10

When running apt full-upgrade or apt update I'm getting several logs that are more or less the same as this one, where there is an identical filesize, SHA1 and MD5 but different SHA256:

E: Failed to fetch store:/var/lib/apt/lists/partial/jp.archive.ubuntu.com_ubuntu_dists_focal_main_binary-amd64_Packages.xz  Hash Sum mismatch
   Hashes of expected file:
    - Filesize:5826751 [weak]
    - SHA256:af226b4496cbb524bd4814d102047ae77769836203274dffc91cb543d5da13cc
    - SHA1:aef5c36ce45bd5c3154a1bb03c62b6cfb33e2bc6 [weak]
    - MD5Sum:7ef83228ec207df10acac48fbdd81112 [weak]
   Hashes of received file:
    - SHA256:e2c7fc5a2d86f75f03612fec614dcf84d3d502976558fbe40928c1dd120bb05e
    - SHA1:aef5c36ce45bd5c3154a1bb03c62b6cfb33e2bc6 [weak]
    - MD5Sum:7ef83228ec207df10acac48fbdd81112 [weak]
    - Filesize:5826751 [weak]
   Last modification reported: Thu, 23 Apr 2020 16:40:26 +0000
   Release file created at: Thu, 23 Apr 2020 17:33:17 +0000

Whereas others have the same MD5, but different SHA1 and SHA256:

E: Failed to fetch http://jp.archive.ubuntu.com/ubuntu/pool/main/l/linux/linux-headers-5.4.0-29_5.4.0-29.33_all.deb  Hash Sum mismatch
   Hashes of expected file:
    - SHA256:edde13dcd52c51e2404d37731948d491e6e215b22f599239326809754f8d5633
    - SHA1:3e46354d6aaa92f82d5392a80f6b72c3fcc78a91 [weak]
    - MD5Sum:4ccf38c666c836f29fc3602314de47b9 [weak]
    - Filesize:10936232 [weak]
   Hashes of received file:
    - SHA256:9af606f85850ba3010ac8743f62dca91bbef3e5e60da5a7df62dac53eb5a4fb7
    - SHA1:61c842d896676ac9af0fef9f9f48bc4a3c39cce6 [weak]
    - MD5Sum:4ccf38c666c836f29fc3602314de47b9 [weak]
    - Filesize:10936232 [weak]
   Last modification reported: Thu, 30 Apr 2020 08:23:38 +0000

This problem is similar to what is asked here, and indeed I tried several of the solutions offered there (and elsewhere) but they did not help. However I am wondering specifically about why the SHA-1 and MD5Sum are identical, and only SHA256 is different. Does this mean that there is a security problem somewhere along the line? Or is my system reading SHA256 incorrectly? Something else?

Thanks

  • You should ask the package maintainer, they probably made an error. – ubfan1 May 6 at 0:57
  • @ubfan1 that's the thing, unless I'm mistaken these are core Ubuntu packages (I'm running on 20.04 lts). Moreover, in another VM I'm running, I'm not getting these same errors – RyanQuey May 6 at 1:07
  • 1
    I just downloaded the pkg from ports.ubuntu.com/pool/main/l/linux/… and the sha256sum hash is correct.Try again. – ubfan1 May 6 at 3:07
  • That's a good idea, confirming the SHA256 sum that way. It's still breaking for me though. – RyanQuey May 6 at 11:20
8

Disable Windows Subsystem For Linux and Virtual Machine Platform if you're using Windows and VirtualBox. Happened to me when trying to install lubuntu 20.04 using VirtualBox 6.0.4 and WSL2 was enabled.

| improve this answer | |
  • Could you expand on why this would solve the hash sum mismatch, and if there's any external documentation you can add? Thanks – RyanQuey May 20 at 21:51
  • 4
    VirtualBox is using so called "Virtual Machine Platform" as a virtualization provider if it is enabled. I've no idea why this happens, but for me when running apt update I got mismatch of ONLY SHA256 - SHA1 and MD5 were the same. This gives me an idea there is a bug in this version of Virtual Machine Platform and for some reason SHA256 calculation is done incorrectly. This is just my guess because it solved the issue for me. forums.virtualbox.org/viewtopic.php?f=6&t=92440 It was "Turtle Icon" I got when it didn't work - hence my guess that this changes how virtual CPU behaves. – Marcin Gordziejewski May 21 at 7:25
  • 2
    Thank you so much...this was what I really needed. I was able to get rid of my green turtle as well. Posting this link here for a more full and more recent explanation and set of instructions: forums.virtualbox.org/… – RyanQuey May 22 at 8:56
  • That is not a solution! The whole point why I use this Windows version is WSL2. It has to both work on the same system. – Akito Jun 2 at 10:06
  • Currently cannot tell why this is happening - so a quick remedy is doing what I said. There probably might be a solution out there in the wild to solve it - but I just don't know of it. – Marcin Gordziejewski Jun 3 at 13:21
27

Try this before running apt:

$ sudo bash
# mkdir /etc/gcrypt
# echo all >> /etc/gcrypt/hwf.deny

Because apt use sha256 method from libgcrypto20, but optimized too much. We can deny this opt. using configuration file /etc/gcrypt/hwf.deny.

| improve this answer | |
  • 1
    This is what worked for me. Disabling WSL like the accepted answer says didn't help. – cclloyd Jun 9 at 9:51
  • 2
    Just tested this solution in Ubuntu 20.04 hosted in a Windows 10 install of Oracle VM VirtualBox. Nothing worked before this, even tried to disable wsl. – prm296 Jun 26 at 4:00
  • 2
    Worked for me! Windows 10 host (the thing was broken by newest Windows update), Ubuntu 20.04 guest. Haven't disabled WSL or anything - this solution worked. – user2622016 Jul 26 at 19:47
  • 2
    Asking out of curiosity: What exactly does this do? It solves the issue indeed but reads like I would disable all (?) checks for something which doesn't sound that great from a security perspective. – geisterfurz007 Aug 11 at 9:05
  • 1
    @geisterfurz007 it just disables the use of dedicated hardware features provided by the chip. Its in the docs for dev.gnupg.org/source/libgcrypt – caduceus Aug 22 at 15:02
5

EXPLANATION and Solution: Quick Fix

This issue is caused by the Windows Hypervisor Platform. This issue cannot be resolved for now (asfar as I know).

A partial fix is at hand though. And I say"partial" because it involves disabling the platform (also known as"Hyper-V") which will probably break other virtualization solutions you have installed since this is enabled manually. Anyway, here's how to disable it and get your VM running again,

  1. Shut down the Virtual Machine.

  2. Press Windows logo key + X, then hit A to run Command Prompt(powershell) as administrator.

  3. Type bcdedit /set hypervisorlaunchtype off

4.When you see"The operation completed succesfully", reboot your windows. After reboot, boot your VM and update/upgrade.

| improve this answer | |
  • Thanks @MRX Clay. You saved my day! In fact, you saved my night ;) The issue happened to me after enabling Windows Sandbox feature and did not go away after disabling it. I had two virtual machines broken on two different physical hosts. And by broken I mean that all checksum operations returned wrong results. I was unable to use npm, serverless or apt. Now it all works again. – David Beneš Aug 30 at 21:51
1

The file from the jp... archive is correct also, so it must be your copy of sha256sum that is borked. Confirm the sha256sum executable you are running is in /usr/bin, and if it is not, remove the identified executable which is earlier in your path than /usr/bin. If it is, download the coreutils package from the primary Ubuntu archives, and reinstall coreutils.

| improve this answer | |
  • For me, this answer was helpful in determining that my sha256sum was not working correctly. However, this answer here is actually what was able to fix it for me. I didn't mention anything about VirtualBox and using a Windows 10 host in my question though. I think it wouldn't be fair to this answer to change the question now though, so just upvoting both and accepting the one that fixed it for me. – RyanQuey May 22 at 9:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.