[Package Issue]: AntibodySoftware.WizFile

[dtokarczuk]

Please confirm these before moving forward

• I have searched for my issue and not found a work-in-progress/duplicate/resolved issue.
• I have not been informed if the issue is resolved in a preview version of the winget client.

Category of the issue

Installer hash mismatch.

Brief description of your issue

Winget install reports "Installer hash does not match; to override this check use --ignore-security-hash" when attempting to download AntibodySoftware.WizFile

Steps to reproduce

winget install AntibodySoftware.WizFile --accept-package-agreements --accept-source-agreements

Actual behavior

Winget does not download and install Wizfile
Winget returns:

Found WizFile [AntibodySoftware.WizFile] Version 3.08
This application is licensed to you by its owner.
Microsoft is not responsible for, nor does it grant any licenses to, third-party packages.
Downloading https://antibody-software.com/files/wizfile_3_08_setup.exe
██████████████████████████████ 4.69 MB / 4.69 MB
Installer hash does not match; to override this check use --ignore-security-hash

Expected behavior

winget install should download and install Wizfile

It appears that the Antibody Software executable has been changed on the provider's website to version 3.09, from 3.08. The current winget manifest states the version is 3.08, and if you attempt to manually download via the url in the manifest (https://antibody-software.com/files/wizfile_3_08_setup.exe), it actually points to version 3.09, which presumably has a different hash.

So the Version, InstallerSha256, and InstallerUrl would presumably need to be changed.

Environment

Name          Id                       Version Source
------------------------------------------------------
WizFile v3.09 AntibodySoftware.WizFile 3.09    winget
PS C:\Users\Dan> winget --info
Windows Package Manager v1.4.10173
Copyright (c) Microsoft Corporation. All rights reserved.

Windows: Windows.Desktop v10.0.22621.1702
System Architecture: X64
Package: Microsoft.DesktopAppInstaller v1.19.10173.0

Logs: %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDir

User Settings: %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\settings.json

Links
---------------------------------------------------------------------------
Privacy Statement   https://aka.ms/winget-privacy
License Agreement   https://aka.ms/winget-license
Third Party Notices https://aka.ms/winget-3rdPartyNotice
Homepage            https://aka.ms/winget
Windows Store Terms https://www.microsoft.com/en-us/storedocs/terms-of-sale

Screenshots and Logs

2023-05-21 22:27:19.027 [CORE] WinGet, version [1.4.10173], activity [{347CB5EA-F9D1-4FCA-86EB-6A34836A6DA3}]
2023-05-21 22:27:19.027 [CORE] OS: Windows.Desktop v10.0.22621.1702
2023-05-21 22:27:19.027 [CORE] Command line Args: "C:\Users\Dan\AppData\Local\Microsoft\WindowsApps\winget.exe" install AntibodySoftware.WizFile --accept-package-agreements --accept-source-agreements
2023-05-21 22:27:19.027 [CORE] Package: Microsoft.DesktopAppInstaller v1.19.10173.0
2023-05-21 22:27:19.027 [CORE] IsCOMCall:0; Caller: winget-cli
2023-05-21 22:27:19.032 [CLI ] WinGet invoked with arguments: 'install' 'AntibodySoftware.WizFile' '--accept-package-agreements' '--accept-source-agreements'
2023-05-21 22:27:19.032 [CLI ] Found subcommand: install
2023-05-21 22:27:19.032 [CLI ] Leaf command to execute: root:install
2023-05-21 22:27:19.036 [CLI ] Executing command: install
2023-05-21 22:27:19.044 [REPO] GetCurrentSourceRefs: Source named 'microsoft.builtin.desktop.frameworks' from origin Default is hidden and is dropped.
2023-05-21 22:27:19.044 [REPO] Default source requested, multiple sources available, adding all to source references.
2023-05-21 22:27:19.044 [REPO] Adding to source references msstore
2023-05-21 22:27:19.044 [REPO] Adding to source references winget
2023-05-21 22:27:19.044 [REPO] Multiple sources available, creating aggregated source.
2023-05-21 22:27:19.044 [REPO] Adding to aggregated source: msstore
2023-05-21 22:27:19.044 [REPO] Sending http GET request to: https://storeedgefd.dsx.mp.microsoft.com/v9.0/information
2023-05-21 22:27:19.254 [REPO] Response status: 200
2023-05-21 22:27:19.255 [REPO] Sending http GET request to: https://storeedgefd.dsx.mp.microsoft.com/v9.0/information
2023-05-21 22:27:19.291 [REPO] Response status: 200
2023-05-21 22:27:19.292 [REPO] Adding to aggregated source: winget
2023-05-21 22:27:19.308 [CORE] Examining extension: PFN = Microsoft.Winget.Source_8wekyb3d8bbwe, ID = IndexDB
2023-05-21 22:27:19.308 [CORE] Found matching extension.
2023-05-21 22:27:19.343 [REPO] Opening SQLite Index for ImmutableRead at 'C:\Program Files\WindowsApps\Microsoft.Winget.Source_2023.521.2436.490_neutral__8wekyb3d8bbwe\Public\index.db'
2023-05-21 22:27:19.343 [SQL ] Opening SQLite connection #1: 'C:\Program Files\WindowsApps\Microsoft.Winget.Source_2023.521.2436.490_neutral__8wekyb3d8bbwe\Public\index.db' [1, 40]
2023-05-21 22:27:19.344 [REPO] Opened SQLite Index with version [1.6], last write [2023-05-21 19:35:06.000]
2023-05-21 22:27:19.429 [REPO] Creating PredefinedInstalledSource with filter [None]
2023-05-21 22:27:19.429 [REPO] Creating new SQLite Index [4294967295.4294967295] at ':memory:'
2023-05-21 22:27:19.429 [SQL ] Opening SQLite connection #2: ':memory:' [6, 0]
2023-05-21 22:27:19.481 [REPO] Reading MSI UpgradeCodes
2023-05-21 22:27:19.483 [REPO] Examining ARP entries for Machine | X64
2023-05-21 22:27:19.520 [REPO] Examining ARP entries for Machine | X86
2023-05-21 22:27:19.532 [REPO] Reading MSI UpgradeCodes
2023-05-21 22:27:19.534 [REPO] Examining ARP entries for User | X64
2023-05-21 22:27:20.048 [REPO] Opening SQLite Index for ReadWrite at 'C:\Users\Dan\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\StoreEdgeFD\installed.db'
2023-05-21 22:27:20.048 [SQL ] Opening SQLite connection #3: 'C:\Users\Dan\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\StoreEdgeFD\installed.db' [2, 0]
2023-05-21 22:27:20.050 [REPO] Opened SQLite Index with version [1.6], last write [2023-05-21 20:28:29.000]
2023-05-21 22:27:20.091 [REPO] Sending http POST request to: https://storeedgefd.dsx.mp.microsoft.com/v9.0/manifestSearch
2023-05-21 22:27:20.146 [REPO] Response status: 200
2023-05-21 22:27:20.150 [REPO] Opening SQLite Index for ReadWrite at 'C:\Users\Dan\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\Microsoft.Winget.Source_8wekyb3d8bbwe\installed.db'
2023-05-21 22:27:20.150 [SQL ] Opening SQLite connection #4: 'C:\Users\Dan\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\Microsoft.Winget.Source_8wekyb3d8bbwe\installed.db' [2, 0]
2023-05-21 22:27:20.151 [REPO] Opened SQLite Index with version [1.3], last write [2023-05-21 21:18:47.000]
2023-05-21 22:27:20.202 [CLI ] Found one app. App id: AntibodySoftware.WizFile App name: WizFile
2023-05-21 22:27:20.204 [REPO] Downloading manifest
2023-05-21 22:27:20.204 [CORE] WinINet downloading from url: https://cdn.winget.microsoft.com/cache/manifests/a/AntibodySoftware/WizFile/3.08/0917-AntibodySoftware.WizFile.yaml
2023-05-21 22:27:20.434 [CORE] Download hash: e3980f8d1361f4b30e5f227c7aca227ffa5ae7dca859960c185024ba27b352d2
2023-05-21 22:27:20.434 [CORE] Download completed.
2023-05-21 22:27:20.437 [CLI ] Starting installer selection.
2023-05-21 22:27:20.437 [CLI ] Completed installer selection.
2023-05-21 22:27:20.437 [CLI ] Manifest fields: Name [WizFile], Version [3.08]
2023-05-21 22:27:20.483 [CLI ] Generated temp download path: C:\Users\Dan\AppData\Local\Temp\WinGet\AntibodySoftware.WizFile.3.08\ee2f665909da56ca166a421f464187b3bcb392f1e51fc13904b2e10bb45c237c
2023-05-21 22:27:20.483 [CORE] Downloading to path: C:\Users\Dan\AppData\Local\Temp\WinGet\AntibodySoftware.WizFile.3.08\ee2f665909da56ca166a421f464187b3bcb392f1e51fc13904b2e10bb45c237c
2023-05-21 22:27:20.484 [CORE] DeliveryOptimization downloading from url: https://antibody-software.com/files/wizfile_3_08_setup.exe
2023-05-21 22:27:23.259 [CORE] DeliveryOptimization error: 0x80190003, extended error: 0x00000000
2023-05-21 22:27:23.260 [FAIL] D:\a_work\1\s\external\pkg\src\AppInstallerCommonCore\DODownloader.cpp(289)\WindowsPackageManager.dll!00007FF97D5927BD: (caller: 00007FF97D593090) Exception(1) tid(c0c) 80190003 Unexpected redirection status code (3xx).

2023-05-21 22:27:23.289 [CORE] Started applying motw to C:\Users\Dan\AppData\Local\Temp\WinGet\AntibodySoftware.WizFile.3.08\ee2f665909da56ca166a421f464187b3bcb392f1e51fc13904b2e10bb45c237c with zone: 3
2023-05-21 22:27:23.296 [CORE] Finished applying motw
2023-05-21 22:27:23.296 [CORE] WinINet downloading from url: https://antibody-software.com/files/wizfile_3_08_setup.exe
2023-05-21 22:27:23.922 [CORE] Download hash: 0be4049d9b43d80b91f90b5fd5e0a309a1b02336751f5f704ad58291b4f3a442
2023-05-21 22:27:23.922 [CORE] Download completed.
2023-05-21 22:27:23.922 [CLI ] Package hash verification failed. SHA256 in manifest [ee2f665909da56ca166a421f464187b3bcb392f1e51fc13904b2e10bb45c237c] does not match download [0be4049d9b43d80b91f90b5fd5e0a309a1b02336751f5f704ad58291b4f3a442]
2023-05-21 22:27:23.923 [CLI ] Terminating context: 0x8a150011 at D:\a_work\1\s\external\pkg\src\AppInstallerCLICore\Workflows\DownloadFlow.cpp:15d

[stephengillie]

Thank you @dtokarczuk for the thorough report. A hash mismatch is frequently due to a new version of the application being released, regularly with bug or vulnerability fixes. The fix usually involves having the manifest become updated with the new hash.

[dtokarczuk]

Thanks, understood. The reason I submitted is that the new version has been out there on the antibody web site since Feb 23 and this has been bugging me for a couple months now. I'd be willing to try making the changes but I have no experience with git so I'd need some handholding. I understand the principles having worked with CVS versioning years ago. So from a noob perspective am I on the ballpark with the following steps? - git pull (or clone?) onto my local machine - update version, package url, hash and other necessary fields. - test - is there a way to set up a local test repository on my machine? Or do I somehow test against the local pull that I made the changes to? - git push (or commit?) the changes. Is there a way to push to some kind of shared test repository so that someone else can verify my changes? - test against the shared repository Otherwise I'm happy to let someone else more experienced handle it. Thanks, Dan

…

On Mon, May 22, 2023, 12:04 PM Stephen Gillie ***@***.***> wrote: Thank you @dtokarczuk <https://github.com/dtokarczuk> for the thorough report. A hash mismatch is frequently due to a new version of the application being released, regularly with bug or vulnerability fixes. The fix usually involves having the manifest become updated with the new hash. — Reply to this email directly, view it on GitHub <#107718 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AJOLYONWJFMS6U4VHP74G6DXHOE7FANCNFSM6AAAAAAYJZ4AM4> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[dtokarczuk]

Is this the proper forum for a noob for a continued discussion for help in making the changes?

…

On Mon, May 22, 2023, 12:04 PM Stephen Gillie ***@***.***> wrote: Thank you @dtokarczuk <https://github.com/dtokarczuk> for the thorough report. A hash mismatch is frequently due to a new version of the application being released, regularly with bug or vulnerability fixes. The fix usually involves having the manifest become updated with the new hash. — Reply to this email directly, view it on GitHub <#107718 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AJOLYONWJFMS6U4VHP74G6DXHOE7FANCNFSM6AAAAAAYJZ4AM4> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[BrandonWanHuanSheng]

I might detect it automatically. Also, making change or creating a new update while during on it. Determine 2 months older, that is not touching anyone before the pull request I might spend long time because the release notes change. I might also check anyone to see if anyone making changes pull request as same as me.

[BrandonWanHuanSheng]

I think we already in github.com domain. The document repeat one time on directory without hub.com and repeat first 3 letter words

[BrandonWanHuanSheng]

Can you guess it?

[BrandonWanHuanSheng]

Thanks, understood. The reason I submitted is that the new version has been out there on the antibody web site since Feb 23 and this has been bugging me for a couple months now. I'd be willing to try making the changes but I have no experience with git so I'd need some handholding. I understand the principles having worked with CVS versioning years ago. So from a noob perspective am I on the ballpark with the following steps? - git pull (or clone?) onto my local machine - update version, package url, hash and other necessary fields. - test - is there a way to set up a local test repository on my machine? Or do I somehow test against the local pull that I made the changes to? - git push (or commit?) the changes. Is there a way to push to some kind of shared test repository so that someone else can verify my changes? - test against the shared repository Otherwise I'm happy to let someone else more experienced handle it.

You might need to look at this one. https://github.com/git/git/blob/master/Documentation/

[BrandonWanHuanSheng]

Also try to look at Azure Pipelines also. It might give you some hints.

[mdanish-kh]

@dtokarczuk Contributing to Windows Package Manager - Microsoft Developer (YouTube) is a good resource to get you started contributing to the packages repository