Fixing apt-get update Hash Sum Mismatch error on Ubuntu archive mirrors

Root Cause Diagnosis

The Hash Sum Mismatch error occurs when the checksums listed in the repository index file (InRelease or Release) do not match the calculated checksums of the downloaded package indices (such as Packages.xz or Translation-en). This typically happens due to caching proxies or Content Delivery Networks (CDNs) serving out-of-sync mirror metadata, corrupted local packet caches under /var/lib/apt/lists/, or active transparent HTTP proxies (such as ISP or corporate firewalls) truncating or altering partial byte transfers during apt-get update.

Quick Fix

Purge local APT metadata lists, flush local package caches, and force a clean non-cached fetch from remote mirrors:

sudo rm -rf /var/lib/apt/lists/*
sudo rm -rf /var/lib/apt/lists/partial/*
sudo apt-get clean
sudo apt-get update -o Acquire::http::No-Cache=true -o Acquire::https::No-Cache=true

Step-by-Step Resolution

Step 1: Purge Corrupted Local Index Files

Remove cached metadata files that APT relies on for differential index downloads (pdiffs).

sudo rm -rf /var/lib/apt/lists/*
sudo mkdir -p /var/lib/apt/lists/partial

Step 2: Disable Differential Index Downloads (pdiffs)

APT uses delta updates (pdiffs) to patch index files. If a mirror fails to sync patch files sequentially, checksum mismatches occur continuously. Disable pdiffs temporarily or permanently.

Create a dedicated APT configuration file under /etc/apt/apt.conf.d/:sudo nano /etc/apt/apt.conf.d/99nopdiff
Insert the following parameter to force full metadata index downloads:Acquire::PDiffs "false";

Step 3: Configure APT to Bypass Proxy Caching

Ensure intermediary network proxies or local edge caches do not deliver stale index chunks.

Create or edit /etc/apt/apt.conf.d/99bypasstatcache:sudo nano /etc/apt/apt.conf.d/99bypasstatcache
Add cache-bypassing headers for both HTTP and HTTPS protocols:Acquire::http::No-Cache "true"; Acquire::http::Pipeline-Depth "0"; Acquire::https::No-Cache "true"; Acquire::https::Pipeline-Depth "0";

Step 4: Switch to the Official Main Ubuntu Mirror

If regional or country-specific mirrors (e.g., archive.ubuntu.com vs us.archive.ubuntu.com) are out of sync, update /etc/apt/sources.list (or /etc/apt/sources.list.d/ubuntu.sources on Ubuntu 24.04+) to use the main release server.

For traditional sources.list (Ubuntu 22.04 and older):sudo sed -i 's|http://[a-z]*\.archive\.ubuntu\.com/ubuntu/|http://archive.ubuntu.com/ubuntu/|g' /etc/apt/sources.list
For deb822-format .sources files (Ubuntu 24.04+):sudo sed -i 's|http://[a-z]*\.archive\.ubuntu\.com/ubuntu/|http://archive.ubuntu.com/ubuntu/|g' /etc/apt/sources.list.d/ubuntu.sources

Step 5: Refresh Index Data

Run the update command again:

sudo apt-get update

Why This Fails for Some Users

Corporate TLS/SSL Interception Firewalls: Security appliances performing deep packet inspection (DPI) or man-in-the-middle SSL decrypts can rewrite HTTP headers or drop fragmented TCP packets, altering payload hashes. Configuring explicit HTTP proxy credentials in /etc/apt/apt.conf.d/01proxy or adding custom root certificates to /usr/local/share/ca-certificates/ is necessary in these environments.
Asynchronous Mirror Synchronization Windows: Ubuntu mirror networks take up to several hours to replicate entirely across regional nodes. If a user triggers apt-get update precisely during a mirror push, the InRelease file may contain updated hashes while the server is still streaming old Packages.xz archives. Waiting for the mirror sync cycle to complete or switching directly to http://azure.archive.ubuntu.com/ or http://archive.ubuntu.com/ bypasses out-of-sync regional mirrors.
Faulty MTU/Network Interface Fragmentation: Network interfaces with incorrect Maximum Transmission Unit (MTU) settings (common on VPNs, WireGuard tunnels, or AWS EC2 instances) drop network packets silently, resulting in truncated archive metadata files. Reducing MTU size on the host interface (e.g., sudo ip link set dev eth0 mtu 1420) prevents silent metadata truncation.