Root Cause Diagnosis
Hash Sum mismatch occurs when the package index file apt downloaded doesn’t match the SHA256/MD5 checksum listed in the mirror’s Release file, meaning the local copy under /var/lib/apt/lists/ is corrupted or stale relative to what the mirror is currently serving. This happens most often because a transparent caching proxy (ISP-level, corporate, or a local apt-cacher-ng instance) served a partially cached or outdated index file, or because the specific mirror backend apt hit is mid-sync and its Release file already references package indices that haven’t finished replicating across the mirror network. It is a data-integrity failure at the transport/cache layer, not a broken package.
Quick Fix
sudo rm -rf /var/lib/apt/lists/*
sudo apt-get clean
sudo apt-get update
This discards every locally cached index and forces a full re-download, which resolves the mismatch if the corruption was local rather than on the mirror side.
Step-by-Step Resolution
1. Clear the index cache completely
sudo rm -rf /var/lib/apt/lists/*
sudo mkdir -p /var/lib/apt/lists/partial
sudo apt-get update
Recreating partial/ matters — apt expects that directory to exist for in-progress downloads and will fail differently if it’s missing.
2. If the error persists, disable HTTP pipelining
Caching proxies and some mirror load balancers mishandle pipelined requests, returning interleaved or truncated responses that fail checksum validation:
echo 'Acquire::http::Pipeline-Depth "0";' | sudo tee /etc/apt/apt.conf.d/99fixbadproxy
sudo apt-get update
3. Force IPv4 if the mirror has broken IPv6 routing
Some regional mirrors advertise AAAA records that are unreachable or serve stale content over IPv6 while IPv4 is fine:
echo 'Acquire::ForceIPv4 "true";' | sudo tee /etc/apt/apt.conf.d/99force-ipv4
sudo apt-get update
4. Switch away from the geo-routed mirror if the problem is intermittent
archive.ubuntu.com and country mirrors (e.g., us.archive.ubuntu.com) round-robin across backend servers. If one backend is mid-sync, repeated apt-get update calls can hit different servers each time, producing inconsistent results. Point directly at a single known-good mirror in /etc/apt/sources.list:
deb http://mirror.math.princeton.edu/pub/ubuntu jammy main restricted universe multiverse
deb http://mirror.math.princeton.edu/pub/ubuntu jammy-updates main restricted universe multiverse
deb http://mirror.math.princeton.edu/pub/ubuntu jammy-security main restricted universe multiverse
Substitute your release codename and a mirror from https://launchpad.net/ubuntu/+archivemirrors known to sync frequently.
5. Rule out a local apt-cacher-ng or similar caching proxy
If /etc/apt/apt.conf.d/ contains a proxy directive (check for Acquire::http::Proxy), the proxy’s own cache may hold the corrupted file independent of the upstream mirror. Purge its cache directly:
sudo systemctl stop apt-cacher-ng
sudo rm -rf /var/cache/apt-cacher-ng/*
sudo systemctl start apt-cacher-ng
6. As a last resort, bypass compression-related corruption
Rare cases involve gzip-compressed index corruption specific to certain proxy transcoding. Force apt to fetch uncompressed or a different compression order:
sudo apt-get update -o Acquire::CompressionTypes::Order::=gz
Why This Fails for Some Users
Corporate or ISP transparent proxies that re-serve the same corrupt bytes. Clearing /var/lib/apt/lists/ has no effect when an upstream network-level cache (not one configured in apt itself) intercepts port 80 traffic and returns its own stale cached copy regardless of what apt requests. This is distinguishable by testing the same apt-get update from a different network (mobile hotspot, VPN) — if it succeeds there, the proxy is the cause, and switching sources to https:// mirrors (which the transparent proxy can’t inspect or cache) is the actual fix.
Low disk space truncating index downloads mid-write. If /var is near full, apt can partially write an index file, pass a size check but fail the hash check. df -h /var before assuming a mirror-side problem; a full disk produces the identical error message as a genuinely corrupt remote file.
Containers and VMs with copy-on-write filesystem layers caching stale blocks. Docker images built with a cached apt-get update layer, or LXC containers sharing an overlay filesystem, can retain a corrupted lists directory across rebuilds if --no-cache isn’t used on the build step, making the “fix” appear to not persist between runs.
Mirrors that support by-hash but clients using an apt version that doesn’t request it. Newer Ubuntu mirrors serve index files under /dists/<release>/main/binary-amd64/by-hash/ to avoid exactly this race condition during sync, but very old apt versions (pre-1.1, i.e., Ubuntu 14.04 and earlier) don’t use by-hash lookups and remain vulnerable to mid-sync mismatches that newer apt on 18.04+ largely avoids automatically.