Fix apt and dpkg errors on Ubuntu and Debian

Package errors stop updates, so they matter for security. Most of them print a message that names the problem precisely. Find your message below, run the fix and confirm with sudo apt update && sudo apt upgrade.

Before you start

• Work as a user with sudo over SSH; see connect to your Linux server.
• Read the first error in the output: later errors are often consequences of it.
• Check free space first, because many apt failures are really a full disk: df -h / /var /boot. If a file system is at 100 %, fix that first with disk full and sudo apt clean.

"Could not get lock /var/lib/dpkg/lock-frontend"

E: Could not get lock /var/lib/dpkg/lock-frontend. It is held by process 1234 (unattended-upgr)

Cause: another package process runs. Right after a boot this is usually the automatic security update.

Fix: wait until it finishes. See what it is doing:

ps -o pid,etime,cmd -p 1234

Then try again in a few minutes. Do not delete the lock files. Only if no process holds the lock any more (for example after a crash or a lost SSH session during an upgrade) and apt still refuses, continue with the next section.

"dpkg was interrupted, you must manually run 'sudo dpkg --configure -a'"

Cause: an installation stopped halfway, for example when the SSH connection dropped.

Fix: let dpkg finish configuring every unpacked package, then check the database:

sudo dpkg --configure -a
sudo dpkg --audit

Verify: dpkg --audit prints nothing, and sudo apt update && sudo apt upgrade runs through. Use tmux or screen for long upgrades, so a dropped connection does not interrupt them again.

"Unmet dependencies. Try 'apt --fix-broken install'"

Cause: a package was installed without all of its dependencies, often from a downloaded .deb file.

Fix: let apt work out a repair:

sudo apt --fix-broken install

Read the list of packages apt wants to install or remove before you confirm. If it wants to remove something important, cancel and remove the package that caused the problem instead (sudo apt remove package-name).

"NO_PUBKEY" or "The following signatures couldn't be verified"

W: GPG error: https://repo.example.com stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 0123456789ABCDEF

Cause: a third-party repository is configured, but its signing key is missing, expired or was rotated by the vendor.

Fix: follow the vendor's current installation instructions to download its key again. The recommended layout stores the key in its own file and names it in the repository entry with signed-by, so it is trusted only for that repository:

sudo install -d -m 0755 /etc/apt/keyrings
ls /etc/apt/sources.list.d/

Compare the signed-by path in the repository file with the key file the vendor tells you to create. Do not use apt-key, and do not put third-party keys into /etc/apt/trusted.gpg.d/. If you no longer use the repository, delete its file from /etc/apt/sources.list.d/ instead.

"Release file … is not valid yet"

Cause: the server's clock is behind, so the repository's signature looks like it comes from the future.

Fix: check timedatectl and turn on time synchronisation as described in hostname, time zone and time sync, then run sudo apt update again.

"changed its 'Suite' value from 'stable' to 'oldstable'"

Cause: your Debian sources use the alias stable instead of a release name, and a new Debian release came out. Debian 12 became oldstable when Debian 13 was released.

Fix: decide whether you want to stay on your release or upgrade. To stay, replace stable with your release name (bookworm for Debian 12, trixie for Debian 13) in the files under /etc/apt/, then run sudo apt update. To accept the change once in a script, apt-get has --allow-releaseinfo-change. To upgrade, see upgrade Ubuntu or Debian to a new release.

"404 Not Found" on apt update

Cause: the repository is gone from that address. For a third-party repository, the vendor moved or dropped it. For the system's own repositories, the release reached its end of life: Ubuntu moves releases past their end of life from the regular archive to an archive server for old releases.

Fix: for a third-party repository, update or remove its entry. For an end-of-life release, the lasting fix is a supported release: upgrade it step by step, or reinstall the server with a current image and restore your data (reinstall the operating system).

"The following packages have been kept back"

Cause: on Ubuntu, usually a phased update: a new version is offered to a growing share of machines over a few days. Packages can also be held because the upgrade would remove another package, or because someone held them with apt-mark hold.

Fix: check the package:

apt-cache policy package-name
apt-mark showhold

A candidate marked phased with a percentage reaches you automatically; you can ignore the message. For a package held because of new or removed dependencies, review and run sudo apt full-upgrade. Release a deliberate hold with sudo apt-mark unhold package-name.

"E: Sub-process /usr/bin/dpkg returned an error code (1)"

Cause: a package's own install or removal script failed. The real reason is printed above this line.

Fix: scroll up to the first error of the package named there. Common causes are a full disk, a service that cannot start because of its configuration (check sudo journalctl -xeu service-name) and a configuration file you changed. After fixing the cause, run sudo dpkg --configure -a again.

Next steps

• Keep security updates coming without you: automatic updates.
• Running an old release? Upgrade Ubuntu or Debian to a new release.