Self-Healing CI: Recovering from apt "Hash Sum mismatch"
A "Hash Sum mismatch" means apt downloaded an index that did not match its checksum - a stale cache or mid-sync mirror, not a corrupt package.
The problem
An apt-get update/install fails with Hash Sum mismatch because the downloaded package index did not match its expected checksum. The package itself is fine; a stale local cache or a mirror caught mid-sync served an inconsistent index. A human clears the apt cache and retries, and it succeeds unchanged.
E: Failed to fetch http://.../Packages Hash Sum mismatch
E: Some index files failed to download. They have been ignored, or old ones used instead.Why it happens
apt verifies each index against a signed checksum. If a mirror is partway through publishing new metadata, or a cached index is stale relative to the signed manifest, the downloaded bytes do not match the expected hash and apt refuses them.
It is transient and self-correcting: clearing the stale local lists and re-fetching from a now-consistent mirror produces a matching index, with no change to the packages you want.
The manual fix
The manual fix is to clear the stale index and re-fetch:
- Remove the cached package lists (
/var/lib/apt/lists/*). - Run
apt-get updateagain to fetch fresh, consistent indexes. - Retry the install.
sudo rm -rf /var/lib/apt/lists/*
sudo apt-get update
sudo apt-get install -y <package>How this gets automated
A Hash Sum mismatch has a clear, detectable signature, and the remedy is deterministic: clear the stale index and re-fetch before retrying. A self-healing CI pipeline detects the mismatch, refreshes package metadata, retries the operation, and only escalates if the mismatch persists against fresh indexes - which would indicate a genuine mirror problem rather than a transient sync.