As of October 3, 2026, Dropbox’s Ubuntu resolute repository causes apt update to exit with code 100: File has unexpected size (1192 != 1203). Mirror sync in progress? Direct downloads, independently of APT, show inconsistent repository files: * InRelease is dated September 29, 2026, and expects AMD64 Packages.bz2 to contain 1,203 bytes. * The server returns 1,192 bytes, matching the older Release dated July 1, 2026. * The i386 index also differs: 514 bytes delivered versus 515 expected. * InRelease verifies successfully against the configured Dropbox signing key, but the served Release.gpg fails verification against the served Release. * Fresh downloads and cache-bypass requests reproduce the mismatch, including CloudFront responses marked as cache misses. * Sampled indexes for Ubuntu noble, Ubuntu questing, and Debian trixie match their metadata. Affected repository: https://linux.dropbox.com/ubuntu/dists/resolute/ Affected AMD64 index: https://linux.dropbox.com/ubuntu/dists/resolute/main/binary-amd64/Packages.bz2 Expected SHA256 from InRelease: 8aa024cb2e76ef1d7e6d1f85f19b5fdbdfc1a17752aaf1573f6ad32d7b7a6f16 Actual SHA256, which matches the older Release: 9f0667f188d372117ea429514705184d7f74ab4ffa3ceba332a7b587d45700e4 A similar metadata inconsistency was reported on January 14, 2026, and your team confirmed a fix on January 15: https://community.dropbox.com/en/discussion/comment/854951 Please escalate this to the team responsible for Linux repository publication/CDN delivery and restore consistency between InRelease, Release, Release.gpg, and the package indexes.

nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Ubuntu resolute APT repository serves inconsistent metadata and indexes

elsterson

As of October 3, 2026, Dropbox’s Ubuntu resolute repository causes apt update to exit with code 100:

File has unexpected size (1192 != 1203). Mirror sync in progress?

Direct downloads, independently of APT, show inconsistent repository files:

InRelease is dated September 29, 2026, and expects AMD64 Packages.bz2 to contain 1,203 bytes.
The server returns 1,192 bytes, matching the older Release dated July 1, 2026.
The i386 index also differs: 514 bytes delivered versus 515 expected.
InRelease verifies successfully against the configured Dropbox signing key, but the served Release.gpg fails verification against the served Release.
Fresh downloads and cache-bypass requests reproduce the mismatch, including CloudFront responses marked as cache misses.
Sampled indexes for Ubuntu noble, Ubuntu questing, and Debian trixie match their metadata.

Affected repository:
https://linux.dropbox.com/ubuntu/dists/resolute/

Affected AMD64 index:
https://linux.dropbox.com/ubuntu/dists/resolute/main/binary-amd64/Packages.bz2

Expected SHA256 from InRelease:

8aa024cb2e76ef1d7e6d1f85f19b5fdbdfc1a17752aaf1573f6ad32d7b7a6f16

Actual SHA256, which matches the older Release:

9f0667f188d372117ea429514705184d7f74ab4ffa3ceba332a7b587d45700e4

A similar metadata inconsistency was reported on January 14, 2026, and your team confirmed a fix on January 15:
https://community.dropbox.com/en/discussion/comment/854951

Please escalate this to the team responsible for Linux repository publication/CDN delivery and restore consistency between InRelease, Release, Release.gpg, and the package indexes.