I have a mirror server that I maintain in school.

$ uname -a Linux CSE-Cloud01 4.0.0-1-amd64 #1 SMP Debian 4.0.2-1 (2015-05-11) x86_64 GNU/Linux

$ sudo apt-get update

 W: Failed to fetch http:// mirror.cs.nchu.edu.tw/debian/dists/jessie/main/source/Sources  Hash Sum mismatch    
    W: Failed to fetch http:// mirror.cs.nchu.edu.tw/debian/dists/jessie/main/binary-amd64/Packages  Hash Sum mismatch

W: Failed to fetch http:// mirror.cs.nchu.edu.tw/debian/dists/jessie/non-free/binary-amd64/Packages Hash Sum mismatch

W: Failed to fetch http:// mirror.cs.nchu.edu.tw/debian/dists/jessie/main/i18n/Translation-en  Hash Sum mismatch

E: Some index files failed to download. They have been ignored, or old ones used instead.

In mirror itself or some of my machines, It failed in the end.(some work properly.) I had tried to do the below commands that recommended, and won't work

$ apt-get clean
$ rm -rf /var/cache/apt/*
$ rm -rf /var/lib/apt/lists/*
$ apt-get update

I can't find other solution on the internet. Did anyone know how to solve this problem?

  • This solved my issue – spacebiker Nov 12 '18 at 8:45

If deleting /var/lib/apt/lists/* does not work...
(esp. if you're behind a proxy), fix "Hash Sum Mismatch" like this:

Create file /etc/apt/apt.conf.d/99fixbadproxy
with this content

Acquire::http::Pipeline-Depth 0;
Acquire::http::No-Cache true;
Acquire::BrokenProxy    true;

See also here

  • 3
    Removing .../lists/* solved it for me. – user1794469 Feb 17 '16 at 18:36

I had a similar problem and it seemed to be a problem on the mirror.

As stated here remove the files "InRelease" on the server and try again.

In the /debian/dists/jessie directory there was a file called InRelease. It had a date several months back from the other files (which were mostly dated today's date).


I this case the problem always is the difference between the hashsum stated in the InRelease and Release files located in dist/[name-of-your-distro]/ folder.

This files are used to verify that others like Packages.xz hasn't been altered. When the hashsum mismatch you get the error. Unfortunately rehashing and writing the new value is not enough, because you will also need to sing both *Release files with a private key that you don't own... a real tedious job.

In my case I solved the problem (which in the first place was just use the local downloaded mirror) by removing the release files:

rm dist/[name-of-your-distro]/*Release*

and adding a trusted switch to the line corresponding to this repo in APT sources:

deb [trusted=yes] file:/path/to/your/local/mirror/ubuntu xenial main

Note the [trusted=yes]

Hope this helps, and even help me in the future :)


Following helped me (considering you are su)

  • apt-get clean
  • apt-get autoclean
  • apt-get remove
  • apt-get autoremove

I had such a problem while upgrading from wheezy to jessie. The solution was to temporarily remove xz-utils package. Wheezy can't manage .xz package lists because of the old version of apt.

apt-get remove xz-utils
apt-get update
apt-get upgrade
apt-get install xz-utils

Try removing all network connections other than the internet connection before trying to update or install files.

I just resolved this issue now. I was using wifi to connect to the internet, but also had an ethernet cable attached to a switch which was connected to another computer. I removed the ethernet cable and the hash mismatch error disappeared. It is possible that the local area network was preventing the laptop from connecting to the internet because I wasnt able to even ping google. The browser would not open websites either.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.