Hey, thanks for the detailed report with hashes and timings. This is a known issue on our side with the apt repo metadata. InRelease got out of sync with Packages.gz. Itâs not a bug in your system.
This doesnât affect Cursor itself, and you already noticed that. Here are a few workarounds, from quick to more invasive:
Clear the local apt metadata cache and force a fresh fetch:
sudo rm -rf /var/lib/apt/lists/*
sudo apt update
If you cached an old InRelease locally, this should fix it right away. If the mismatch is still there, itâs on the repo metadata side.
Just retry sudo apt update a bit later. After the next publish cycle, the hashes usually line up again.
If this is blocking other updates right now, temporarily comment out the Cursor source:
sudo nano /etc/apt/sources.list.d/cursor.sources
Add # before the URIs: line (or comment out the whole block), run apt update, then revert it.
Weâve already logged the issue. Once thereâs an update, Iâll reply in the thread. Let me know at which step the mismatch goes away, or if it doesnât. That helps confirm whether itâs client-side or server-side.
Iâve tried everything you suggested (and even more, like âsudo apt cleanâ, reinstalling the package and so on), but nothing worked. So yes, it looks like the problem is on the server side, as you already mentioned.
For now, I can just ignore the error or disable the Cursor repo, so this doesnât block my work in any way, but ofcourse it would be great go get Cursor updates sometime again.
Thanks for running through all the steps. It confirms the issue is on the repo side, not on your end. This canât be fixed with client workarounds anymore, the metadata mismatch needs to be fixed on the server.
Weâve logged the issue on our side. For now, you can safely keep the Cursor source commented out or just ignore the error, it wonât affect how Cursor works. Iâll post an update in this thread as soon as I have one.
3.377 Warning: OpenPGP signature verification failed: /aptrepo stable InRelease: The following signatures couldnât be verified because the public key is not available: NO_PUBKEY 42A1772E62E492D6
3.377 Error: The repository â stable InReleaseâ is not signed.
Steps to Reproduce
Consider the following Docker file:
FROM ubuntu:26.04
# Add Cursor's GPG key
RUN curl -fsSL https://downloads.cursor.com/keys/anysphere.asc \
| gpg --dearmor \
| tee /etc/apt/keyrings/cursor.gpg >/dev/null
RUN chmod 644 /etc/apt/keyrings/cursor.gpg
# Add the Cursor repository
RUN echo 'deb [arch=amd64 signed-by=/etc/apt/keyrings/cursor.gpg] https://downloads.cursor.com/aptrepo stable main' \
| tee /etc/apt/sources.list.d/cursor.list
# Update and install
RUN apt update && apt install -y cursor
Expected Behavior
I have been using the above Dockerfile sniper for months and it worked. This is a regression bug.
Installation issue for APT after following instructions from:
/docs/get-started/quickstart
For AI issues: which model did you use?
N/A
For AI issues: add Request ID with privacy disabled
N/A
Additional Information
Most likely a regression where public GPG key did not get updated. I cannot use standalone DEB files, unless there is an universal URL to download the latest version - need to automate install task.
Note: I did install Cursor using .deb file, but it seems to be breaking follow-up apt update commands. Installing Cursor right now is potentially dangerous to automated work deployments.
Yep, itâs fixed on our side. The apt repo metadata is back in sync, InRelease and Packages.gz match again by hashes, so sudo apt update should run without errors. This is a server-side fix, you donât need to update Cursor.
If anyone still sees the old mismatch locally, itâs cached metadata. You can clear it like this:
sudo rm -rf /var/lib/apt/lists/*
sudo apt update
If you hit the error again after that, let me know and weâll take a look.
