# Fix apt and dpkg errors on Ubuntu and Debian

> Fixes for apt and dpkg errors: lock held by another process, interrupted dpkg, broken dependencies, NO\_PUBKEY, Release file not valid yet, kept-back packages.

Difficulty: Intermediate

Package errors stop updates, so they matter for security. Most of them print a message that names the problem precisely. Find your message below, run the fix and confirm with `sudo apt update && sudo apt upgrade`.

## Before you start

- Work as a user with `sudo` over SSH; see [connect to your Linux server](/guides/connect-to-linux-server-ssh).
- Read the **first** error in the output: later errors are often consequences of it.
- Check free space first, because many apt failures are really a full disk: `df -h / /var /boot`. If a file system is at 100 %, fix that first with [disk full](/guides/disk-full) and `sudo apt clean`.

## "Could not get lock /var/lib/dpkg/lock-frontend"

```text
E: Could not get lock /var/lib/dpkg/lock-frontend. It is held by process 1234 (unattended-upgr)
```

**Cause:** another package process runs. Right after a boot this is usually the automatic security update.

**Fix:** wait until it finishes. See what it is doing:

```bash
ps -o pid,etime,cmd -p 1234
```

Then try again in a few minutes. **Do not delete the lock files.** Only if no process holds the lock any more (for example after a crash or a lost SSH session during an upgrade) and apt still refuses, continue with the next section.

## "dpkg was interrupted, you must manually run 'sudo dpkg --configure -a'"

**Cause:** an installation stopped halfway, for example when the SSH connection dropped.

**Fix:** let dpkg finish configuring every unpacked package, then check the database:

```bash
sudo dpkg --configure -a
sudo dpkg --audit
```

**Verify:** `dpkg --audit` prints nothing, and `sudo apt update && sudo apt upgrade` runs through. Use `tmux` or `screen` for long upgrades, so a dropped connection does not interrupt them again.

## "Unmet dependencies. Try 'apt --fix-broken install'"

**Cause:** a package was installed without all of its dependencies, often from a downloaded `.deb` file.

**Fix:** let apt work out a repair:

```bash
sudo apt --fix-broken install
```

Read the list of packages apt wants to install or **remove** before you confirm. If it wants to remove something important, cancel and remove the package that caused the problem instead (`sudo apt remove package-name`).

## "NO_PUBKEY" or "The following signatures couldn't be verified"

```text
W: GPG error: https://repo.example.com stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 0123456789ABCDEF
```

**Cause:** a third-party repository is configured, but its signing key is missing, expired or was rotated by the vendor.

**Fix:** follow the vendor's current installation instructions to download its key again. The recommended layout stores the key in its own file and names it in the repository entry with `signed-by`, so it is trusted only for that repository:

```bash
sudo install -d -m 0755 /etc/apt/keyrings
ls /etc/apt/sources.list.d/
```

Compare the `signed-by` path in the repository file with the key file the vendor tells you to create. Do not use `apt-key`, and do not put third-party keys into `/etc/apt/trusted.gpg.d/`. If you no longer use the repository, delete its file from `/etc/apt/sources.list.d/` instead.

## "Release file … is not valid yet"

**Cause:** the server's clock is behind, so the repository's signature looks like it comes from the future.

**Fix:** check `timedatectl` and turn on time synchronisation as described in [hostname, time zone and time sync](/guides/linux-hostname-time-settings), then run `sudo apt update` again.

## "changed its 'Suite' value from 'stable' to 'oldstable'"

**Cause:** your Debian sources use the alias `stable` instead of a release name, and a new Debian release came out. Debian 12 became `oldstable` when Debian 13 was released.

**Fix:** decide whether you want to stay on your release or upgrade. To stay, replace `stable` with your release name (`bookworm` for Debian 12, `trixie` for Debian 13) in the files under `/etc/apt/`, then run `sudo apt update`. To accept the change once in a script, `apt-get` has `--allow-releaseinfo-change`. To upgrade, see [upgrade Ubuntu or Debian to a new release](/guides/upgrade-ubuntu-debian-release).

## "404 Not Found" on apt update

**Cause:** the repository is gone from that address. For a third-party repository, the vendor moved or dropped it. For the system's own repositories, the release reached its end of life: Ubuntu moves releases past their end of life from the regular archive to an archive server for old releases.

**Fix:** for a third-party repository, update or remove its entry. For an end-of-life release, the lasting fix is a supported release: [upgrade it](/guides/upgrade-ubuntu-debian-release) step by step, or reinstall the server with a current image and restore your data ([reinstall the operating system](/guides/reinstall-operating-system)).

## "The following packages have been kept back"

**Cause:** on Ubuntu, usually a **phased update**: a new version is offered to a growing share of machines over a few days. Packages can also be held because the upgrade would remove another package, or because someone held them with `apt-mark hold`.

**Fix:** check the package:

```bash
apt-cache policy package-name
apt-mark showhold
```

A candidate marked `phased` with a percentage reaches you automatically; you can ignore the message. For a package held because of new or removed dependencies, review and run `sudo apt full-upgrade`. Release a deliberate hold with `sudo apt-mark unhold package-name`.

## "E: Sub-process /usr/bin/dpkg returned an error code (1)"

**Cause:** a package's own install or removal script failed. The real reason is printed **above** this line.

**Fix:** scroll up to the first error of the package named there. Common causes are a full disk, a service that cannot start because of its configuration (check `sudo journalctl -xeu service-name`) and a configuration file you changed. After fixing the cause, run `sudo dpkg --configure -a` again.

## Next steps

- Keep security updates coming without you: [automatic updates](/guides/automatic-updates).
- Running an old release? [Upgrade Ubuntu or Debian to a new release](/guides/upgrade-ubuntu-debian-release).

## Frequently asked questions

### Can I just delete the lock files?

No. The lock exists because another package process is running, usually the automatic security updates. Deleting the lock while it runs can corrupt the package database. Wait for the process to finish instead.

### Is it safe to ignore packages that are kept back?

On Ubuntu, usually yes: phased updates roll a new version out to machines gradually, and yours gets it automatically later. If a package is held back for another reason, apt full-upgrade or installing the package by name resolves it.

### Why do I see 404 Not Found on apt update?

Either a third-party repository moved or the release reached its end of life and its packages left the regular mirrors. Upgrade to a supported release or reinstall the server with a current image.

### Should I use apt or apt-get?

Both use the same package system. apt is meant for working at the terminal and shows progress and colours; apt-get has a stable output for scripts. The fixes in this guide work with either.

---

Source: <https://hyperdc.com/guides/products/fix-apt-dpkg-errors>\
Updated: 2026-10-15