How to fix Clearsigned file isn't valid, got 'NOSPLIT' (does the network require authentication?) in APT

APTINTERMEDIATEHIGHUpdated Dec 29, 2025· 564 views

The "Clearsigned file isn't valid, got 'NOSPLIT'" error occurs when APT cannot validate the GPG signature on repository metadata (InRelease files). This is typically caused by incomplete downloads, network proxies modifying content, corrupted cache files, or authentication issues. Clearing the APT cache, switching mirrors, or checking network configuration usually resolves it.

Quick fix

Fixes Clearsigned file isn't valid, got 'NOSPLIT' (does the network require authentication?)

sudo rm -rf /var/lib/apt/lists/*
sudo apt update
  1. Clear your APT cache to remove potentially corrupted metadata
  2. Check your network connectivity and proxy settings
  3. Switch to a different repository mirror
  4. Verify that your system clock is accurate
apt — error
sudo rm -rf /var/lib/apt/lists/*
sudo apt update
Clearsigned file isn't valid, got 'NOSPLIT' (does the network require authentication?)

What this error means

This error indicates that APT's GPG signature verification failed when processing repository metadata. The "NOSPLIT" message specifically refers to how the clearsigned file is structured—APT expects the signature to be properly separated from the message content, but instead found an invalid or malformed format. The error message also hints at a possible authentication issue, suggesting that a network proxy or firewall might be intercepting and modifying the repository traffic before it reaches your system. This is common in corporate networks or behind HTTP proxies that require authentication.

Typical symptoms

  • apt update fails with the NOSPLIT clearsigned validation error
  • Some or all package repositories fail to verify while others work normally
  • The error occurs immediately or after a successful repository connection
  • apt update worked previously but suddenly starts failing
  • System is behind a corporate proxy or firewall

Common causes

  1. The InRelease or Release.gpg file was downloaded incompletely, leaving a corrupted signature
  2. A network proxy, firewall, or CDN is transparently modifying or compressing the repository metadata before it reaches your system
  3. The local APT cache contains a corrupted copy of the repository metadata file
  4. The repository mirror is in the middle of an update or synchronization cycle
  5. Repository metadata files on the mirror itself are malformed or corrupted
  6. Network authentication (HTTP proxy with username/password) is required but not configured
  7. An intermediary (corporate proxy, ISP, or firewall) is stripping or altering the GPG signature headers

How to fix "Clearsigned file isn't valid, got 'NOSPLIT' (does the network require authentication?)"

1Clear your APT cache to remove potentially corrupted metadata

The simplest first step is to remove all cached repository metadata and redownload it fresh:

bash
sudo rm -rf /var/lib/apt/lists/*
sudo apt update

This removes all locally cached copies of repository file lists. When you run apt update, APT will redownload the metadata from scratch, which often resolves signature validation issues caused by corrupted cache files.

2Check your network connectivity and proxy settings

Verify that your network connection is stable and check if you're behind a proxy that might be modifying traffic:

bash
# Check basic connectivity
ping -c 1 archive.ubuntu.com

# Check current proxy settings (if any)
echo $http_proxy
echo $https_proxy

If you see proxy settings configured, verify they are correct. If behind a corporate proxy that requires authentication, you may need to configure APT to use authenticated proxy settings. Edit or create /etc/apt/apt.conf.d/proxy.conf:

bash
Acquire::http::Proxy "http://username:password@proxy.example.com:8080/";
Acquire::https::Proxy "https://username:password@proxy.example.com:8080/";

Replace username, password, proxy address, and port with your actual values.

3Switch to a different repository mirror

The issue might be specific to your current mirror. Try switching to an alternative mirror:

bash
# Backup your current sources
sudo cp /etc/apt/sources.list /etc/apt/sources.list.backup

# Edit sources.list to use a different mirror
sudo nano /etc/apt/sources.list

Change your current mirror URL (like archive.ubuntu.com or deb.debian.org) to a different one:
- Ubuntu: Try mirror.example.com or regional mirrors
- Debian: Try httpredir.debian.org or regional mirrors

After changing mirrors, clear cache and update:

bash
sudo rm -rf /var/lib/apt/lists/*
sudo apt update
4Verify that your system clock is accurate

GPG signature validation depends on accurate time. If your system clock is significantly off, signature verification can fail:

bash
# Check current time
date

# Sync time with NTP servers
sudo ntpdate -s time.nist.gov
# Or use timedatectl on modern systems:
sudo timedatectl set-ntp true

An incorrect system clock can cause GPG signature verification to fail because signatures have time-validity windows. Ensure your time is synchronized with NTP servers.

5Update your GPG keys to ensure key validity

Occasionally, the repository GPG keys themselves need updating. Update the keyring package:

bash
# For Ubuntu/Debian
sudo apt install --reinstall ubuntu-keyring
# or
sudo apt install --reinstall debian-archive-keyring

# Update the local GPG keyring
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys YOUR_KEY_ID

However, note that apt-key is deprecated in newer Debian/Ubuntu versions. For modern systems, verify keys are properly configured in /etc/apt/trusted.gpg.d/ or use the signed-by option in your sources.list entries.

6Check if the repository mirror is experiencing issues

The mirror itself might be temporarily corrupt or undergoing maintenance. Test connectivity and mirror health:

bash
# Test connectivity to the mirror
curl -v https://archive.ubuntu.com/ubuntu/dists/jammy/InRelease 2>&1 | head -20

# Check if you're being redirected through a proxy
curl -I https://archive.ubuntu.com/ubuntu/

If the mirror appears to be down or returning errors, wait a few minutes and retry. You can also switch to a different mirror temporarily while the main mirror recovers.

7Disable HTTPS and use HTTP temporarily for testing

In some environments with problematic proxies, the HTTPS connection itself is being intercepted. For testing purposes, try switching to HTTP to isolate the issue:

bash
# Edit sources.list
sudo nano /etc/apt/sources.list

# Change https:// to http:// for one line to test
# Example:
# deb http://archive.ubuntu.com/ubuntu jammy main

sudo apt update

Note: HTTP is less secure. If this resolves the issue, it confirms your problem is HTTPS-related, likely from a proxy. Switch to HTTP only as a permanent solution if absolutely necessary, or configure your proxy correctly. Then switch back to HTTPS once the proxy is properly configured.

8Check for and remove problematic third-party repositories

Sometimes the error originates from a third-party PPA rather than official repositories. Identify and disable problematic sources:

bash
# List all repository sources
cat /etc/apt/sources.list
ls -la /etc/apt/sources.list.d/

# Temporarily disable third-party PPAs to test
sudo mv /etc/apt/sources.list.d/ppa-name.list /etc/apt/sources.list.d/ppa-name.list.bak

# Clear cache and update
sudo rm -rf /var/lib/apt/lists/*
sudo apt update

If update works after disabling a PPA, that PPA is the source of the issue. You can either remove it permanently or fix its configuration.

9Restore from backup and perform a full system cleanup

As a last resort, restore a clean APT configuration and perform a full cleanup:

bash
# Restore sources.list from backup if available
sudo cp /etc/apt/sources.list.backup /etc/apt/sources.list

# Remove all cached data
sudo rm -rf /var/lib/apt/lists/*
sudo apt clean
sudo apt autoclean

# Clear the package cache
sudo rm -f /var/lib/apt/lists/partial/*

# Rebuild the cache from scratch
sudo apt update

This removes all potentially corrupted files and rebuilds the package database from scratch. This approach resolves nearly all clearsigned validation issues.

Advanced notes

NOSPLIT vs SPLIT Message Format: The NOSPLIT message format in clearsigned files refers to how the signature is embedded. APT expects a specific structure where the message body and cryptographic signature are properly delimited with GPG clearsign headers. If a proxy or intermediary removes or alters these headers, APT cannot parse the file correctly, resulting in this error.

Proxy and MITM Attacks: Corporate proxies, ISPs, and firewalls sometimes perform deep packet inspection on HTTPS traffic. If the proxy doesn't properly handle or re-sign the clearsigned content, the signature becomes invalid. Some proxies also perform transparent compression or modification of traffic, which breaks GPG signatures. The error message's hint about "network requiring authentication" suggests checking proxy settings first.

InRelease vs Release Files: Modern APT prefers InRelease files (combined message + signature in one file) over the older Release + Release.gpg pair. Some mirrors may still provide only the older format. If you're having persistent issues with InRelease, you can temporarily configure APT to use the Release/Release.gpg pair instead by modifying your sources.list.

Time Synchronization Critical: GPG signatures have validity windows based on system time. GPG will reject signatures made in the future (relative to your system clock) or outside the key's validity period. Use timedatectl show to check NTP status and ensure your system time is accurate to within a few seconds.

Debugging with apt-get: Use verbose output to get more detailed error information:

bash
sudo apt update -o Debug::Acquire::gpg=1 2>&1 | grep -i error

This shows which specific file failed verification and may reveal whether it's InRelease, Release.gpg, or another metadata file causing the issue.

Frequently asked questions

What does "Clearsigned file isn't valid, got 'NOSPLIT' (does the network require" mean?
This error indicates that APT's GPG signature verification failed when processing repository metadata. The "NOSPLIT" message specifically refers to how the clearsigned file is structured—APT expects the signature to be properly separated from the message content, but instead found an invalid or malformed format. The error message also hints at a possible authentication issue, suggesting that a network proxy or firewall might be intercepting and modifying the repository traffic before it reaches your system.
How do I fix "Clearsigned file isn't valid, got 'NOSPLIT' (does the network require"?
The "Clearsigned file isn't valid, got 'NOSPLIT'" error occurs when APT cannot validate the GPG signature on repository metadata (InRelease files). This is typically caused by incomplete downloads, network proxies modifying content, corrupted cache files, or authentication issues. Clearing the APT cache, switching mirrors, or checking network configuration usually resolves it.
What causes "Clearsigned file isn't valid, got 'NOSPLIT' (does the network require"?
The InRelease or Release.gpg file was downloaded incompletely, leaving a corrupted signature A network proxy, firewall, or CDN is transparently modifying or compressing the repository metadata before it reaches your system The local APT cache contains a corrupted copy of the repository metadata file
Is the "Clearsigned file isn't valid, got 'NOSPLIT' (does the network require" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading