Koha Solutions

Installation & setup

apt cannot install koha-common

Unmet dependencies, NO_PUBKEY, or apt claiming the package does not exist. Four causes, in the order they actually occur, with the one command that tells you which of them you have.

Updated 2026-08-12 · Tested against Koha 26.05

Start by asking apt what it can actually see: apt-cache policy koha-common. If the candidate is (none) the repository is not configured or not trusted; if there is a candidate but the install fails on unmet dependencies, the repository is fine and your OS release is the mismatch. Those are two different problems with two different fixes.

Step 1Ask apt what it sees

Terminal
$ apt-cache policy koha-common koha-common:  Installed: (none)  Candidate: 26.05.00-1  Version table:     26.05.00-1 500        500 https://debian.koha-community.org/koha stable/main amd64 Packages

A candidate and a version table like that means the repository is working. Candidate: (none), or no version table at all, means apt has never successfully read the Koha repository — go to step 2. A candidate that installs and then fails is step 3.

Step 2Add the key and the repository properly

The two halves have to agree: the key file is named inside the repository line, so a key added the old way (apt-key) with a modern line, or the reverse, produces a repository apt refuses to trust.

Terminal
$ sudo apt -y install wget gnupg ca-certificates apt-transport-https$ wget -qO- https://debian.koha-community.org/koha/gpg.asc \    | sudo gpg --dearmor -o /usr/share/keyrings/koha-keyring.gpg$ echo "deb [signed-by=/usr/share/keyrings/koha-keyring.gpg] \https://debian.koha-community.org/koha stable main" \    | sudo tee /etc/apt/sources.list.d/koha.list$ sudo apt update

The apt update at the end is not optional and is the single most common omission — adding a .list file changes nothing until apt re-reads it. Watch its output: the Koha line should appear without a warning.

What apt update saysWhat it means
<code>NO_PUBKEY</code>The key was never installed, or not where the repository line says it is. Re-run the wget … gpg --dearmor line above.
<code>is not signed</code> / <code>signatures were invalid</code>The key file exists but is the armoured text rather than a keyring. It must be passed through gpg --dearmor, not saved directly.
<code>404 Not Found</code> on the suiteThe suite name is wrong. It is stable or oldstable, and main is the component.
<code>Certificate verification failed</code>ca-certificates is missing or the server clock is badly wrong. Check date.
Nothing — but still no candidateThe file is in the wrong place. It must be /etc/apt/sources.list.d/koha.list, and it must end in .list.

Step 3If the dependencies cannot be satisfied

koha-common pulls in a long list of Perl modules that come from your distribution, not from Koha. When apt says it "has unmet dependencies" or "requested an impossible situation", it is telling you that this OS release does not carry a version of something Koha needs.

Terminal
$ sudo apt install koha-common The following packages have unmet dependencies: koha-common : Depends: libmodule-name-perl (>= 2.30) but 2.10-1 is to be installedE: Unable to correct problems, you have held broken packages.

Two things fix this, in this order:

  1. 1On Ubuntu, make sure the universe component is enabled. Many Perl modules live there, and a minimal cloud image often has it switched off: sudo add-apt-repository universe && sudo apt update.
  2. 2Then try the previous Koha branch. Change stable to oldstable in /etc/apt/sources.list.d/koha.list, run sudo apt update, and install again. The older branch was built against an older set of distribution packages, and on an OS release that is a year or two old it will frequently resolve where stable cannot.

Do not force it with --force-yes, aptitude downgrades or a pinned mixture of releases

Forcing an install past a dependency conflict produces a Koha that starts and then fails somewhere specific and undiagnosable months later — usually in indexing or in a report. If stable and oldstable both refuse on a supported release, the answer is a different OS release, not a forced install.

Choosing that release is its own decision — which Ubuntu or Debian version to install Koha on covers how to check before you build the server rather than after.

Why Koha ships its own repository at all

Koha is not in Debian's or Ubuntu's own archives, so the project builds and hosts its own packages. That is what makes a package install possible in the first place, and it is also the source of every error above: an extra repository is one more thing that has to be configured, signed and matched to your OS.

The suites are branches, not versions. stable follows the current supported Koha release and moves when a new one is cut; oldstable follows the previous one. That is why a server built a year ago and never touched can suddenly fail to update — the suite it is pointed at has moved to a Koha that expects newer distribution packages than the OS underneath it has.

The practical consequence is worth planning for: the operating system release ages faster than Koha does. Building on the newest Ubuntu LTS or Debian stable buys roughly the whole life of that release before this becomes a decision again, and rebuilding a server every few years is a smaller job than fighting a dependency graph.

And if you are looking at this on a Windows machine, none of it applies — see can you install Koha on Windows? first.

Share this article

Would rather not do this yourself? We do it as a service — and if you would rather it were already done, it is on Koha Cloud before you log in.