microsoft / microsoft/winget-pkgs
[Package Issue]: GoTo.LogMeInClient - Installer Hash Mismatch (Vendor MSI now reports 1.3.5702)
- Dominant language
- No language data
- Stars
- 11.1k
- Forks
- 9.7k
- PR merge metrics
- PR metrics pending
Description
### Please confirm these before moving forward
- [x] I have searched for my issue and not found a work-in-progress/duplicate/resolved issue.
- [x] I have not been informed if the issue is resolved in a preview version of the winget client.
### Category of the issue
Installer hash mismatch.
### Brief description of your issue
The WinGet package GoTo.LogMeInClient appears to contain a stale manifest/hash.
The current manifest advertises version 1.3.5692, but the installer currently served from the vendor URL appears to be a newer version. WinGet fails with "Installer hash does not match" because the downloaded MSI no longer matches the SHA256 recorded in the manifest.
I manually downloaded the installer from the URL in the manifest and extracted the MSI ProductVersion. The MSI currently served reports version 1.3.5702.
### Steps to reproduce
1. Install LogMeIn Client 1.3.5683.
2. Run:
winget source update
3. Run:
winget upgrade GoTo.LogMeInClient
4. Observe the hash mismatch error.
The same failure occurs with:
winget download GoTo.LogMeInClient --download-directory C:\Temp\WingetTest
### Actual behavior
WinGet reports version 1.3.5692 is available and downloads the installer from:
https://secure.logmein.com/LogMeInClientApp.msi
The download completes successfully, but installation fails with:
Installer hash does not match; this cannot be overridden when running as admin
Additional investigation shows:
Installed version: 1.3.5683
Manifest version: 1.3.5692
MSI currently served by vendor URL: 1.3.5702
This suggests the installer available at the vendor URL no longer matches the hash stored in the package manifest.
### Expected behavior
The package should install successfully.
If the vendor has replaced the installer at the download URL, the WinGet package manifest should be updated to reference the currently served version and corresponding SHA256 hash.
### Environment
```raw
winget --version
v1.29.290
OS Name: Microsoft Windows Server 2025 Standard
OS Version: 10.0.26100 N/A Build 26100
```
### Screenshots and Logs
winget show GoTo.LogMeInClient --verbose
Version: 1.3.5692
Installer Url:
https://secure.logmein.com/LogMeInClientApp.msi
Installer SHA256:
354ab98a10767e73262dd2545115a3f1627d1c8d23ba74b873f32d6eae022202
Found LogMeIn Client [GoTo.LogMeInClient] Version 1.3.5692
Downloading https://secure.logmein.com/LogMeInClientApp.msi
Installer hash does not match; this cannot be overridden when running as admin
MSI ProductVersion extracted from manually downloaded installer:
1.3.5702
Contributor guide
Research direction
Search the manifest repository for GoTo.LogMeInClient and inspect the installer entry using https://secure.logmein.com/LogMeInClientApp.msi. Confirm the downloaded MSI version and SHA256, then run the reported winget download or upgrade command. Done means the manifest matches the currently served 1.3.5702 installer and the package installs without a hash mismatch.
Written by the indexing model from the issue text.
Assessment
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 75/100