dive into diagnosing and resolving this stubborn issue specifically on Ubuntu 22.04 LTS.

Symptom & Error Signature

The primary symptom is the failure of sudo apt update or sudo apt-get update to complete successfully. Instead of a clean output showing package lists being read and built, you'll see errors indicating a discrepancy in the downloaded files' cryptographic hashes.

Typical error output:

Err:1 http://archive.ubuntu.com/ubuntu jammy InRelease
  Hash Sum mismatch
Hashes of expected file:
 - Filesize:190186 [weak]
 - MD5Sum:f82163351d5c5a04e90868f07a4a9844 [weak]
 - SHA1:823a31c19b06f2e240243292496a7d571630137d [weak]
 - SHA256:d8c6b7d1e0f0c0d1b2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5
 - SHA512:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
 - T_MD5Sum:54321fedcba987654321fedcba98765 [weak]
 - T_SHA1:fedcba987654321fedcba987654321fedcba98765 [weak]
Actual content length: 190186
Get:2 http://security.ubuntu.com/ubuntu jammy-security InRelease [110 kB]
Ign:3 http://archive.ubuntu.com/ubuntu jammy-updates InRelease
Ign:4 http://archive.ubuntu.com/ubuntu jammy-backports InRelease
Err:5 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
  Hash Sum mismatch
  Hashes of expected file:
   - Filesize:123456 [weak]
   - SHA256:fedcba987654321fedcba987654321fedcba987654321fedcba987654321fedcba
  Actual content length: 123450
Fetched 110 kB in 1s (123 kB/s)
Reading package lists... Error!
E: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/jammy/InRelease  Hash Sum mismatch
E: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/jammy-updates/main/binary-amd64/Packages  Hash Sum mismatch
E: Some index files failed to download. They have been ignored, or old ones used instead.

The error typically points to InRelease or Packages files from various repositories (main, security, updates, backports, etc.).

Root Cause Analysis

The "Hash Sum mismatch" error occurs when the apt package manager downloads a file (e.g., InRelease, Release, Packages file) from a repository and its cryptographic hash (MD5, SHA1, SHA256, etc.) does not match the expected hash recorded in the main Release or InRelease file from that same repository. apt relies on these hashes to verify the integrity and authenticity of package lists and packages. If they don't match, apt assumes the downloaded data is corrupted or tampered with and refuses to proceed, which is a critical security measure.

Common underlying causes include:

1. Corrupted Local APT Cache: The most frequent culprit. Previously downloaded partial or corrupted index files in /var/lib/apt/lists/ can interfere with new downloads, leading to mismatches.
2. Repository Mirror Synchronization Issues: Ubuntu repositories are distributed across numerous mirrors worldwide. If a mirror is not fully synchronized, or if it's serving outdated package lists while the main Release file has been updated, apt will detect a mismatch. This is common if you're using a geographically close mirror that is slow to update.
3. Network Intermediaries (Proxies, CDNs, Firewalls):
   • HTTP/HTTPS Proxies: Corporate proxies or local caching proxies (like Squid) might cache old versions of files, modify headers, or inject content, causing the downloaded file's hash to differ from the expected one.
   • Content Delivery Networks (CDNs): Sometimes, the CDN layer used by repository mirrors can experience propagation delays or serve stale content from different edge locations.
   • Network Address Translation (NAT) and Firewalls: Less common, but misconfigured NAT or transparent proxies could theoretically corrupt data streams.
4. DNS Resolution Problems: An incorrect or stale DNS entry might direct your system to an outdated or non-functional mirror, leading to inconsistent data.
5. Interrupted Downloads: Network instability or timeout issues during the download of package list files can result in incomplete files being stored in the cache, which then fail hash verification.
6. System Clock Skew: While less direct for hash mismatches, a significantly incorrect system clock can interfere with SSL/TLS certificate validation for HTTPS repositories, potentially leading to issues or masked problems that manifest as hash errors.
7. Disk I/O Errors or Full Disk: Extremely rare but possible if the disk where /var/lib/apt/lists/ resides has physical corruption or is completely full, leading to incomplete writes.

Step-by-Step Resolution

Follow these steps systematically to diagnose and resolve the "Hash Sum mismatch" error. Always start with the simplest solutions.

1. Clear the Local APT Cache

This is the most common fix, as it forces apt to re-download all package list index files from scratch.

# Clear the cached .deb package files (good practice, but not directly for hash mismatch)
sudo apt clean

# Remove all existing package list files to force a full re-download
sudo rm -rf /var/lib/apt/lists/*

# Attempt to update the package lists again
sudo apt update

If the error persists, proceed to the next step.

2. Change APT Mirrors

A common cause is a specific mirror not being synchronized. Switching to the main Ubuntu archive or a different, reliable mirror can resolve the issue.

Always back up your sources.list file before making changes. This ensures you can revert if needed.

# Backup existing sources.list
sudo cp /etc/apt/sources.list /etc/apt/sources.list.bak

# Open the sources.list file for editing
sudo nano /etc/apt/sources.list

Inside nano, you'll see lines similar to this:

deb http://<country_code>.archive.ubuntu.com/ubuntu/ jammy main restricted
deb http://<country_code>.archive.ubuntu.com/ubuntu/ jammy-updates main restricted
# ... and so on

Change all instances of <country_code>.archive.ubuntu.com (e.g., us.archive.ubuntu.com, de.archive.ubuntu.com) to archive.ubuntu.com. This directs apt to the main global mirror, which is usually the most up-to-date.

Alternatively, you can use the official "Old Releases" mirror if you suspect issues with the current primary infrastructure, though for 22.04 LTS, this is less likely to be the direct fix unless the primary mirror is having severe issues.

Save the file (Ctrl+O, Enter, Ctrl+X).

Now, clean the cache and try updating again:

sudo apt clean
sudo rm -rf /var/lib/apt/lists/*
sudo apt update

If the issue is resolved, you might consider using the software-properties-gtk tool (if GUI is available) or manually finding a well-synchronized mirror in your region.

3. Disable Proxy or CDN Caching (if applicable)

If your server is behind a corporate proxy, a local caching proxy (like Squid), or if you've explicitly configured proxy settings, these can interfere.

First, check if proxy environment variables are set:

env | grep -i proxy

If you see output like http_proxy, https_proxy, ftp_proxy, no_proxy, these proxies are active. You can temporarily unset them:

unset http_proxy
unset https_proxy
unset ftp_proxy

# If there's an APT-specific proxy configuration, remove it temporarily
sudo rm -f /etc/apt/apt.conf.d/proxy.conf
# Or comment out relevant lines in /etc/apt/apt.conf

After unsetting, try the update again in the same terminal session:

sudo apt clean
sudo rm -rf /var/lib/apt/lists/*
sudo apt update

If a proxy is essential for your network access, temporarily disabling it might prevent network connectivity for apt. Re-enable it or find the correct proxy configuration after troubleshooting. Consult your network administrator if unsure.

4. Force IPv4 for APT

Sometimes, issues with IPv6 connectivity or specific IPv6 mirror endpoints can cause problems. Forcing apt to use IPv4 can bypass this.

Create a new APT configuration file:

sudo nano /etc/apt/apt.conf.d/99force-ipv4

Add the following line to the file:

Acquire::ForceIPv4 "true";

Save and exit, then clean and update:

sudo apt clean
sudo rm -rf /var/lib/apt/lists/*
sudo apt update

5. Verify DNS Resolution

Incorrect DNS resolution can lead apt to connect to stale or incorrect mirror IPs.

Check your current DNS configuration:

resolvectl status
# Or if using traditional configuration
cat /etc/resolv.conf

Test DNS resolution for a mirror:

dig archive.ubuntu.com
# Or a specific country mirror, e.g., dig us.archive.ubuntu.com

Ensure the IP addresses returned are valid and routable. If you suspect your current DNS servers are problematic, you can temporarily switch to public DNS resolvers like Google (8.8.8.8, 8.8.4.4) or Cloudflare (1.1.1.1, 1.0.0.1) for testing.

To temporarily change DNS for testing, you can modify /etc/resolv.conf directly, but note that this file is often managed by systemd-resolved or NetworkManager and changes might be overwritten. A more robust temporary test is to configure a specific DNS server for dig or nslookup: dig @8.8.8.8 archive.ubuntu.com.

6. Check System Clock Synchronization

An out-of-sync system clock can cause issues with SSL/TLS certificate validation for HTTPS repositories, which can indirectly manifest as download errors or hash mismatches, although less directly than the other causes.

Check your system date and time:

date
timedatectl status

Ensure NTP service: active is displayed. If not, enable NTP synchronization:

sudo timedatectl set-ntp true

7. Debugging with APT's Verbose Output

If all else fails, enabling verbose debugging output for apt can provide more detailed information about what's happening during the acquisition process.

sudo apt -o Debug::Acquire::http=true -o Debug::Acquire::ftp=true update

Carefully examine the output for clues. Look for any connection errors, redirection issues, or specific file paths mentioned just before the "Hash Sum mismatch" error. This verbose output can sometimes point to a particular mirror, an unusual HTTP response, or a network-level problem.

By systematically working through these steps, you should be able to identify and resolve the "Hash Sum mismatch" error on your Ubuntu 22.04 LTS system, ensuring reliable package management.