microsoft / microsoft/winget-pkgs
[Task]: wingetbot worker — Hash-mismatch class learnings
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 11.1k
- Forks
- 9.7k
- Avg merge
- 1h 32m
- Merged PRs (30d)
- 616
Description
### Description
Per-class learning tracker for the **wingetbot auto-update PR triage worker** (#411124). Use this issue to capture evidence, edge cases, and diagnosis heuristics for the **Hash-mismatch** class before/while building the worker.
**Labels:** `Error-Hash-Mismatch`, `Validation-Hash-Verification-Failed`
### Current disposition (from the 2026-08-01 pilot)
**Diagnose + route — never auto-fix.** The SHA256 in the manifest ≠ the file when the pipeline downloaded it. **Hard guardrail: never download the installer to re-hash** (integrity/security).
### Learnings so far
- Example #410669 (codexu.NoteGen 0.30.0): InstallerUrl is a **version-pinned** GitHub release tag, yet the setup.exe hash changed *again* after wingetbot's own bump → the publisher **re-published** the release asset (a moving target even at a pinned URL).
- No error-detail PR comment exists for this label (label-only); the evidence is the InstallerUrl + the manifest SHA256, not a log line.
- Useful signal: is the InstallerUrl **version-specific** or a moving `latest`-style target? That distinction drives the diagnosis.
### Open questions / learnings to capture
- [ ] How often is it a genuine re-publish (trust the new hash after human review) vs. a `latest`-URL package that should be pinned?
- [ ] Can we detect re-publish vs. CDN flap without downloading (e.g. `Last-Modified` / `ETag` via HEAD)?
- [ ] What is the safe recommend-only message for a moderator (verify current file, then `@wingetbot run`)?
Parent: #411124
_Created with GitHub Copilot assistance._
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with parent #411124 and example #410669, then review the InstallerUrl and manifest SHA256 evidence described here. Use the open questions to define diagnosis heuristics, including version-pinned versus latest-style URLs and possible HEAD metadata signals. Done means documenting safe recommend-only guidance, with no installer download or auto-fix.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100