When a Proxy Rejects APT's User-Agent
Recognize an explicit client-identity policy denial when curl succeeds but APT is blocked through the same proxy.
Curl retrieves a URL. APT, using the same proxy, receives a page saying its User-Agent is not approved. That response already narrows the investigation: the intermediary is applying a client policy.
Changing repository mirrors, passwords and DNS together discards that useful evidence. Keep the returned status and the relevant denial text before changing the route.
APT documents Acquire::http::User-Agent for the HTTP acquisition method. If the network operator requires an approved identifier, configure the agreed value deliberately. Copying a browser's entire identity string from an old answer can conceal the actual updater and still fail another policy condition.
Check the scope of the failed request. An HTTP repository request and an HTTPS tunnel expose different information to an ordinary non-intercepting proxy. Do not infer that a header policy visible on one path is automatically applied identically inside encrypted traffic.
A denial page returned where repository metadata was expected can also cause a later parsing or signature-looking error. Read the response's origin before changing repository trust. Successful proxy routing does not make an HTML policy page a valid package index. For a Hash Sum mismatch, keep the expected checksum and actual bytes together.