# Self-Healing CI: Recovering from apt "Hash Sum mismatch"

> An apt "Hash Sum mismatch" is a stale or mid-sync index, not a broken package. See the manual fix and how self-healing CI refreshes and retries.

Source: https://latchkey.dev/learn/self-healing-ci/self-heal-apt-hash-sum-mismatch  
Updated: 2026-06-25

A "Hash Sum mismatch" means apt downloaded an index that did not match its checksum - a stale cache or mid-sync mirror, not a corrupt package.

## What makes a failure safely retryable

Automatic retry is only correct for failures that are genuinely transient. Retrying a deterministic failure wastes minutes and hides a real defect, so the classification matters more than the retry mechanism.

- Safe to retry: network timeouts, registry 5xx, transient DNS failures, a service container that was not ready, a spot instance reclaimed mid-run.
- Not safe to retry: assertion failures, compile errors, lint violations, anything that fails identically on every attempt.
- Ambiguous, and worth investigating rather than retrying: out-of-memory kills, disk exhaustion, and flaky tests. These repeat under load and a retry only hides the trend.
- Always record that a retry happened. A pipeline that silently retries is a pipeline whose real failure rate you do not know.

## FAQ

### What causes Self-Healing CI: recovering from apt "Hash sum mismatch"?

An apt-get update/install fails with Hash Sum mismatch because the downloaded package index did not match its expected checksum. The package itself is fine; a stale local cache or a mirror caught mid-sync served an inconsistent index. A human clears the apt cache and retries, and it succeeds unchanged.

### How do I fix Self-Healing CI: recovering from apt "Hash sum mismatch" manually?

[object Object]

### Can Self-Healing CI: recovering from apt "Hash sum mismatch" be fixed automatically?

A Hash Sum mismatch has a clear, detectable signature, and the remedy is deterministic: clear the stale index and re-fetch before retrying. A self-healing CI pipeline detects the mismatch, refreshes package metadata, retries the operation, and only escalates if the mismatch persists against fresh indexes - which would indicate a genuine

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt