Debian 9 – apt update fails because repository Release file is expired

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

apt metadata refresh fails and security patching is blocked until repository trust and freshness are restored.

Environment & Reproduction

Seen on Debian 9 hosts with stale mirrors, snapshot drift, or incorrect local clock.

# Capture baseline
cat /etc/debian_version
uname -r
apt-cache policy | sed -n 1,40p
date -u
systemctl --failed

Root Cause Analysis

Repository metadata validity has expired or system time is skewed, so apt-secure rejects the Release information.

Quick Triage

Confirm clock health, mirror reachability, and apt source consistency before deeper changes.

# Quick triage
timedatectl status || true
grep -R ^deb /etc/apt/sources.list /etc/apt/sources.list.d 2>/dev/null
apt-get clean
apt-get update

Step-by-Step Diagnosis

Collect apt output and compare metadata timestamps to host time to verify expiry conditions.

# Detailed diagnosis
apt-get update 2>&1 | tee /tmp/apt_update_151.log
awk /Release file/ /tmp/apt_update_151.log
journalctl -u systemd-timesyncd -n 100 --no-pager || true
dig +short deb.debian.org

Solution – Primary Fix

Correct time sync, replace failing mirrors with healthy endpoints, then refresh package metadata.

# Primary fix
sudo timedatectl set-ntp true || true
sudo sed -i s@http://deb.debian.org@http://archive.debian.org@g /etc/apt/sources.list
sudo apt-get clean
sudo apt-get update

Solution – Alternative Approaches

Use controlled snapshot or internal mirror sources when internet mirror freshness is inconsistent.

# Alternatives
sudo cp /etc/apt/sources.list /etc/apt/sources.list.bak
sudo apt-cache policy
sudo apt-get -o Acquire::Check-Valid-Until=false update

Verification & Acceptance Criteria

apt update completes with zero Release-file validity errors and package candidate lists are populated.

# Verify
apt-get update
apt-cache policy | sed -n 1,60p
apt-get -s upgrade | sed -n 1,30p

Rollback Plan

Restore prior source definitions and time settings if repository compatibility regresses.

# Rollback
sudo test -f /etc/apt/sources.list.bak && sudo cp /etc/apt/sources.list.bak /etc/apt/sources.list
sudo apt-get clean
sudo apt-get update

Prevention & Hardening

Monitor time sync and mirror health; enforce repository change control before maintenance windows.

# Hardening
crontab -l | cat
echo 5 * * * * /usr/bin/apt-get update >/dev/null 2>&1 | crontab -
apt-config dump | sed -n 1,80p

Related Errors & Cross-Refs

Often appears with InRelease not valid yet, signature date mismatch, and temporary mirror sync failures.

Related tutorial: View the step-by-step tutorial for Debian 9.

View all Debian 9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian apt-secure documentation, mirror operations guidance, and time synchronization best practices.