Hey, thanks for the detailed report with hashes and the Dockerfile. This is the same known issue on our side as described here: Hash Sum mismatch when apt update
In short, the apt repo metadata got out of sync. InRelease was signed before Packages.gz finished updating, so the hashes don’t match. You’re seeing the same SHA256 values as other reports. This isn’t an issue with your Dockerfile or system, and client-side workarounds like apt clean or wiping /var/lib/apt/lists/* won’t help. This needs a server-side fix. After the next publish cycle, the hashes usually match again, so the apt install path may start working on its own if you retry apt update later.
If you need to automate installation in Docker right now without waiting for the repo, you can pull the binary directly via the download API. Important: the endpoint returns JSON, not the file itself, so you need to extract the URL from the response, for example with jq:
RUN apt-get update && apt-get install -y curl jq \
&& DL_URL=$(curl -fsSL "https://www.cursor.com/api/download?platform=linux-x64&releaseTrack=stable" | jq -r '.downloadUrl') \
&& echo "Resolved download URL: $DL_URL"
For platform=linux-x64, this endpoint returns an AppImage link by default. To get a .deb, in the returned URL on downloads.cursor.com, replace the /appimage/ segment with /deb/. It still stays on official infrastructure:
.../production/client/linux/x64/appimage/Cursor-<ver>-<sha>...
↓
.../production/client/linux/x64/deb/Cursor-<ver>-<sha>...
Then run curl -fsSL "$DEB_URL" -o /tmp/cursor.deb && apt install -y /tmp/cursor.deb. If you prefer the AppImage, you can run it directly, in Docker usually via --appimage-extract or with --no-sandbox.
We’ve logged the bug. I can’t share an ETA yet. Once there’s an update, I’ll reply in the thread.