[Bug]: Winget v0.2.0 installer hash does not match

[rsxdalv]

Description

See below

Steps to reproduce

winget install OpenCoworkAI.OpenCoDesign
Found an existing package already installed. Trying to upgrade the installed package...
Found Open CoDesign [OpenCoworkAI.OpenCoDesign] Version 0.2.0
This application is licensed to you by its owner.
Microsoft is not responsible for, nor does it grant any licenses to, third-party packages.
Downloading https://github.com/OpenCoworkAI/open-codesign/releases/download/v0.2.0/open-codesign-0.2.0-x64-setup.exe
  ██████████████████████████████  90.7 MB / 90.7 MB
Installer hash does not match.

Expected behavior

Works

Actual behavior

Broken

open-codesign version

0.2.0

Platform

Windows

OS version

No response

Model provider (if relevant)

None

Error code

No response

Diagnostics bundle

No response

Logs

[github-actions]

Thank you for reporting this, @rsxdalv. The "Installer hash does not match" error in winget typically occurs when the installer binary on GitHub Releases has been updated (for example, rebuilt to fix a packaging issue) but the winget manifest's SHA256 hash in the repository hasn't been refreshed to match the new binary.

What likely happened:

• The v0.2.0 release installer (open-codesign-0.2.0-x64-setup.exe) on GitHub Releases was replaced or rebuilt after the initial winget submission, causing a hash mismatch.
• The winget manifest resides at packaging/winget/manifests/o/OpenCoworkAI/OpenCoDesign/0.2.0/. Until the hash in those YAML files is updated to match the current release binary, winget will reject the upgrade/install.

Workarounds:

1. Download the installer directly from the v0.2.0 release page and run it manually.
2. Wait for the winget manifest to be updated by the maintainers — this is a known packaging sync issue.

If you're comfortable verifying, you can compute the SHA256 of the downloaded .exe and compare it to the hash in the winget manifest to confirm the mismatch source.

Relevant code:

• packaging/winget/manifests/o/OpenCoworkAI/OpenCoDesign/0.2.0/OpenCoworkAI.OpenCoDesign.installer.yaml — contains the expected installer hash.
• The GitHub release asset hash is published alongside the release; any rebuild changes that hash.

Thanks again for flagging this — the team will need to sync the winget manifest with the current release binary. Let me know if you need further assistance!

---

Open-CoDesign Bot

[hqhq1025]

Update — this has been addressed on main. The four commits that fixed the winget hash mismatch and the repack workflow are now shipped:

• f54cc8be chore(release): sync v0.2.0 repack hashes
• d3bbb217 chore(release): refresh v0.2.0 distribution hashes
• 93a6633a fix(release): skip winget for same-version repacks
• e8be5dd6 fix(release): preflight winget token access

The winget manifest's SHA256 should now match the installer published on the v0.2.0 GitHub release. Could you retry winget install OpenCoworkAI.OpenCoDesign and confirm? If it still fails I'll reopen this immediately.

Closing for now — feel free to reopen with the latest output if the hash is still off.

[github-actions]

The winget manifest hash mismatch has been addressed on main as noted. The four commits (f54cc8be, d3bbb217, 93a6633a, e8be5dd6) sync the manifest hash with the published installer. Thank you @rsxdalv for reporting, and thanks to @hqhq1025 for the fix. Please try winget install OpenCoworkAI.OpenCoDesign again and reopen if the issue persists.

Open-CoDesign Bot