Installation & setup
apt cannot install koha-common
Unmet dependencies, NO_PUBKEY, or apt claiming the package does not exist. Four causes, in the order they actually occur, with the one command that tells you which of them you have.
Updated 2026-08-12 · Tested against Koha 26.05
Start by asking apt what it can actually see: apt-cache policy koha-common. If the candidate is (none) the repository is not configured or not trusted; if there is a candidate but the install fails on unmet dependencies, the repository is fine and your OS release is the mismatch. Those are two different problems with two different fixes.
Step 1Ask apt what it sees
$ apt-cache policy koha-common koha-common: Installed: (none) Candidate: 26.05.00-1 Version table: 26.05.00-1 500 500 https://debian.koha-community.org/koha stable/main amd64 PackagesA candidate and a version table like that means the repository is working. Candidate: (none), or no version table at all, means apt has never successfully read the Koha repository — go to step 2. A candidate that installs and then fails is step 3.
Step 2Add the key and the repository properly
The two halves have to agree: the key file is named inside the repository line, so a key added the old way (apt-key) with a modern line, or the reverse, produces a repository apt refuses to trust.
$ sudo apt -y install wget gnupg ca-certificates apt-transport-https$ wget -qO- https://debian.koha-community.org/koha/gpg.asc \ | sudo gpg --dearmor -o /usr/share/keyrings/koha-keyring.gpg$ echo "deb [signed-by=/usr/share/keyrings/koha-keyring.gpg] \https://debian.koha-community.org/koha stable main" \ | sudo tee /etc/apt/sources.list.d/koha.list$ sudo apt updateThe apt update at the end is not optional and is the single most common omission — adding a .list file changes nothing until apt re-reads it. Watch its output: the Koha line should appear without a warning.
| What apt update says | What it means |
|---|---|
| <code>NO_PUBKEY</code> | The key was never installed, or not where the repository line says it is. Re-run the wget … gpg --dearmor line above. |
| <code>is not signed</code> / <code>signatures were invalid</code> | The key file exists but is the armoured text rather than a keyring. It must be passed through gpg --dearmor, not saved directly. |
| <code>404 Not Found</code> on the suite | The suite name is wrong. It is stable or oldstable, and main is the component. |
| <code>Certificate verification failed</code> | ca-certificates is missing or the server clock is badly wrong. Check date. |
| Nothing — but still no candidate | The file is in the wrong place. It must be /etc/apt/sources.list.d/koha.list, and it must end in .list. |
Step 3If the dependencies cannot be satisfied
koha-common pulls in a long list of Perl modules that come from your distribution, not from Koha. When apt says it "has unmet dependencies" or "requested an impossible situation", it is telling you that this OS release does not carry a version of something Koha needs.
$ sudo apt install koha-common The following packages have unmet dependencies: koha-common : Depends: libmodule-name-perl (>= 2.30) but 2.10-1 is to be installedE: Unable to correct problems, you have held broken packages.Two things fix this, in this order:
- 1On Ubuntu, make sure the
universecomponent is enabled. Many Perl modules live there, and a minimal cloud image often has it switched off:sudo add-apt-repository universe && sudo apt update. - 2Then try the previous Koha branch. Change
stabletooldstablein/etc/apt/sources.list.d/koha.list, runsudo apt update, and install again. The older branch was built against an older set of distribution packages, and on an OS release that is a year or two old it will frequently resolve wherestablecannot.
Do not force it with --force-yes, aptitude downgrades or a pinned mixture of releases
stable and oldstable both refuse on a supported release, the answer is a different OS release, not a forced install.Choosing that release is its own decision — which Ubuntu or Debian version to install Koha on covers how to check before you build the server rather than after.
Why Koha ships its own repository at all
Koha is not in Debian's or Ubuntu's own archives, so the project builds and hosts its own packages. That is what makes a package install possible in the first place, and it is also the source of every error above: an extra repository is one more thing that has to be configured, signed and matched to your OS.
The suites are branches, not versions. stable follows the current supported Koha release and moves when a new one is cut; oldstable follows the previous one. That is why a server built a year ago and never touched can suddenly fail to update — the suite it is pointed at has moved to a Koha that expects newer distribution packages than the OS underneath it has.
The practical consequence is worth planning for: the operating system release ages faster than Koha does. Building on the newest Ubuntu LTS or Debian stable buys roughly the whole life of that release before this becomes a decision again, and rebuilding a server every few years is a smaller job than fighting a dependency graph.
And if you are looking at this on a Windows machine, none of it applies — see can you install Koha on Windows? first.
Would rather not do this yourself? We do it as a service — and if you would rather it were already done, it is on Koha Cloud before you log in.
Related
More on installation & setup
Answers to the questions that usually arrive with this one.
MySQL or MariaDB for Koha, and which version
Install MariaDB from your distribution's own repository. Both work — Koha depends on a virtual package that either satisfies — but one of them is what everybody else is running.
Koha packages or a source install: which one you want
Almost every library wants the packages. Here is exactly what a source install gives up — the koha-* commands, the upgrade path, and most published answers — and the two cases where it is still right.
Which Ubuntu or Debian version to install Koha on
The newest Ubuntu LTS or current Debian stable, and nothing else — here is the one command that confirms it before you build the server, and what each other choice actually costs.
Apache will not start: Invalid command 'RewriteEngine'
Apache refuses to start after enabling a Koha site because mod_rewrite is not enabled. One command fixes it — and the same class of error covers the other three modules Koha needs.

