microsoft / microsoft/winget-pkgs

[Package Issue]: GoTo.LogMeInClient - Installer Hash Mismatch (Vendor MSI now reports 1.3.5702)

Open Beginner friendly
#433,217 1 comment 0 reactions 0 assignees View on GitHub
Error-Hash-Mismatch Needs-Triage Package-Update
Dominant language
No language data
Stars
11.1k
Forks
9.7k
PR merge metrics
PR metrics pending

Description

### Please confirm these before moving forward

- [x] I have searched for my issue and not found a work-in-progress/duplicate/resolved issue.
- [x] I have not been informed if the issue is resolved in a preview version of the winget client.

### Category of the issue

Installer hash mismatch.

### Brief description of your issue

The WinGet package GoTo.LogMeInClient appears to contain a stale manifest/hash.

The current manifest advertises version 1.3.5692, but the installer currently served from the vendor URL appears to be a newer version. WinGet fails with "Installer hash does not match" because the downloaded MSI no longer matches the SHA256 recorded in the manifest.

I manually downloaded the installer from the URL in the manifest and extracted the MSI ProductVersion. The MSI currently served reports version 1.3.5702.

### Steps to reproduce

1. Install LogMeIn Client 1.3.5683.
2. Run:

winget source update

3. Run:

winget upgrade GoTo.LogMeInClient

4. Observe the hash mismatch error.

The same failure occurs with:

winget download GoTo.LogMeInClient --download-directory C:\Temp\WingetTest

### Actual behavior

WinGet reports version 1.3.5692 is available and downloads the installer from:

https://secure.logmein.com/LogMeInClientApp.msi

The download completes successfully, but installation fails with:

Installer hash does not match; this cannot be overridden when running as admin

Additional investigation shows:

Installed version: 1.3.5683
Manifest version: 1.3.5692
MSI currently served by vendor URL: 1.3.5702

This suggests the installer available at the vendor URL no longer matches the hash stored in the package manifest.

### Expected behavior

The package should install successfully.

If the vendor has replaced the installer at the download URL, the WinGet package manifest should be updated to reference the currently served version and corresponding SHA256 hash.

### Environment

```raw
winget --version
v1.29.290
OS Name: Microsoft Windows Server 2025 Standard
OS Version: 10.0.26100 N/A Build 26100
```

### Screenshots and Logs

winget show GoTo.LogMeInClient --verbose

Version: 1.3.5692

Installer Url:
https://secure.logmein.com/LogMeInClientApp.msi

Installer SHA256:
354ab98a10767e73262dd2545115a3f1627d1c8d23ba74b873f32d6eae022202

Found LogMeIn Client [GoTo.LogMeInClient] Version 1.3.5692

Downloading https://secure.logmein.com/LogMeInClientApp.msi

Installer hash does not match; this cannot be overridden when running as admin

MSI ProductVersion extracted from manually downloaded installer:

1.3.5702

Contributor guide

Open the contributing guide

Research direction

Search the manifest repository for GoTo.LogMeInClient and inspect the installer entry using https://secure.logmein.com/LogMeInClientApp.msi. Confirm the downloaded MSI version and SHA256, then run the reported winget download or upgrade command. Done means the manifest matches the currently served 1.3.5702 installer and the package installs without a hash mismatch.

Written by the indexing model from the issue text.

Assessment

Domain
tooling
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
75/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.