🚨 Linux Error Guide: 'E: Failed to fetch' in apt — Fix 404s and Hash Sum Mismatches

Overview

E: Failed to fetch is apt’s catch-all failure when it cannot download a repository index or a .deb package from a mirror. It surfaces at the end of apt update or during apt install, usually with an HTTP status code or a network error appended. The two most common forms look like this:

Err:1 http://archive.ubuntu.com/ubuntu focal/main amd64 Packages
  404  Not Found [IP: 91.189.91.82 80]
E: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/focal/main/binary-amd64/Packages.gz  404  Not Found [IP: 91.189.91.82 80]
E: Some index files failed to download. They have been ignored, or old ones used instead.

E: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/focal/main/binary-amd64/Packages.gz  Hash Sum mismatch
   Hashes of expected file:
    - SHA256:8f...c1
   Hashes of received file:
    - SHA256:2a...9d
E: Some index files failed to download.

The status code or trailing text is the real diagnostic. A 404 means the path is gone (moved or end-of-life release); Hash Sum mismatch means the index apt downloaded does not match the checksums in the signed Release file — almost always a stale local list or a caching proxy. This guide covers every common variant and the exact commands to fix them.

Symptoms

• apt update finishes with E: Failed to fetch ... and E: Some index files failed to download.
• apt install <pkg> fails immediately because the cached index is stale or a package URL 404s.
• One or more Err: lines appear before the E: lines, naming the exact URL and reason.
• Errors are intermittent (network/DNS) or perfectly reproducible (404, hash mismatch, EOL release).
• The trailing bracket shows the resolved mirror IP, confirming DNS worked even when the fetch failed.

Common Root Causes

• 404 Not Found — the release was moved or reached end-of-life (EOL). Ubuntu removes EOL releases from archive.ubuntu.com and relocates them to old-releases.ubuntu.com. Also caused by a stale or hand-edited sources.list pointing at a path that no longer exists.
• Hash Sum mismatch — the downloaded index does not match the signed Release checksums. Usually a stale /var/lib/apt/lists cache, a mirror mid-sync, or a transparent HTTP proxy serving a cached (outdated) Packages file.
• Could not resolve host / Temporary failure resolving — DNS is broken or /etc/resolv.conf is misconfigured; apt cannot turn the mirror hostname into an IP.
• Connection timed out / Connection failed — the mirror or an egress firewall/proxy is blocking or dropping the connection.
• Certificate verification failed — for https:// mirrors, a wrong system clock or missing/outdated CA certificates breaks TLS validation.
• Undetermined Error — commonly returned by a misbehaving or intercepting proxy (apt-cacher-ng, a corporate proxy) that mangles the response.

Diagnostic Workflow

Read the Err: line first — it names the URL and the reason. Then work through these checks.

# 1. Reproduce and capture the exact error and URL.
sudo apt update

# 2. Inspect what your sources actually point at.
cat /etc/apt/sources.list
ls -l /etc/apt/sources.list.d/
# On newer Ubuntu, sources may live in the deb822 format:
cat /etc/apt/sources.list.d/ubuntu.sources 2>/dev/null

# 3. Confirm which release codename you are on (matters for EOL/404).
lsb_release -a

# 4. Test reachability of the mirror over HTTP/HTTPS (headers only).
curl -I http://archive.ubuntu.com/ubuntu/dists/focal/Release

# 5. Check DNS resolution independently of apt.
getent hosts archive.ubuntu.com

# 6. Check the clock — a skewed clock breaks TLS and Release validity.
date

Based on what you find:

# Stale index or Hash Sum mismatch: wipe the local lists and rebuild them.
sudo rm -rf /var/lib/apt/lists/*
sudo apt clean
sudo apt update

# Suspected caching proxy serving stale indexes: bypass the cache for one run.
sudo apt-get -o Acquire::http::No-Cache=true update

sudo apt clean empties /var/cache/apt/archives (downloaded .deb files); removing /var/lib/apt/lists/* forces apt to re-download every index from scratch, which resolves nearly all hash-sum problems caused by partial or stale metadata.

Example Root Cause Analysis

Scenario A — EOL release returns 404. A host still running an EOL Ubuntu release runs apt update and every line 404s:

Err:1 http://archive.ubuntu.com/ubuntu focal/main amd64 Packages
  404  Not Found [IP: 91.189.91.82 80]

lsb_release -a confirms the codename (e.g. focal), and a quick check shows the release is past end of standard support. Ubuntu has moved its dists/ and pool/ trees off archive.ubuntu.com and security.ubuntu.com to old-releases.ubuntu.com. The fix is to repoint the sources at the archive host. Back up first, then rewrite the hostnames:

sudo cp /etc/apt/sources.list /etc/apt/sources.list.bak
sudo sed -i \
  -e 's|http://archive.ubuntu.com/ubuntu|http://old-releases.ubuntu.com/ubuntu|g' \
  -e 's|http://security.ubuntu.com/ubuntu|http://old-releases.ubuntu.com/ubuntu|g' \
  /etc/apt/sources.list
sudo apt update

old-releases.ubuntu.com is a stopgap so you can install what you need and then upgrade to a supported release — not a permanent home.

Scenario B — Hash Sum mismatch behind a caching proxy. apt update reports Hash Sum mismatch on the Packages.gz file even though the mirror is healthy from another network. The environment routes apt through a transparent HTTP proxy that cached an older Packages index while apt already has the newer signed Release. Clear the local lists and force a cache-bypassing fetch:

sudo rm -rf /var/lib/apt/lists/*
sudo apt-get -o Acquire::http::No-Cache=true update

If it recurs, the proxy is caching apt paths it should not. Fix the proxy to exclude Debian/Ubuntu repository paths, or point apt at a purpose-built cache like apt-cacher-ng instead of a generic HTTP proxy.

Prevention Best Practices

• Upgrade before EOL. Track your release’s support window and run do-release-upgrade (Ubuntu) or a version upgrade well before end of life. Treat old-releases.ubuntu.com as a temporary bridge, not a destination.

• Do not pin to moving or unofficial mirrors. Use the official archive or a stable, well-maintained regional mirror. Third-party mirrors that lag or disappear are a recurring source of 404s and hash mismatches.

• Keep the clock synced. Enable systemd-timesyncd or install chrony so TLS validation and Release Valid-Until checks pass:

  timedatectl set-ntp true
  timedatectl status

• Configure proxies correctly. For an intercepting HTTP proxy that caches, set Acquire::http::No-Cache "true"; in a file under /etc/apt/apt.conf.d/, or exclude repository paths from caching. Define proxies explicitly rather than relying on transparent interception:

  # /etc/apt/apt.conf.d/95proxies
  Acquire::http::Proxy "http://proxy.internal:3142/";

• Use apt-cacher-ng the intended way. Point clients at it as an apt proxy (the Acquire::http::Proxy line above) rather than mangling sources.list URLs, and let it manage its own cache expiry so it never serves an index that conflicts with a newer signed Release.

• Keep CA certificates current. Ensure the ca-certificates package is installed and updated so https:// mirrors validate cleanly.

Quick Command Reference

# Show the exact failing URL and reason.
sudo apt update

# Inspect and confirm your sources and release.
cat /etc/apt/sources.list
ls -l /etc/apt/sources.list.d/
lsb_release -a

# Network / DNS / clock sanity checks.
curl -I http://archive.ubuntu.com/ubuntu/dists/focal/Release
getent hosts archive.ubuntu.com
date

# Fix stale index or Hash Sum mismatch.
sudo rm -rf /var/lib/apt/lists/*
sudo apt clean
sudo apt update

# Bypass a caching proxy for one run.
sudo apt-get -o Acquire::http::No-Cache=true update

# Move an EOL Ubuntu release to old-releases (stopgap).
sudo cp /etc/apt/sources.list /etc/apt/sources.list.bak
sudo sed -i 's|http://archive.ubuntu.com/ubuntu|http://old-releases.ubuntu.com/ubuntu|g' /etc/apt/sources.list
sudo apt update

# Keep the clock in sync (prevents cert/Release errors).
timedatectl set-ntp true

Conclusion

E: Failed to fetch is not one error but a family of them, and the fix follows directly from the text apt prints after the URL. A 404 points at a stale or EOL source — repoint sources.list, moving to old-releases.ubuntu.com only long enough to upgrade. A Hash Sum mismatch almost always clears after wiping /var/lib/apt/lists/* and, if a proxy is involved, fetching with Acquire::http::No-Cache=true. Resolution, timeout, and certificate variants are DNS, firewall, and clock problems respectively — verify each with getent hosts, curl -I, and date before touching apt. Read the Err: line, match it to the variant above, and apply the matching command.