apt update refreshes package lists and apt upgrade installs updates. When either fails, the message usually points straight at the cause, once you know what it means. These are the errors you’ll meet most often on servers, with fixes.

“Could not get lock /var/lib/dpkg/lock-frontend”

E: Could not get lock /var/lib/dpkg/lock-frontend. It is held by process 1234 (unattended-upgr)

Another package process is running. On a fresh server that’s usually unattended-upgrades doing its first run after boot.

ps -p 1234 -o pid,etime,cmd

Wait for it to finish. Don’t kill it or delete the lock while it’s running, or you risk a half-configured system. If no apt or dpkg process exists and the lock is stale:

sudo rm /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/lib/apt/lists/lock /var/cache/apt/archives/lock
sudo dpkg --configure -a

“dpkg was interrupted”

sudo dpkg --configure -a
sudo apt -f install

See dpkg.

NO_PUBKEY / “The following signatures couldn’t be verified”

W: GPG error: https://repo.example.com stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 1234ABCD5678EF90

The key for a third-party repository is missing or has been rotated. Download the vendor’s current key into a dedicated keyring and reference it:

curl -fsSL https://repo.example.com/key.gpg | sudo gpg --dearmor -o /etc/apt/keyrings/example.gpg
# make sure the source line contains: [signed-by=/etc/apt/keyrings/example.gpg]
sudo apt update

Get the key URL from the vendor’s install docs. See adding repositories.

Key is stored in legacy trusted.gpg keyring is a warning, not an error. It means a key was added with the deprecated apt-key. Move it to /etc/apt/keyrings/ with signed-by when convenient.

“does not have a Release file” / 404 Not Found

E: The repository 'http://ppa.launchpad.net/foo/bar/ubuntu noble Release' does not have a Release file.

Common causes:

  1. The third-party repository doesn’t support your release. For example, a PPA has no builds for the new Ubuntu version yet. Disable that source (/etc/apt/sources.list.d/) or wait.
  2. Your release is end-of-life. Non-LTS Ubuntu releases are supported for 9 months. After that their repositories move to old-releases.ubuntu.com and apt update fails with 404 errors. Upgrade the release, or temporarily point sources at old-releases.ubuntu.com to install the upgrade tools. Debian archives old releases at archive.debian.org.
  3. A typo in a source line.

Check your release: lsb_release -a or cat /etc/os-release. See check OS version.

“Hash Sum mismatch” / “File has unexpected size”

The downloaded index doesn’t match what’s expected. This is often a mirror being updated mid-sync, or a caching proxy:

sudo rm -rf /var/lib/apt/lists/*
sudo apt clean
sudo apt update

If it persists, switch to another mirror.

“Temporary failure resolving ‘archive.ubuntu.com’”

DNS isn’t working on the server:

resolvectl status
ping -c1 1.1.1.1          # network ok?
getent hosts archive.ubuntu.com

If the IP ping works but name resolution fails, fix DNS. See change DNS servers.

“Unmet dependencies” / “held broken packages”

The following packages have unmet dependencies:
 php8.3-fpm : Depends: php8.3-common (= 8.3.12-1) but 8.3.14-1 is to be installed
E: Unable to correct problems, you have held broken packages.

Usually mixed repositories, a held package or a half-finished upgrade:

sudo apt -f install                 # try to fix
apt-mark showhold                   # anything held?
apt policy php8.3-common            # which repositories offer which versions
sudo apt full-upgrade               # allow installing/removing packages to resolve

Look for a PPA or third-party repository supplying conflicting versions. Pin or remove it.

“The following packages have been kept back”

Not an error. apt upgrade won’t install updates that need new packages or removals, and phased updates on Ubuntu are rolled out gradually. Options:

sudo apt full-upgrade          # allow new dependencies
sudo apt install package-name  # upgrade one kept-back package explicitly

On Ubuntu, phased updates resolve themselves within days. Leave them unless you need the update now.

“Release file … is not valid yet” / “is expired”

The server’s clock is wrong. Check timedatectl and enable time sync. See chrony.

“No space left on device”

The disk or /boot is full, often from old kernels:

df -h / /boot
sudo apt autoremove --purge
sudo apt clean

See disk full troubleshooting.

“Repository changed its ‘Label’ / ‘Suite’ value”

This happens after a release changes, for example Debian testing becoming stable. Accept it:

sudo apt update --allow-releaseinfo-change

Prevention

  • Run upgrades inside tmux so they can’t be interrupted. See tmux.
  • Keep third-party repositories to a minimum.
  • Stay on supported releases. Use LTS for servers.
  • Take a backup before major upgrades.

Related: apt commands and unattended upgrades.

  • Ubuntu
  • Debian
  • Troubleshooting