Hey, thanks for the detailed report with hashes and timings. This is a known issue on our side with the apt repo metadata. InRelease got out of sync with Packages.gz. It’s not a bug in your system.
This doesn’t affect Cursor itself, and you already noticed that. Here are a few workarounds, from quick to more invasive:
Clear the local apt metadata cache and force a fresh fetch:
sudo rm -rf /var/lib/apt/lists/*
sudo apt update
If you cached an old InRelease locally, this should fix it right away. If the mismatch is still there, it’s on the repo metadata side.
Just retry sudo apt update a bit later. After the next publish cycle, the hashes usually line up again.
If this is blocking other updates right now, temporarily comment out the Cursor source:
sudo nano /etc/apt/sources.list.d/cursor.sources
Add # before the URIs: line (or comment out the whole block), run apt update, then revert it.
We’ve already logged the issue. Once there’s an update, I’ll reply in the thread. Let me know at which step the mismatch goes away, or if it doesn’t. That helps confirm whether it’s client-side or server-side.
I’ve tried everything you suggested (and even more, like “sudo apt clean”, reinstalling the package and so on), but nothing worked. So yes, it looks like the problem is on the server side, as you already mentioned.
For now, I can just ignore the error or disable the Cursor repo, so this doesn’t block my work in any way, but ofcourse it would be great go get Cursor updates sometime again.
Thanks for running through all the steps. It confirms the issue is on the repo side, not on your end. This can’t be fixed with client workarounds anymore, the metadata mismatch needs to be fixed on the server.
We’ve logged the issue on our side. For now, you can safely keep the Cursor source commented out or just ignore the error, it won’t affect how Cursor works. I’ll post an update in this thread as soon as I have one.
3.377 Warning: OpenPGP signature verification failed: /aptrepo stable InRelease: The following signatures couldn’t be verified because the public key is not available: NO_PUBKEY 42A1772E62E492D6
3.377 Error: The repository ‘ stable InRelease’ is not signed.
Steps to Reproduce
Consider the following Docker file:
FROM ubuntu:26.04
# Add Cursor's GPG key
RUN curl -fsSL https://downloads.cursor.com/keys/anysphere.asc \
| gpg --dearmor \
| tee /etc/apt/keyrings/cursor.gpg >/dev/null
RUN chmod 644 /etc/apt/keyrings/cursor.gpg
# Add the Cursor repository
RUN echo 'deb [arch=amd64 signed-by=/etc/apt/keyrings/cursor.gpg] https://downloads.cursor.com/aptrepo stable main' \
| tee /etc/apt/sources.list.d/cursor.list
# Update and install
RUN apt update && apt install -y cursor
Expected Behavior
I have been using the above Dockerfile sniper for months and it worked. This is a regression bug.
Installation issue for APT after following instructions from:
/docs/get-started/quickstart
For AI issues: which model did you use?
N/A
For AI issues: add Request ID with privacy disabled
N/A
Additional Information
Most likely a regression where public GPG key did not get updated. I cannot use standalone DEB files, unless there is an universal URL to download the latest version - need to automate install task.
Note: I did install Cursor using .deb file, but it seems to be breaking follow-up apt update commands. Installing Cursor right now is potentially dangerous to automated work deployments.
Yep, it’s fixed on our side. The apt repo metadata is back in sync, InRelease and Packages.gz match again by hashes, so sudo apt update should run without errors. This is a server-side fix, you don’t need to update Cursor.
If anyone still sees the old mismatch locally, it’s cached metadata. You can clear it like this:
sudo rm -rf /var/lib/apt/lists/*
sudo apt update
If you hit the error again after that, let me know and we’ll take a look.
