I cannot update apt on Debian 12 (via Qubes OS Update)

User Support
1

Dear Team,

Unfortunately, I could not update the installed apps correctly since two weeks ago on my Debian 12 template. Last update was on 5th August 2025. I got error or warn when I wanted to update Debian 12 template. Is there any simple way to solve this problem?

Here the logs form the terminal:

Updating debian-12-xfce-sys-firewall
Refreshing package info
Refreshing available packages.
Fail to refresh InRelease: https://apt.packages.shiftkey.dev/ubuntu any InRelease from https://apt.packages.shiftkey.dev/ubuntu/dists/any/InRelease
Fail to refresh InRelease: https://apt.packages.shiftkey.dev/ubuntu any InRelease from https://apt.packages.shiftkey.dev/ubuntu/dists/any/InRelease
Fail to refresh InRelease: https://apt.packages.shiftkey.dev/ubuntu any InRelease from https://apt.packages.shiftkey.dev/ubuntu/dists/any/InRelease
Refreshed.
Fail to refresh InRelease: https://apt.packages.shiftkey.dev/ubuntu any InRelease from https://apt.packages.shiftkey.dev/ubuntu/dists/any/InRelease
W:Target Packages (main/binary-amd64/Packages) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1, W:Target Packages (main/binary-all/Packages) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1, W:Target Translations (main/i18n/Translation-en) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1, W:Target DEP-11 (main/dep11/Components-amd64.yml) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1, W:Target DEP-11 (main/dep11/Components-all.yml) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1, W:Target DEP-11-icons-small (main/dep11/icons-48x48.tar) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1, W:Target DEP-11-icons (main/dep11/icons-64x64.tar) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1, W:Target Packages (main/binary-amd64/Packages) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3, W:Target Packages (main/binary-all/Packages) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3, W:Target Translations (main/i18n/Translation-en) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3, W:Target DEP-11 (main/dep11/Components-amd64.yml) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3, W:Target DEP-11 (main/dep11/Components-all.yml) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3, W:Target DEP-11-icons-small (main/dep11/icons-48x48.tar) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3, W:Target DEP-11-icons (main/dep11/icons-64x64.tar) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3, W:https://wire-app.wire.com/linux/debian/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details., E:Failed to fetch https://apt.packages.shiftkey.dev/ubuntu/dists/any/InRelease  Certificate verification failed: The certificate is NOT trusted. The name in the certificate does not match the expected.  Could not handshake: Error in the certificate verification. [IP: 127.0.0.1 8082], E:Some index files failed to download. They have been ignored, or old ones used instead.
Hit:1 https://brave-browser-apt-release.s3.brave.com stable InRelease
Ign:2 https://apt.packages.shiftkey.dev/ubuntu any InRelease
Hit:3 https://deb.debian.org/debian bookworm InRelease
Hit:4 https://packages.microsoft.com/repos/edge stable InRelease
Hit:5 https://deb.debian.org/debian-security bookworm-security InRelease
Hit:6 https://updates.signal.org/desktop/apt xenial InRelease
Hit:7 http://download.opensuse.org/repositories/home:/clayrisser:/bookworm/Debian_12  InRelease
Hit:8 https://packages.microsoft.com/repos/code stable InRelease
Hit:9 https://packages.element.io/debian default InRelease
Hit:10 https://deb.debian.org/debian bookworm-backports InRelease
Get:11 https://apt.syncthing.net syncthing InRelease [21.3 kB]
Hit:12 https://deb.qubes-os.org/r4.2/vm bookworm InRelease
Hit:13 http://debian.usebruno.com bruno InRelease
Hit:14 https://repo.teamsforlinux.de/debian stable InRelease
Hit:15 https://tvd-packages.tradingview.com/ubuntu/stable jammy InRelease
Hit:16 https://download.sublimetext.com apt/dev/ InRelease
Hit:17 https://deb.cwtch.im/cwtch.im stable InRelease
Get:18 https://wire-app.wire.com/linux/debian stable InRelease [4,145 B]
Ign:2 https://apt.packages.shiftkey.dev/ubuntu any InRelease
Ign:2 https://apt.packages.shiftkey.dev/ubuntu any InRelease
Hit:19 https://repository.mullvad.net/deb/stable bookworm InRelease
Err:2 https://apt.packages.shiftkey.dev/ubuntu any InRelease
  Certificate verification failed: The certificate is NOT trusted. The name in the certificate does not match the expected.  Could not handshake: Error in the certificate verification. [IP: 127.0.0.1 8082]
Fetched 25.5 kB in 8s (3,271 B/s)
Reading package lists...
W: Target Packages (main/binary-amd64/Packages) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1
W: Target Packages (main/binary-all/Packages) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1
W: Target Translations (main/i18n/Translation-en_US) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1
W: Target Translations (main/i18n/Translation-en) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1
W: Target DEP-11 (main/dep11/Components-amd64.yml) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1
W: Target DEP-11 (main/dep11/Components-all.yml) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1
W: Target DEP-11-icons-small (main/dep11/icons-48x48.tar) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1
W: Target DEP-11-icons (main/dep11/icons-64x64.tar) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1
W: Target Packages (main/binary-amd64/Packages) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3
W: Target Packages (main/binary-all/Packages) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3
W: Target Translations (main/i18n/Translation-en_US) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3
W: Target Translations (main/i18n/Translation-en) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3
W: Target DEP-11 (main/dep11/Components-amd64.yml) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3
W: Target DEP-11 (main/dep11/Components-all.yml) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3
W: Target DEP-11-icons-small (main/dep11/icons-48x48.tar) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3
W: Target DEP-11-icons (main/dep11/icons-64x64.tar) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3
W: https://wire-app.wire.com/linux/debian/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
E: Failed to fetch https://apt.packages.shiftkey.dev/ubuntu/dists/any/InRelease  Certificate verification failed: The certificate is NOT trusted. The name in the certificate does not match the expected.  Could not handshake: Error in the certificate verification. [IP: 127.0.0.1 8082]
E: Some index files failed to download. They have been ignored, or old ones used instead.
W: Target Packages (main/binary-amd64/Packages) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1
W: Target Packages (main/binary-all/Packages) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1
W: Target Translations (main/i18n/Translation-en_US) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1
W: Target Translations (main/i18n/Translation-en) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1
W: Target DEP-11 (main/dep11/Components-amd64.yml) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1
W: Target DEP-11 (main/dep11/Components-all.yml) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1
W: Target DEP-11-icons-small (main/dep11/icons-48x48.tar) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1
W: Target DEP-11-icons (main/dep11/icons-64x64.tar) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/archive_uri-http_deb_debian_org_debian-bookworm.list:1
W: Target Packages (main/binary-amd64/Packages) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3
W: Target Packages (main/binary-all/Packages) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3
W: Target Translations (main/i18n/Translation-en_US) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3
W: Target Translations (main/i18n/Translation-en) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3
W: Target DEP-11 (main/dep11/Components-amd64.yml) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3
W: Target DEP-11 (main/dep11/Components-all.yml) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3
W: Target DEP-11-icons-small (main/dep11/icons-48x48.tar) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3
W: Target DEP-11-icons (main/dep11/icons-64x64.tar) is configured multiple times in /etc/apt/sources.list.d/microsoft-edge-dev.list:3 and /etc/apt/sources.list.d/microsoft-edge.list:3

Thanks for any help.

Cheers
AC

2

You have duplicates in /etc/apt/sources.list. Can you paste that file here? It is a list of repositories for software your system uses. Also, it seems you have Ubuntu repos. Did you set those up?

3

Yes, here is:

deb https://deb.debian.org/debian bookworm main contrib non-free-firmware
# deb-src https://deb.debian.org/debian bookworm main contrib non-free-firmware

deb https://deb.debian.org/debian-security bookworm-security main contrib non-free-firmware
# deb-src https://deb.debian.org/debian-security bookworm-security main contrib non-free-firmware
4

I do not remember well. I do not think that I set those up this year.

Thanks for asking me that.

5

Okay, so if it’s not in sources.list then it’s in sources.list.d/. Can you paste the result of running:

ls /etc/apt/sources.list.d/
6 
archive_uri-http_deb_debian_org_debian-bookworm.list
backports.list
brave-browser-release.list
bruno.list
cwtch.im.list
element-io.list
home:clayrisser:bookworm.list
microsoft-edge-dev.list
microsoft-edge.list
mullvad.list
onlyoffice.list~
qubes-r4.list
shiftkey-packages-desktop.list
signal-desktop.list
sublime-text.list
syncthing.list
teams-for-linux-packages.list
tradingview-desktop.list
vscode.sources
wire-desktop.list
7

I’m stupid, forgive me. The lines starting with W: in the logs will tell you which files are duplicates. It looks like archive_uri-http_deb_debian_org_debian-bookworm.list should probably be deleted, but make sure there aren’t unique lines in it. Also, microsoft-edge.list and microsoft-edge-dev.list have duplicates.

1 Like
8

You’ll also need to locate the line https://apt.packages.shiftkey.dev/ubuntu any InRelease. There is an error with this repo (that it’s certificate is bad). You’ll have to investigate that one further.

9

You are right. Now it looks better with the Update.

I did delete these lines:

archive_uri-http_deb_debian_org_debian-bookworm.list
microsoft-edge-dev.list

But this still is an issue with the complete update (as you mentioned):

Fail to refresh InRelease: https://apt.packages.shiftkey.dev/ubuntu any InRelease from https://apt.packages.shiftkey.dev/ubuntu/dists/any/InRelease
Refreshed.
W:https://wire-app.wire.com/linux/debian/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details., E:Failed to fetch https://apt.packages.shiftkey.dev/ubuntu/dists/any/InRelease  Certificate verification failed: The certificate is NOT trusted. The name in the certificate does not match the expected.  Could not handshake: Error in the certificate verification. [IP: 127.0.0.1 8082], E:Some index files failed to download. They have been ignored, or old ones used instead.
Hit:19 https://repository.mullvad.net/deb/stable bookworm InRelease
Err:4 https://apt.packages.shiftkey.dev/ubuntu any InRelease
  Certificate verification failed: The certificate is NOT trusted. The name in the certificate does not match the expected.  Could not handshake: Error in the certificate verification. [IP: 127.0.0.1 8082]
Fetched 25.5 kB in 8s (3,295 B/s)
Reading package lists...
W: https://wire-app.wire.com/linux/debian/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
E: Failed to fetch https://apt.packages.shiftkey.dev/ubuntu/dists/any/InRelease  Certificate verification failed: The certificate is NOT trusted. The name in the certificate does not match the expected.  Could not handshake: Error in the certificate verification. [IP: 127.0.0.1 8082]
E: Some index files failed to download. They have been ignored, or old ones used instead.
1 Like
10

So when you did the ls line, that listed files. Inside those files are lists of repo URLs, and that’s what I meant by ‘line’. It’s highly unlikely you deleted anything important as both those files looked to be full duplicates, but make sure to be careful.

The only line causing trouble now should be https://apt.packages.shiftkey.dev/ubuntu any InRelease. Your system is likely fully updated except for any updates for software coming from that repo. If you want to be certain, find the line with that URL and temporarily put a # in front of it (remember to remove the # when finished). This will disable the repo and allow the system to update without error. But for your system to update software from that repo, you’ll have to figure out what happened to the certificate.

1 Like
11

I appreciate Linux/Unix because everything that usually generates an error can be read from the error message.

You should calmly analyze the output in the CLI after attempting to update → everything is written there.

1 Like
12

Thanks a lot. It has been fixed. I could calmly analyze the output and commented out the unneeded duplicated repos.

13

Thanks a lot for your recommendation. I did make it as described by you careful. I did not delete those files (did rollback then), I just looked into the file for duplicates and commended out the unneeded duplicated lines. It works then.

For the trouble with certificate issue, I did follow that point:

Link: Known Issue

a)

 sudo wget -q -O /usr/share/keyrings/wire-desktop.key https://wire-app.wire.com/linux/releases.key

b)

 echo "deb [arch=amd64 signed-by=/usr/share/keyrings/wire-desktop.key] https://wire-app.wire.com/linux/debian stable main" \
   | sudo tee /etc/apt/sources.list.d/wire-desktop.list