Skip to content

New version: timvw.wt 0.1.31 - #410145

Closed
Tim Van Wassenhove (timvw) wants to merge 40 commits into
microsoft:masterfrom
timvw:wt-0.1.31
Closed

New version: timvw.wt 0.1.31#410145
Tim Van Wassenhove (timvw) wants to merge 40 commits into
microsoft:masterfrom
timvw:wt-0.1.31

Conversation

@timvw

@timvw Tim Van Wassenhove (timvw) commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

📖 Description

✅ Checklist

📦 Manifest Checklist

  • Checked that there aren't other open pull requests for the same manifest update/change
  • This PR only modifies one (1) manifest
  • Validated manifest locally with winget validate --manifest <path> (validation guide)
  • Tested manifest locally with winget install --manifest <path>
  • Manifest conforms to the 1.12 schema

Note: <path> is the directory containing the manifest you're submitting.

Automated with GoReleaser
Microsoft Reviewers: Open in CodeFlow

@goreleaserbot
New version: timvw.wt 0.1.21: add version
131f549
@goreleaserbot
New version: timvw.wt 0.1.21: add installer
96960a7
@goreleaserbot
New version: timvw.wt 0.1.21: add locale
ec4a3a9
@timvw
Merge branch 'microsoft:master' into master
e1e16fc
@goreleaserbot
New version: timvw.wt 0.1.22: add version
e470fa1
@goreleaserbot
New version: timvw.wt 0.1.22: add installer
53a23b2
@goreleaserbot
New version: timvw.wt 0.1.22: add locale
274d915
@timvw
fix: remove duplicate 0.1.21 manifests, keep only 0.1.22
ae667dc
@timvw
Merge branch 'microsoft:master' into master
ca9fe89
@goreleaserbot
New version: timvw.wt 0.1.23: add version
aa69d2d
@goreleaserbot
New version: timvw.wt 0.1.23: add installer
5c060ba
@goreleaserbot
New version: timvw.wt 0.1.23: add locale
1085afc
@timvw
Merge branch 'microsoft:master' into master
107a6a5
@goreleaserbot
New version: timvw.wt 0.1.24: add version
1be8a76
@goreleaserbot
New version: timvw.wt 0.1.24: add installer
8c65a74
@goreleaserbot
New version: timvw.wt 0.1.24: add locale
640d716
@timvw
fix: keep only wt 0.1.24 winget manifest
c548a38
@timvw
Merge branch 'microsoft:master' into master
ebf97a5
@goreleaserbot
New version: timvw.wt 0.1.25: add version
7924a64
@goreleaserbot
New version: timvw.wt 0.1.25: add installer
9a00937
@goreleaserbot
New version: timvw.wt 0.1.25: add locale
238da53
@timvw
Merge branch 'microsoft:master' into master
7a98af4
@goreleaserbot
New version: timvw.wt 0.1.26: add version
03a92aa
@goreleaserbot
New version: timvw.wt 0.1.26: add installer
323982b
@goreleaserbot
New version: timvw.wt 0.1.26: add locale
d15f254
@timvw
Merge branch 'microsoft:master' into master
cd1b853
@goreleaserbot
New version: timvw.wt 0.1.27: add version
62d7e0e
@goreleaserbot
New version: timvw.wt 0.1.27: add installer
229e051
@goreleaserbot
New version: timvw.wt 0.1.27: add locale
9bb37d5
@timvw
Merge branch 'microsoft:master' into master
a268963
@wingetbot

wingetbot (wingetbot) commented Jul 30, 2026

Copy link
Copy Markdown
Collaborator

Validation Pipeline Run WinGetSvc-Validation-148-410145-20260730-1

@wingetbot wingetbot (wingetbot) added New-Manifest Error-Hash-Mismatch The InstallerSHA256 Hash specified in the manifest doesn't match with the InstallerURL hash labels Jul 30, 2026
@microsoft-github-policy-service microsoft-github-policy-service Bot added Needs-Author-Feedback This needs a response from the author. Validation-Guide Something happened during validation. Provide the guide. labels Jul 30, 2026
@stephengillie

Stephen Gillie (stephengillie) commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

Automatic Validation ended with:

Installer Verification Analysis Context Information:
Specified hash doesn't match. Actual hash: 'E26E53D675395CAF80417F1F7A7647CAC4808A1C0E7EE29C833A4BD3CB1E8369' Expected hash: 'ebc56b3224fd8b627995ec1d3a33d5da6507242690d8050c78f69c888f22fbfa'

7/30/2026 10:58:50 PM

(Deterministic automation - build 1802.)

@microsoft-github-policy-service microsoft-github-policy-service Bot removed Error-Hash-Mismatch The InstallerSHA256 Hash specified in the manifest doesn't match with the InstallerURL hash Needs-Author-Feedback This needs a response from the author. New-Manifest labels Aug 11, 2026
Tim Van Wassenhove (timvw) added a commit to timvw/wt that referenced this pull request Aug 11, 2026
@timvw
fix(release): make archives reproducible so winget hashes match (#121)
c4e7e43 
The release workflow runs GoReleaser twice (core with --skip=winget, then
best-effort winget-only), both with --clean. The second run rebuilds from
scratch, and since archive members carried build/checkout mtimes the rebuilt
archives hashed differently than the ones the first run had already uploaded
to the GitHub release. The winget manifest is generated by the second run, so
it shipped a hash no published asset matched -- microsoft/winget-pkgs#410145
was rejected with Error-Hash-Mismatch for 0.1.31.

Pin the binary timestamp (mod_timestamp), add -trimpath, and pin the mtime of
every archive member including the default LICENSE/README globs.

Verified: two consecutive `goreleaser release --snapshot --clean` runs now
produce byte-identical archives for all five targets; before this change the
same two runs produced different hashes.

Also migrates format/format_overrides.format to the plural `formats` form
(singular deprecated since v2.6).
@timvw

Tim Van Wassenhove (timvw) commented Aug 11, 2026

Copy link
Copy Markdown
Contributor Author

Fixed in 38a7c9e — InstallerSha256 for 0.1.31 now matches the published wt_0.1.31_windows_amd64.zip (E26E53D675395CAF80417F1F7A7647CAC4808A1C0E7EE29C833A4BD3CB1E8369), which is the hash the validation run reported as actual.

Root cause was on our side: our release pipeline ran GoReleaser twice, and the second (winget-only) run rebuilt the archives from scratch. The rebuilt zip differed byte-wise from the one already uploaded to the GitHub release, so the generated manifest carried a hash no published asset matched. We've since made our archives reproducible (timvw/wt#121), so future manifests can't drift from the published assets.

Ready for revalidation — thanks for the review.

@wingetvalidator-prod wingetvalidator-prod Bot added Azure-Pipeline-Passed Validation pipeline passed. There may still be manual validation requirements. Validation-Completed Validation passed labels Aug 11, 2026
@microsoft-github-policy-service
microsoft-github-policy-service Bot enabled auto-merge (squash) August 11, 2026 07:12
@microsoft-github-policy-service microsoft-github-policy-service Bot removed the Validation-Guide Something happened during validation. Provide the guide. label Aug 11, 2026
@timvw

Tim Van Wassenhove (timvw) commented Aug 11, 2026

Copy link
Copy Markdown
Contributor Author

Closing in favour of #415345, which adds 0.1.33 and supersedes this one. The hash issue here was fixed, but 0.1.31 is no longer the version we want published — 0.1.33 is current, and its manifest is generated by a release pipeline that can no longer produce a mismatched hash.

Apologies for the churn, and thanks for the validation feedback.

auto-merge was automatically disabled August 11, 2026 07:31

Pull request was closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Azure-Pipeline-Passed Validation pipeline passed. There may still be manual validation requirements. Validation-Completed Validation passed

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@timvw @wingetbot @stephengillie @goreleaserbot