Home / ubuntu / Questions / 1235914
Accepted
RyanQuey
Asked: 2020-05-06 15:50:50 +0800 CST

“Hash sum mismatch” error due to identical SHA1 and MD5 but different SHA256

  • 772

When running apt full-upgrade or apt update I'm getting several logs that are more or less the same as this one, where there is an identical filesize, SHA1 and MD5 but different SHA256: 

E: Failed to fetch store:/var/lib/apt/lists/partial/jp.archive.ubuntu.com_ubuntu_dists_focal_main_binary-amd64_Packages.xz  Hash Sum mismatch
   Hashes of expected file:
    - Filesize:5826751 [weak]
    - SHA256:af226b4496cbb524bd4814d102047ae77769836203274dffc91cb543d5da13cc
    - SHA1:aef5c36ce45bd5c3154a1bb03c62b6cfb33e2bc6 [weak]
    - MD5Sum:7ef83228ec207df10acac48fbdd81112 [weak]
   Hashes of received file:
    - SHA256:e2c7fc5a2d86f75f03612fec614dcf84d3d502976558fbe40928c1dd120bb05e
    - SHA1:aef5c36ce45bd5c3154a1bb03c62b6cfb33e2bc6 [weak]
    - MD5Sum:7ef83228ec207df10acac48fbdd81112 [weak]
    - Filesize:5826751 [weak]
   Last modification reported: Thu, 23 Apr 2020 16:40:26 +0000
   Release file created at: Thu, 23 Apr 2020 17:33:17 +0000

Whereas others have the same MD5, but different SHA1 and SHA256: 

E: Failed to fetch http://jp.archive.ubuntu.com/ubuntu/pool/main/l/linux/linux-headers-5.4.0-29_5.4.0-29.33_all.deb  Hash Sum mismatch
   Hashes of expected file:
    - SHA256:edde13dcd52c51e2404d37731948d491e6e215b22f599239326809754f8d5633
    - SHA1:3e46354d6aaa92f82d5392a80f6b72c3fcc78a91 [weak]
    - MD5Sum:4ccf38c666c836f29fc3602314de47b9 [weak]
    - Filesize:10936232 [weak]
   Hashes of received file:
    - SHA256:9af606f85850ba3010ac8743f62dca91bbef3e5e60da5a7df62dac53eb5a4fb7
    - SHA1:61c842d896676ac9af0fef9f9f48bc4a3c39cce6 [weak]
    - MD5Sum:4ccf38c666c836f29fc3602314de47b9 [weak]
    - Filesize:10936232 [weak]
   Last modification reported: Thu, 30 Apr 2020 08:23:38 +0000

This problem is similar to what is asked here, and indeed I tried several of the solutions offered there (and elsewhere) but they did not help. However I am wondering specifically about why the SHA-1 and MD5Sum are identical, and only SHA256 is different. Does this mean that there is a security problem somewhere along the line? Or is my system reading SHA256 incorrectly? Something else?

Thanks

apt md5sum sha256

7 Answers

  1. Try this before running apt:

    $ sudo bash
# mkdir /etc/gcrypt
# echo all >> /etc/gcrypt/hwf.deny

    Because apt uses the sha256 method from libgcrypt20, but optimized too much. We can opt out of these optimizations using the configuration file /etc/gcrypt/hwf.deny.

    info gcrypt section 16 says:

    /etc/gcrypt/hwf.deny

    This file can be used to disable the use of hardware based optimizations, see hardware features.

    info gcrypt section 2.7 then says:

    Libgcrypt makes use of certain hardware features. If the use of a feature is not desired it may be either be disabled by a program or globally using a configuration file.

    • 47
  2. Best Answer

    Disable Windows Subsystem For Linux and Virtual Machine Platform if you're using Windows and VirtualBox. Happened to me when trying to install lubuntu 20.04 using VirtualBox 6.0.4 and WSL2 was enabled.

    • 11

  3. EXPLANATION and Solution: Quick Fix

    This issue is caused by the Windows Hypervisor Platform. This issue cannot be resolved for now (asfar as I know).

    A partial fix is at hand though. And I say"partial" because it involves disabling the platform (also known as"Hyper-V") which will probably break other virtualization solutions you have installed since this is enabled manually. Anyway, here's how to disable it and get your VM running again,

    1. Shut down the Virtual Machine.

    2. Press Windows logo key + X, then hit A to run Command Prompt(powershell) as administrator.

    3. Type bcdedit /set hypervisorlaunchtype off

    4.When you see"The operation completed succesfully", reboot your windows. After reboot, boot your VM and update/upgrade.

    • 8

  4. The file from the jp... archive is correct also, so it must be your copy of sha256sum that is borked. Confirm the sha256sum executable you are running is in /usr/bin, and if it is not, remove the identified executable which is earlier in your path than /usr/bin. If it is, download the coreutils package from the primary Ubuntu archives, and reinstall coreutils.

    • 1

  5. I don't understand the reasons for the issue, but in my particular situation (Ubuntu on WSL, on a Laptop using both WiFi and Ethernet at the same time) I could resolve the hash sum mismatches by unplugging the Ethernet wire. Don't ask me why, but now everything works again ... ?

    • 0

  6. HyperV was already disabled on my Windows. But I always haved this problem under VirtualBox.

    In Virtualbox configuration machine > System > Processor > "Enable PAE/NX" option. Reboot your virtual machine then it works for me.

    • 0

  7. I have been having trouble trying to install Ubuntu in VirtualBox. Turns out there is a bug fix for the issue in VirtualBox 6.1.16. I updated this morning to 6.1.18 and was able to install a clean Ubuntu Server 20.04 with no problems.

    https://www.virtualbox.org/ticket/19695

    • 0