How to Fix Duplicate apt Sources for Clean Updates

Wetin duplicate apt sources error mean

Duplicate apt sources mean say one repository dey declared two times, inside two different files, and APT (advanced package tool) don find both copies. For Ubuntu 24.04 and newer versions, this almost always happen because third party install script write old one line .list file, while deb822 .sources file for the same repository already dey for disk. Nothing spoil, and no package dey risk. Delete one of the two declarations, and the message go disappear.

Na this line people dey paste inside search box:

W: Target Packages (stable/binary-amd64/Packages) is configured multiple times in /etc/apt/sources.list.d/docker.list:1 and /etc/apt/sources.list.d/docker.sources:1

Read am from the end. Two files, each with line number, dey declare the same thing. Target Packages na the index apt dey download to learn which packages repository dey offer, while stable/binary-amd64/Packages name the component (stable) and architecture (amd64) wey that index cover. So apt dey tell you say amd64 index for stable component dey configured inside docker.list for line 1, and again inside docker.sources for line 1.

For apt 3.0 and newer, wey mean Ubuntu 25.04 onward and Debian 13, the same message dey start with Warning: instead of W:. The text after the prefix remain the same.

That warning na the mild case. apt merge the two declarations, and update still run because both describe the same archive with the same key. The serious case stop everything:

E: Conflicting values set for option Signed-By regarding source https://download.docker.com/linux/ubuntu/ noble: /usr/share/keyrings/docker-archive-keyring.gpg != /etc/apt/keyrings/docker.asc
E: The list of sources could not be read.

apt refuse for here because the two declarations name different signing keys for one archive. E go merge two identical declarations, but e no go choose between two Signed-By values, because choosing the wrong one mean checking package signatures against key wey archive owner never sign with. So apt no read any sources at all. apt update and apt install both fail with those same two lines until you edit the files by hand.

Duplicate one come from

The two formats dey inside different files wey get different extensions, so nothing for disk dey stop both make dem exist. apt notice the overlap late, when e expand every source file into the list of index targets wey e plan fetch. Before that point docker.list and docker.sources na two files wey no relate.

Four normal events fit produce the pair:

• A vendor install script, or command wey person copy from old post, write /etc/apt/sources.list.d/vendor.list with a tee line.
• The vendor own package later release /etc/apt/sources.list.d/vendor.sources and install am for you.
• add-apt-repository for Ubuntu 24.04 and newer dey write deb822 .sources files, so PPA (personal package archive) wey you add by hand before as .list come back as .sources.
• A release upgrade rewrite the distribution own sources into deb822 and leave your hand-written .list file untouched beside dem.

Each path dey make sense by itself. The duplicate na wetin you get when two of dem happen for the same box, often months apart.

Di format dey side by side

Old format na one line for each repository, and every part get fixed position.

deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu noble stable

Order no dey change: type (deb for binary packages, deb-src for source packages), then options for square brackets, then URI (uniform resource identifier) of the archive, then suite, then one or more components. Because position dey determine meaning, wrong space fit change wetin apt read.

deb822 dey write the same information as stanza wey get named fields. The name come from RFC 822, the mail header style wey Debian already dey use for package control files.

Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: noble
Components: stable
Architectures: amd64
Signed-By: /etc/apt/keyrings/docker.asc

Na the same repository and same key; nothing add. The mapping direct: deb become Types, archive address become URIs, suite become Suites, components become Components, and each bracket option become separate field, so signed-by= become Signed-By: and arch= become Architectures:.

Every field name plural because every field dey take space-separated list. Suites: noble noble-updates noble-backports for one stanza replace three separate deb lines. Blank line dey end stanza, so one .sources file fit hold several repositories. deb822 also fit carry settings wey one-line format no handle well: Enabled: no to switch repository off, Trusted, Check-Valid-Until, and inline key wey you paste straight inside Signed-By, with every line indented by one space and blank lines written as one dot.

Wia each file dey

• /etc/apt/sources.list: the original single file. For Ubuntu 24.04 and newer, e dey usually empty or e just get comment wey point to the new location.
• /etc/apt/sources.list.d/*.list: entries wey get one line each, normally one file for each repository.
• /etc/apt/sources.list.d/*.sources: deb822 stanzas. Ubuntu 24.04 and newer keep the distribution own repositories here, inside ubuntu.sources.
• /etc/apt/keyrings/: na here keys wey you add suppose dey. /usr/share/keyrings/ hold keys wey come from a package.

apt dey read only files wey end with .list or .sources, and filename fit contain letters, digits, underscore, hyphen and period. If file get any other extension, apt go skip am with notice. This one matter for the fix wey follow.

Find the duplicate pair

Start with the directory listing:

ls -l /etc/apt/sources.list.d/

-rw-r--r-- 1 root root  195 Aug  3 09:12 docker.list
-rw-r--r-- 1 root root  254 Aug  9 14:40 docker.sources
-rw-r--r-- 1 root root 2683 Jun 11 08:02 ubuntu.sources

Two files wey get the same stem but different extensions na the common pair, but no trust the names. Read wetin dey inside dem, because duplicate fit hide inside file wey get any name:

grep -rn -E '^(deb |deb-src |Types:|URIs:|Suites:|Signed-By:)' /etc/apt/sources.list /etc/apt/sources.list.d/

/etc/apt/sources.list.d/docker.list:1:deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu noble stable
/etc/apt/sources.list.d/docker.sources:1:Types: deb
/etc/apt/sources.list.d/docker.sources:2:URIs: https://download.docker.com/linux/ubuntu
/etc/apt/sources.list.d/docker.sources:3:Suites: noble
/etc/apt/sources.list.d/docker.sources:6:Signed-By: /etc/apt/keyrings/docker.asc

The pair na the two entries wey get the same host and the same suite. Both point to https://download.docker.com/linux/ubuntu and the suite noble, so na the same repository dem write two times. Their Signed-By paths too no match, and na this one dey cause the Conflicting values error wey show earlier.

Use grep instead of an apt command for this step. When apt don already stop because of the conflict, e no fit list your sources too, so apt-cache policy go print the same error instead of the answer wey you need.

Fix am: keep the deb822 file, remove the old one

Keep the .sources file. Na the format apt tooling dey write now, and na the direction Debian and Ubuntu dey move go. Before you delete anything, check which of the two key paths dey exist for disk:

ls -l /etc/apt/keyrings/ /usr/share/keyrings/ | grep -i docker

-rw-r--r-- 1 root root 4813 Aug  9 14:40 docker.asc

Na only /etc/apt/keyrings/docker.asc dey present, so na the deb822 file dey show the correct information, while the .list file dey point to key wey dem don remove. If the file wey you plan keep names the missing key, first copy the working path enter am, then delete the other file.

Move the old file comot from the directory instead of deleting am directly:

sudo mkdir -p /root/apt-sources-backup
sudo mv /etc/apt/sources.list.d/docker.list /root/apt-sources-backup/
sudo apt update

You fit also rename am to docker.list.bak and leave am for the same place, because apt dey ignore extensions wey e no know. But every apt run go print this:

N: Ignoring file 'docker.list.bak' in directory '/etc/apt/sources.list.d/' as it has an invalid filename extension

Moving the file go another place prevents that notice from showing for your screen and still keeps the backup. Afterward, healthy apt update go look like this, with no line wey names two files:

Hit:1 http://archive.ubuntu.com/ubuntu noble InRelease
Get:2 https://download.docker.com/linux/ubuntu noble InRelease [48.8 kB]
Get:3 http://security.ubuntu.com/ubuntu noble-security InRelease [126 kB]
Fetched 175 kB in 1s (146 kB/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
All packages are up to date.

Now confirm say the repository still dey work after the edit:

apt-cache policy | grep download.docker.com

 500 https://download.docker.com/linux/ubuntu noble/stable amd64 Packages
     origin download.docker.com

If vendor documentation still assumes the one-line file, you fit keep that one and delete the .sources file instead. One rule decide the matter either way: na exactly one file fit declare a particular archive and suite.

Why one broken third-party source dey block apt update

The failure wey dey near am look different but e get the same root cause: na third-party source wey apt no fit use. The first version na missing key:

Err:5 https://download.docker.com/linux/ubuntu noble InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7EA0A9C3F273FCD8
E: The repository 'https://download.docker.com/linux/ubuntu noble InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.

The Signed-By field no dey, or e point to file wey no be usable key, so apt no fit verify the signature for the archive InRelease file. E then throw away the whole repository instead of trusting package lists wey e no fit check. Check the key file itself:

ls -l /etc/apt/keyrings/docker.asc
gpg --show-keys /etc/apt/keyrings/docker.asc

Working key go print pub line with key id and uid line wey name the vendor. gpg: no valid OpenPGP data found. mean say the file no be key at all. Usually, na because the download save error page after the key URL don move. Fetch the key again, check the file, then run apt update.

The second version fit happen after release upgrade:

Err:6 https://ppa.launchpadcontent.net/ondrej/php/ubuntu plucky InRelease
  404  Not Found [IP: 10.0.0.80 443]
E: The repository 'https://ppa.launchpadcontent.net/ondrej/php/ubuntu plucky Release' does not have a Release file.

The PPA no publish anything for that suite, so the path no dey for the server and the request return 404. Your other repositories still update, and the packages wey you already get no change. But the run exit with non-zero status, so any script wey check the exit status of apt update go report failure every time e run. Na why you suppose clear one dead source for a box wey get unattended security upgrades configured: na for the daily noise real failure fit hide.

Disable one source without breaking the rest

For a deb822 file, add one field to the stanza and save am:

Types: deb
URIs: https://ppa.launchpadcontent.net/ondrej/php/ubuntu
Suites: plucky
Components: main
Signed-By: /etc/apt/keyrings/ondrej-php.asc
Enabled: no

The apt manual recommend this instead of commenting out every line for the stanza, and e easier to undo. For one line file, put # for the beginning of the line. For either format, moving the file comot from /etc/apt/sources.list.d/ still work, and na this option you suppose pick when the repository don disappear again.

Run sudo apt update again. The Err: block for that repository go disappear, and the exit status go return to 0. You fit check am with echo $? for the next line.

Never use sudo rm /etc/apt/sources.list.d/* to fix broken source. For Ubuntu 24.04 and newer, e dey delete ubuntu.sources. This file dey hold the distribution own repositories, so apt go remain without any package lists and report E: Unable to locate package curl for software wey clearly dey exist. If you don already run am, write the file back:

Types: deb
URIs: http://archive.ubuntu.com/ubuntu/
Suites: noble noble-updates noble-backports
Components: main restricted universe multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

Types: deb
URIs: http://security.ubuntu.com/ubuntu/
Suites: noble-security
Components: main restricted universe multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

Save am as /etc/apt/sources.list.d/ubuntu.sources. Replace noble with your own release name from lsb_release -cs, then run sudo apt update.

Convert legacy .list files to deb822

As of August 2026, apt 3.0 and newer don release converter for this work. Debian 13 get am, and Ubuntu 25.04 plus every release after am get am too, including 26.04. Check the version, then run am:

apt --version
sudo apt modernize-sources

E go rewrite the one-line files wey dey under /etc/apt/sources.list.d/ into deb822 .sources files. Read wetin e print, then list the directory by yourself and run apt update before you trust the result. Ubuntu 24.04 get older apt wey no get this subcommand, and for there the command go answer E: Invalid operation modernize-sources. For that release, convert am by hand with the field mapping above.

Conversion no compulsory today, because apt still dey read both formats. E make sense to do am for server wey you plan keep, because every tool wey dey write sources now dey write deb822, and a box wey get only .sources files no fit develop this kind duplicate.

Keep third-party sources tidy on a server

Third-party repositories na the part of server wey dey age worst. Each one na promise from another person say dem go continue publish packages for your Ubuntu release, and release upgrade go test all those promises for the same afternoon.

• Add third-party repository only when distribution package no fit do the work. A plain LAMP stack for Ubuntu 24.04 no need any: Ubuntu archive get every package wey e use, with security updates for the full life of the release.
• Keep keys for /etc/apt/keyrings/, one file for each vendor, with mode 644. The unprivileged _apt user dey download and must read the key, so key file wey only root fit read go cause permission error every time dem fetch from that repository.
• Point Signed-By to that exact file for every stanza. Key wey dey inside /etc/apt/trusted.gpg or /etc/apt/trusted.gpg.d/ dey trusted for every repository on the box, meaning say vendor key wey somebody add years ago fit validate packages from anywhere.
• Before release upgrade, read your sources and check say each vendor already dey publish for the suite wey you wan move to.

Key wey dey the old global keyring go show itself for every update:

W: https://download.docker.com/linux/ubuntu/dists/noble/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

Export that one key into its own file, then point the stanza to am:

gpg --no-default-keyring --keyring /etc/apt/trusted.gpg --export 7EA0A9C3F273FCD8 | sudo tee /etc/apt/keyrings/docker.gpg > /dev/null
sudo chmod 644 /etc/apt/keyrings/docker.gpg

Add Signed-By: /etc/apt/keyrings/docker.gpg to the repository stanza and run sudo apt update. The warning go stop once no repository depend on the old keyring again, and you fit then remove the entry with sudo gpg --no-default-keyring --keyring /etc/apt/trusted.gpg --delete-key 7EA0A9C3F273FCD8.

One more habit fit save you the most wahala. do-release-upgrade disables third-party sources for the upgrade and leaves dem switched off afterwards, and when you turn dem back on by hand, one after another, na exactly there duplicate declarations dey happen. Read the Ubuntu 24.04 to 26.04 upgrade guide before you start, and write down the repositories wey you still need. For machine wey you just build, the cheapest time to arrange sources well na during the first ten minutes for new VPS, while the only entries for the box still be the ones Ubuntu shipped.

FAQ

Why apt dey talk say one target configure plenty times?

Na because two files for inside /etc/apt/sources.list.d/ declare the same repository, suite, and component. The message go name both files with line numbers, like docker.list:1 and docker.sources:1. apt go merge dem and continue, so the update itself still dey work. But e good make you clear the duplicate: once the two files name different signing keys, apt go stop with E: Conflicting values set for option Signed-By and refuse to read any source at all. This one go block apt install too.

Make I keep the .list file or the .sources file?

Keep the .sources file. deb822 na wetin add-apt-repository dey write for Ubuntu 24.04 and newer. E get one named field for each setting instead of positional text inside square brackets, and na the format distributions dey move toward. Before you delete the .list file, confirm say the Signed-By path inside the .sources file point to a key wey dey exist, with ls -l /etc/apt/keyrings/. Move the old file out of /etc/apt/sources.list.d/ instead of renaming am inside the directory, because leftover .bak name go make apt print ignored-file notice every time e run.

How I fit turn off one apt repository without removing am?

For a deb822 .sources file, add Enabled: no to the stanza. For a one line .list file, put # for the beginning of the line. Either way, run sudo apt update afterwards and the Err: block for that repository go disappear. This na the correct step when third party repository never get packages for your Ubuntu release and the 404 dey make apt update exit with non-zero status.

The one line sources.list format dey go away?

E dey deprecated, but dem never remove am. apt still dey read .list files and go continue for long time, so nothing for your server go break tomorrow. New tools dey write deb822: Ubuntu 24.04 and newer keep the distribution repositories for /etc/apt/sources.list.d/ubuntu.sources, and add-apt-repository dey write .sources files. For apt 3.0 and newer, sudo apt modernize-sources go convert the files wey still remain.