winget-cli: Failure to install 1.4GB appxbundle

Brief description of your issue

When I try to install the latest 1.4GB “WikiMed by Kiwix” package (winget install kiwix.wikimed), the install fails silently on both Windows 10 and Windows 11. Previously, with a smaller 1.3GB bundle, the install works fine. Is there a size limit for appxbundle packages? If I download the archive from the exact same link that is shown by running winget show kiwix.wikimed, I can install the app successfully by launching the downloaded file.

Steps to reproduce

Run winget show kiwix.wikimed to check that version 1.9.2 will be installed. Then run winget install kiwix.wikimed.

Expected behavior

WikiMed should be installed. Winget should output these messages:

Successfully verified installer hash
Starting package install...
  ██████████████████████████████  100%
Successfully installed

Actual behavior

Winget fails silently. It shows:

Found WikiMed by Kiwix [Kiwix.WikiMed] Version 1.9.2.0
This application is licensed to you by its owner.
Microsoft is not responsible for, nor does it grant any licenses to, third-party packages.
PS C:\Users\jaifroid>

Environment

Windows Package Manager (Preview) v1.2.3411-preview
Copyright (c) Microsoft Corporation. All rights reserved.

Windows: Windows.Desktop v10.0.22000.527
Package: Microsoft.DesktopAppInstaller v1.17.3411.0

About this issue

Original URL
State: open
Created 2 years ago
Comments: 35 (13 by maintainers)

Commits related to this issue

[TEST] Remove SignatureSha256 due to https://github.com/microsoft/winget-cli/issues/1987#issuecomment-1212365048 (#93256) — committed to microsoft/winget-pkgs by deleted user a year ago
[TEST] Remove SignatureSha256 due to https://github.com/microsoft/winget-cli/issues/1987#issuecomment-1212365048 (#93255) — committed to microsoft/winget-pkgs by deleted user a year ago

Most upvoted comments

@denelon I’ve pushed a commit removing that field in https://github.com/microsoft/winget-pkgs/pull/68684. Let’s see!

Jaifroid on Aug 11, 2022

I looked into the difference between these two builds and I don’t see anything of consequence. The only files that changed were a mitigation to a crash that should not have affected install. The only difference in configuration is that experimental features are disabled and it is an RC build (does not have -preview). They are built with the same compiler version.

The errors that you are seeing (0x80072efd and 0x80072eff) are WININET_E_CANNOT_CONNECT and WININET_E_CONNECTION_RESET, not hash check related. These are likely still github server connection issues.

I tried both the most recent preview version and v1.3.1681; they both failed. They don’t fail to download the file though, they fail to verify the signature file before downloading. And this is almost certainly because this large MSIX has a very large number of files within it (55K+ articles and probably many images, etc.). The only public API to read the package is meant for local use, and is not so great when there are a lot of files.

I removed the SignatureSha256 from the manifest and was instantly able to get to downloading the file at a reasonable speed. I would suggest this as a mitigation for now.

@denelon, I sent you a cryptic mail about this, but I think there are multiple reasons for us to deprecate SignatureSha256 and move to a different mechanism. We should discuss further.

PS: There is no difference between appx and msix installer types in our code.

JohnMcPMS on Aug 11, 2022

@denelon Given the frequency of problems I’m having with UWP msix/appxbundle validation and installation with winget over the last 6-8 weeks, with all three of my UWP apps, I wonder if it would be useful to have some automated testing of winget builds on this type of bundle (and ideally on very large bundles >1GB)? On top of my validation issues with appxbundles, there now seems to be increasingly poor interaction between winget and GitHub download servers. They hiccup with Delivery Optimization far too frequently (I know that’s not WinGet’s issue, but there could be better fallback to wininet). It also looks like recent releases of winget have introduced really short timeouts for the hash check. It would be better not to have a timeout – just let the user cancel with Ctrl-C if an operation is taking too long.

FYI I’ve never had any issues validating and installing any of my UWP apps (Kiwix.KiwixJS, Kiwix.Wikivoyage, Kiwix.WikiMed) from the Microsoft Store, and until recently, winget was pretty smooth. For the last couple of months the experience has become quite frustrating and time-consuming for what should be a quick and simple validation and installation process. It should be as simple as it is with the app installer (gif video above). Don’t get me wrong, I really like winget and the concept of a Windows Package Manager, and I really want to get this working smoothly again.

Jaifroid on Aug 5, 2022