PVE 9 (Debian 13 trixie, deb822 format):

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

cat > /etc/apt/sources.list.d/proxmox.sources <<'EOF'
Types: deb
URIs: http://download.proxmox.com/debian/pve
Suites: trixie
Components: pve-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
EOF

# Disable enterprise (without a subscription it returns 401 on every apt update)
grep -q '^Enabled:' /etc/apt/sources.list.d/pve-enterprise.sources \
  || echo 'Enabled: false' >> /etc/apt/sources.list.d/pve-enterprise.sources

apt update && apt full-upgrade

PVE 8 (Debian 12 bookworm, one-line format):

1
2
3
4
5

echo 'deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription' \
  > /etc/apt/sources.list.d/pve-no-subscription.list
sed -i 's/^deb /# deb /' /etc/apt/sources.list.d/pve-enterprise.list

apt update && apt full-upgrade

If the host runs Ceph, the Ceph enterprise repo has to be disabled too and swapped for its no-subscription (below).

What each repository does

Proxmox is clear about it: pve-no-subscription is for testing and non-production use; in production they want you to pay for a subscription and use enterprise. For a lab or a homelab it is the normal repo.

The enterprise 401 does not break anything by itself, but every apt update ends in an error and the other repos are left half refreshed. Disabling it is the fix; there is no need to delete it.

PVE 9: .sources files (deb822)

Since PVE 9 the installer already writes /etc/apt/sources.list.d/pve-enterprise.sources in deb822 format. A .sources file is a block of keys:

1
2
3
4
5
6
7

# /etc/apt/sources.list.d/pve-enterprise.sources
Types: deb
URIs: https://enterprise.proxmox.com/debian/pve
Suites: trixie
Components: pve-enterprise
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
Enabled: false

Enabled: false keeps it written but inactive. The no-subscription block is the one in the TL;DR; the test one is the same with Components: pve-test.

If you carry .list files from an upgrade off PVE 8, apt 3 converts them for you:

1

apt modernize-sources

It rewrites each .list as .sources and leaves the original as .list.bak.

PVE 8: .list files

1
2
3
4
5

# /etc/apt/sources.list.d/pve-enterprise.list
# deb https://enterprise.proxmox.com/debian/pve bookworm pve-enterprise

# /etc/apt/sources.list.d/pve-no-subscription.list
deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription

Commenting the enterprise line with # is the deb822 Enabled: false equivalent.

Ceph

The installer also leaves the Ceph enterprise repo. Same treatment; the repo name carries the Ceph release the cluster runs (ceph -v):

PVE 9:

1
2
3
4
5
6

# /etc/apt/sources.list.d/ceph.sources
Types: deb
URIs: http://download.proxmox.com/debian/ceph-tentacle
Suites: trixie
Components: no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg

Swap ceph-tentacle for ceph-squid if you are still on Squid. If the original file had Components: enterprise, replace the whole file with this one.

PVE 8:

1
2
3

# /etc/apt/sources.list.d/ceph.list
# deb https://enterprise.proxmox.com/debian/ceph-squid bookworm enterprise
deb http://download.proxmox.com/debian/ceph-squid bookworm no-subscription

On bookworm there are ceph-quincy, ceph-reef, and ceph-squid; use the one matching your cluster, not the newest.

Proxmox Backup Server

Identical pattern with pbs in the URI and pbs-no-subscription as the component:

1
2
3
4
5
6

# /etc/apt/sources.list.d/proxmox.sources (PBS 4, trixie)
Types: deb
URIs: http://download.proxmox.com/debian/pbs
Suites: trixie
Components: pbs-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg

And Enabled: false in pbs-enterprise.sources.

Traps

• Do not mix suites. bookworm on PVE 8, trixie on PVE 9. One line with the wrong suite breaks the next full-upgrade.
• The keyring is already there. /usr/share/keyrings/proxmox-archive-keyring.gpg ships with any ISO install. You only need to download it when installing Proxmox on top of a clean Debian (the official guide for that path covers it).
• Signed-By is mandatory in deb822; without that line apt ignores the repo with a warning.
• If apt fails with pve-apt-hook: not found, that is not a repo problem: separate post.
• The GUI’s “no valid subscription” notice is independent of the repos and is not fixed here; a Community subscription removes it and gives you the enterprise repo as a bonus.

Reference: Package Repositories on the Proxmox wiki.

1
2
3
4
5

mkdir -p /usr/share/proxmox-ve
touch /usr/share/proxmox-ve/pve-apt-hook
chmod +x /usr/share/proxmox-ve/pve-apt-hook
apt install -f
apt install proxmox-ve

Once proxmox-ve is reinstalled, the real hook replaces the empty one and apt is back to normal.

The error

1
2

/bin/sh: 1: /usr/share/proxmox-ve/pve-apt-hook: not found
E: Failure running script /usr/share/proxmox-ve/pve-apt-hook

It shows up on any apt install, apt upgrade, or apt full-upgrade, and blocks everything, including whatever you try in order to fix it.

Why it happens

The proxmox-ve package installs two things that belong together:

If proxmox-ve went away (a miscalculated apt remove or autoremove, an interrupted dist-upgrade, a half-installed package), the script disappears but the file under /etc/apt/apt.conf.d/ is a conffile and stays. apt keeps trying to run a script that no longer exists and fails before touching anything.

Fix if you want to keep Proxmox

The empty hook only gets apt running; the point is to reinstall proxmox-ve:

1
2
3
4
5
6

mkdir -p /usr/share/proxmox-ve
touch /usr/share/proxmox-ve/pve-apt-hook
chmod +x /usr/share/proxmox-ve/pve-apt-hook

apt install -f            # close broken dependencies first (Proxmox staff recommendation)
apt install proxmox-ve    # brings back the real hook and whatever else is missing

Check that the hook is now the real one and not your empty file:

1
2

dpkg -S /usr/share/proxmox-ve/pve-apt-hook   # proxmox-ve: /usr/share/proxmox-ve/pve-apt-hook
head -1 /usr/share/proxmox-ve/pve-apt-hook   # #!/usr/bin/perl

After that, apt full-upgrade and a reboot to confirm the Proxmox kernel comes up.

Fix if you removed Proxmox on purpose

If the box is going back to plain Debian, the snippet is leftover:

1
2
3

rm /etc/apt/apt.conf.d/10pveapthook
# or, cleaner, purge what is left of the package:
dpkg --purge proxmox-ve

apt remove leaves conffiles behind; purge takes them with it.

Traps

• Do not leave the empty hook in place. It exists so apt cannot remove proxmox-ve or the proxmox-kernel-* package by accident. With the empty file that protection is gone.
• Check what left together with proxmox-ve. If apt removed it, it probably took dependencies along; apt install proxmox-ve brings them back, but read the list before accepting.
• If apt install proxmox-ve cannot find the package, the problem is in the repos: no-subscription repositories.
• Reference: Proxmox forum thread.

To manage an HPE Smart Array controller from Proxmox you need ssacli. The guide that ranks first on Google (aljax.us) is out of date and, as written, fails. Three things changed:

1. The HPE repo no longer answers over HTTP (port 80) → use https://.
2. The GPG key in the guide is the old one → today it signs with GPG-KEY2-mcp.
3. The guide warns “HPE removed the repo in Feb 2026” → false, it’s still live.

Jump straight to the corrected procedure if you just want the copy/paste.

Tested on Proxmox VE 8 (Debian bookworm) on a host with an HPE Smart Array P840ar controller, on 2026-09-23.

The problem

ssacli (formerly hpssacli) is HPE’s CLI for Smart Array controllers: it lets you see controllers, physical disks, logical arrays, and their health without going into iLO or rebooting into the ROM. On a Proxmox node it’s the practical way to identify bays and check disks while the box is running.

The community “standard” path is to add HPE’s MCP repo to apt. But if you copy the steps from old guides you hit two errors, one after the other:

1

Connection failed [IP: ... 80]

and, if you fix the first but not the second:

1
2
3

W: GPG error: https://downloads.linux.hpe.com/SDR/repo/mcp bookworm/current Release:
   The following signatures couldn't be verified because the public key is not available:
   NO_PUBKEY E3FE26E774C3A4A2

1. The HTTP endpoint is dead

The MCP repo stopped serving over cleartext HTTP. The guides register deb http://downloads.linux.hpe.com/... and apt update hangs with Connection failed on port 80. The fix is simply to use HTTPS in the sources.list (apt-transport-https already ships in bookworm).

2. The GPG key in the guide is wrong

Guides point to hpePublicKey2048_key1.pub. The repo no longer signs with that key: today it uses GPG-KEY2-mcp.

• File: GPG-KEY2-mcp
• Type: RSA-4096
• Fingerprint: 9E8C 4A25 C494 08EF A8D0 9D96 E3FE 26E7 74C3 A4A2
• Validity: 2024-09-05 → 2034-09-05

Without it, apt update fails with NO_PUBKEY E3FE26E774C3A4A2 (the last 16 hex of the fingerprint).

3. The “repo removed” notice is false (for now)

Several guides warn that HPE took down its public repository in February 2026. As of today (2026-09-23) the MCP repo for bookworm is still live and serves ssacli 6.15-11.0 without issue. Even so, there’s an RPM fallback below in case the prophecy comes true one day.

Corrected procedure (copy/paste)

As root on the Proxmox host:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

# 1. Install the correct GPG key (GPG-KEY2-mcp)
mkdir -p /etc/apt/keyrings
curl -fsSL https://downloads.linux.hpe.com/SDR/repo/mcp/GPG-KEY2-mcp \
  | gpg --dearmor > /etc/apt/keyrings/hpePublicKey2-mcp.gpg
chmod 0644 /etc/apt/keyrings/hpePublicKey2-mcp.gpg

# 2. Register the repo (HTTPS, not HTTP; adjust the codename if not bookworm)
cat > /etc/apt/sources.list.d/hp-mcp.list <<'EOT'
deb [signed-by=/etc/apt/keyrings/hpePublicKey2-mcp.gpg] https://downloads.linux.hpe.com/SDR/repo/mcp bookworm/current non-free
EOT

# 3. Update indexes and install
apt-get update
apt-get install -y ssacli

# 4. Verify
ssacli version
ssacli ctrl all show

On a lab node the verification looked like this:

1
2
3
4
5
6

root@pve-node1:~# ssacli version
   SSACLI Version:  6.15.11.0  2022-11-01
   SOULAPI Version: 6.15.11.0  2022-11-01

root@pve-node1:~# ssacli ctrl all show
Smart Array P840ar in Slot 0 (Embedded)   (sn: <serial>)

Useful ssacli commands

1
2
3
4
5
6
7

ssacli ctrl all show                     # list controllers
ssacli ctrl slot=0 show detail           # controller detail for slot 0
ssacli ctrl slot=0 pd all show status    # physical disk status
ssacli ctrl slot=0 ld all show status    # logical array status
ssacli ctrl slot=0 show config           # full topology (arrays, LDs, PDs)
ssacli ctrl slot=0 modify drivewritecache=enable
ssacli ctrl slot=0 ld 1 modify caching=enable

To identify a physical bay by serial number (handy when someone is at the rack swapping a disk), ssacli ctrl slot=0 pd all show detail gives you serial, bay, and status per disk. In HBA mode, inserting a disk may transiently flag “Degraded (Not authenticated)” and then clear to OK; nothing functional changes.

Fallback if the repo disappears

If downloads.linux.hpe.com/SDR/repo/mcp ever stops responding, download the .rpm from the HPE support portal and extract it by hand (Debian doesn’t use RPM, so we just unpack it):

1
2
3

rpm2cpio ssacli-*.rpm | cpio -idmv
cp -rv ./opt/* /opt
cp -rv ./usr/* /usr

Applies to

The same procedure works on any Proxmox / Debian bookworm node with an HPE Smart Array controller (Gen8 / Gen9 / Gen10). For bullseye or trixie, change the codename in the sources.list.