Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Package Issue]: CologneCodeCompany.XYplorer #211377

Closed
2 tasks done
SSLbits opened this issue Jan 14, 2025 · 8 comments · Fixed by #211382
Closed
2 tasks done

[Package Issue]: CologneCodeCompany.XYplorer #211377

SSLbits opened this issue Jan 14, 2025 · 8 comments · Fixed by #211382
Labels
Error-Hash-Mismatch The InstallerSHA256 Hash specified in the manifest doesn't match with the InstallerURL hash In-PR Package-Update This package needs to be updated

Comments

@SSLbits
Copy link

SSLbits commented Jan 14, 2025

Please confirm these before moving forward

  • I have searched for my issue and not found a work-in-progress/duplicate/resolved issue.
  • I have not been informed if the issue is resolved in a preview version of the winget client.

Category of the issue

Installer hash mismatch.

Brief description of your issue

XYplorer updates do not (ever?) work with winget. I've never had this application update successfully using winget.

Steps to reproduce

winget upgrade CologneCodeCompany.XYplorer

Actual behavior

Installer hash does not match.

Expected behavior

Upgrade successful.

Environment

Windows Package Manager v1.9.25200
Copyright (c) Microsoft Corporation. All rights reserved.

Windows: Windows.Desktop v10.0.26100.2605
System Architecture: X64
Package: Microsoft.DesktopAppInstaller v1.24.25200.0

Winget Directories
-----------------------------------------------------------------------------------------------------------------------
Logs                               %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\Diag…
User Settings                      %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\sett…
Portable Links Directory (User)    %LOCALAPPDATA%\Microsoft\WinGet\Links
Portable Links Directory (Machine) C:\Program Files\WinGet\Links
Portable Package Root (User)       %LOCALAPPDATA%\Microsoft\WinGet\Packages
Portable Package Root              C:\Program Files\WinGet\Packages
Portable Package Root (x86)        C:\Program Files (x86)\WinGet\Packages
Installer Downloads                %USERPROFILE%\Downloads

Links
---------------------------------------------------------------------------
Privacy Statement   https://aka.ms/winget-privacy
License Agreement   https://aka.ms/winget-license
Third Party Notices https://aka.ms/winget-3rdPartyNotice
Homepage            https://aka.ms/winget
Windows Store Terms https://www.microsoft.com/en-us/storedocs/terms-of-sale

Admin Setting                             State
--------------------------------------------------
LocalManifestFiles                        Disabled
BypassCertificatePinningForMicrosoftStore Disabled
InstallerHashOverride                     Disabled
LocalArchiveMalwareScanOverride           Disabled
ProxyCommandLineOptions                   Disabled
DefaultProxy                              Disabled

Screenshots and Logs

Image
@SSLbits SSLbits added the Issue-Bug It either shouldn't be doing this or needs an investigation. label Jan 14, 2025
@similar-issues-ai Similar Issues AI
Copy link

We've found some similar issues:

If any of the above are duplicates, please consider closing this issue out and adding additional context in the original issue.

Note: You can give me feedback by 👍 or 👎 this comment.

@microsoft-github-policy-service microsoft-github-policy-service bot added Needs-Triage This work item needs to be triaged by a member of the core team. Package-Update This package needs to be updated Error-Hash-Mismatch The InstallerSHA256 Hash specified in the manifest doesn't match with the InstallerURL hash and removed Issue-Bug It either shouldn't be doing this or needs an investigation. labels Jan 14, 2025
@SSLbits SSLbits changed the title [Package Issue]: Package.Identifier [Package Issue]: CologneCodeCompany.XYplorer Jan 14, 2025
@Dragon1573
Copy link
Contributor

✅ Issue verified.

14:57:03 D:\...\winget-pkgs  [master ≡] 5ms pwsh$ winget download --skip-dependencies -s winget CologneCodeCompany.XYplorer -v 26.70.0600
已找到 XYplorer [CologneCodeCompany.XYplorer] 版本 26.70.0600
此应用程序由其所有者授权给你。
Microsoft 对第三方程序包概不负责，也不向第三方程序包授予任何许可证。
已跳过依赖项。
正在下载 https://www.xyplorer.com/download/XYplorer_26.70_Install.exe
  ██████████████████████████████  6.33 MB / 6.33 MB
安装程序哈希不匹配；若要重写此检查，请使用 --ignore-security-hash

14:58:14 D:\...\winget-pkgs  [master ≡] 1ms pwsh$ winget download --ignore-security-hash --skip-dependencies -s winget CologneCodeCompany.XYplorer -v 26.70.0600
已找到 XYplorer [CologneCodeCompany.XYplorer] 版本 26.70.0600
此应用程序由其所有者授权给你。
Microsoft 对第三方程序包概不负责，也不向第三方程序包授予任何许可证。
已跳过依赖项。
正在下载 https://www.xyplorer.com/download/XYplorer_26.70_Install.exe
  ██████████████████████████████  6.33 MB / 6.33 MB
安装程序哈希不匹配；由于 --ignore-security-hash 而继续进行
已下载安装程序: D:\Dragon1573\Downloads\CologneCodeCompany.XYplorer_26.70.0600\XYplorer_26.70.0600_Machine_X64_nullsoft_en-US.exe

14:58:36 D:\...\winget-pkgs  [master ≡] 6.364s pwsh$ winget hash D:\Dragon1573\Downloads\CologneCodeCompany.XYplorer_26.70.0600\XYplorer_26.70.0600_Machine_X64_nullsoft_en-US.exe
InstallerSha256: 0b5d07ce93e1b2d5bd59d1ed4394b6003fe71480066e70837d2227ac49b328c4

@Dragon1573
Copy link
Contributor

Image
Image

Important

Currently, this package is released with a vanity URL which always points to the latest patch version of an exact minor version series (keep pointing to the latest x.y.z build for the x.y series). This issue will keep exists when a new patch version is released.

@Dragon1573 Dragon1573 mentioned this issue Jan 14, 2025
Merged
7 tasks
@microsoft-github-policy-service microsoft-github-policy-service bot added In-PR and removed Needs-Triage This work item needs to be triaged by a member of the core team. labels Jan 14, 2025
@SSLbits
Copy link
Author

SSLbits commented Jan 14, 2025

Here's the URL in the existing manifest: https://www.xyplorer.com/download/XYplorer_26.70_Install.exe
and here's the URL for the latest full release: https://www.xyplorer.com/download/XYplorer_26.70.0600_Install.exe
which also matches the SHA-256 checksum in the manifest.

According to the vendor, the versioned package links are available in the forum: https://www.xyplorer.com/xyfc/viewtopic.php?p=190279&hilit=download+url#p190279

I just think that the winget package manifests should use these xx.xx.xxxx versioned package links rather than the vanity xx.xx URLs.

@Dragon1573
Copy link
Contributor

Dragon1573 commented Jan 14, 2025 •
edited
Loading

Version v26.70.0600 you provided is valid. ❤

But version v26.70.0602 goes to an HTTP 404 Not Found page.

Edit: The last valid x.y.z format URL is v26.70.0600, there's no version-static URL for 0601 and 0602.

@SSLbits
Copy link
Author

SSLbits commented Jan 14, 2025

I'm not sure if 26.70.0602 is officially released yet?

Image

The application is showing that 26.70.0600 is the latest available version.

@Dragon1573
Copy link
Contributor

The only available release format on Download Center are ZIP and RAR archives.

I can't sure how previous contributors find this EXE install wizard. 😕

The above EXE URL with x.y format will download version 26.70.0602, hence there's an Error-Hash-Mismatch The InstallerSHA256 Hash specified in the manifest doesn't match with the InstallerURL hash error occur.

@SSLbits
Copy link
Author

SSLbits commented Jan 14, 2025 •
edited
Loading

Image
According to the vendor, 26.70.0602 is not an official release.
https://www.xyplorer.com/download/History.txt

The PackageVersion should be 26.70.0600. InstallerSha256 should be C3AA9C002F377CC7DCA9B345A3347E73F65AEAC3BC39FBDFAE5B4B23B5AFAF1A.
InstallerUrl should be https://www.xyplorer.com/download/XYplorer_26.70.0600_Install.exe

Moving forward, the InstallerUrl in the manifests for XYplorer should be in the XX.YY.ZZZZ format: https://www.xyplorer.com/download/XYplorer_XX.YY.ZZZZ_Install.exe

This should ensure proper updates to official releases and resolve the hash mismatch error.

SSLbits referenced this issue Jan 14, 2025
@Dragon1573
Bump version: CologneCodeCompany.XYplorer from 26.70.0600 to 26.70.06…
a3d05dd 
…02 (#211382)

Signed-off-by: Dragon1573 <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Error-Hash-Mismatch The InstallerSHA256 Hash specified in the manifest doesn't match with the InstallerURL hash In-PR Package-Update This package needs to be updated
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Bump version: CologneCodeCompany.XYplorer from 26.70.0600 to 26.70.0602 Dragon1573/winget-pkgs
2 participants
@SSLbits @Dragon1573