Share via

Installation of Bootstrapper Package may fail with the error: ‘Setup has detected that the file X has either changed since it was initially published or may be corrupt.’

  • Article

Issue: Installation ofBootstrapper Package (setup package or ClickOnce package along with the pre-requisite(s)) created using the Visual 2010 or Visual Studio 2012 RTM may fail with the error:  ‘Setup has detected that the file X has either changed since it was initially published or may be corrupt.’.

clip_image002

Cause: 

In my case, the issue started appearing on a machine where .NET Framework 4.5 was installed and Setup project was created using Visual Studio 2010.
When you publish any prerequisite bootstrapper the first thing we try to use is the bootstrapper packages certificate. If the package is not signed then we fall back on a hash of the bootstrapper to verify the integrity of the file being downloaded (This is why there is no issue when the bootstrapper package is signed).
In VS 2012 RTM we switched the hash calculation mechanism to SHA256 as its a more secure standard. Unfortunately we only did this during the msbuild package generation step. At runtime when the bootstrapper package was downloaded it would still try to create a SHA1 hash of the package it downloaded and compare it to the SHA256 hash generated during build which would never work.

At runtime when the bootstrapper package was downloaded it will still try to create a SHA1 hash of the package and compare it to the SHA256 hash generated during build which gave the error message “Setup has detected that the publisher of file cannot be verified”.

Resolution: 

As described earlier, it wasn’t an issue with the VS 2010. In fact it is with .NET Framework 4.5/ Visual Studio 2012. This issue has been fixed with VS 2012 Update 2, where the runtime component (setup.bin) is updated to correctly calculate SHA1/SHA256 hashes of the file being downloaded for comparison to the hash generated during build. So if you are using the Visual Studio 2012 RTM then please upgrade it to latest update.  

So why do we get the error with Visual Studio 2010?

Setup project created using the visual studio 2010 on a machine that have .NET Framework 4.5 uses MSBuild task from .NET Framework 4.5 , which in turn creates SHA256 hash for the bootstrapper package.
The runtime bootstrapper component in VS 2010 isn’t able to calculate this SHA256 hash correctly on the downloaded bootstrapper package.

The workaround to fix this issue is to replace the VS2010 Bootstrapper runtime component with the one from VS2012 Update 2 which is capable of handling the SHA256 hash -

To get the VS 2012 Update 2 bootstrapper engine copy the file from the location -

"%ProgramFiles(x86)%"Microsoft SDKs\Windows\v8.1A\Bootstrapper\Engine\setup.bin

(v8.1A - VS2012) and replace the VS 2010 bootstrapper engine at -

"%ProgramFiles(x86)%"\Microsoft SDKs\Windows\v7.0A\Bootstrapper\Engine\setup.bin

(v7.0A - VS2010. You may want to keep a backup copy of this file just in case).

Also ref https://connect.microsoft.com/VisualStudio/feedback/details/758814

Content by: Keshav Deo Jain

Comments

  • Anonymous
    October 12, 2014
    How does one get the setup.bin if one hasn't VS2012. You cannot do without .Net 4.5 can you?

  • Anonymous
    January 28, 2015
    Thank you very much for this post, saved me a lot of time troubleshooting an installer.  One of our 5 build agents had 4.5 installed, and was producing corrupted installers.  Uninstalling 4.5 solved the issue!

  • Anonymous
    September 07, 2015
    I get this error creating a new setup and deployment package in Visual Studio 2015, ticking the "Visual C++ 14 runtime libraries (x86). So I don't think it's fixed. (08/09/2015 13:37:57) Downloading 'vcredist_x86vcredist_x86.exe' from 'go.microsoft.com/fwlink to 'C:UsersGILESAppDataLocalTempVSD5263.tmp' Download completed at 08/09/2015 13:38:00 Verifying file integrity of C:UsersGILESAppDataLocalTempVSD5263.tmpvcredist_x86vcredist_x86.exe WinVerifyTrust returned -2146762749 Subject form unknown Running checks for package 'Visual C++ "14" Runtime Libraries (x86)', phase BeforePackage Running MsiProductCheck with ProductCode '{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}' MsiQueryProductState returned '-1' Setting value '-1 {int}' for property 'VCRedistInstalled' The following properties have been set for package 'Visual C++ "14" Runtime Libraries (x86)': Property: [VCRedistInstalled] = -1 {int} Running checks for command 'vcredist_x86vcredist_x86.exe' Result of running operator 'ValueGreaterThanEqualTo' on property 'VCRedistInstalled' and value '3': false Result of running operator 'ValueEqualTo' on property 'AdminUser' and value 'false': false Skipping FailIf because Property 'Version9X' was not defined Result of running operator 'VersionLessThan' on property 'VersionNT' and value '6.00': false Result of checks for command 'vcredist_x86vcredist_x86.exe' is 'Install' 'Visual C++ "14" Runtime Libraries (x86)' RunCheck result: Install Needed Verifying file integrity of C:UsersGILESAppDataLocalTempVSD5263.tmpvcredist_x86vcredist_x86.exe WinVerifyTrust returned -2146762749 Subject form unknown Error: Setup has detected that the file 'C:UsersGILESAppDataLocalTempVSD5263.tmpvcredist_x86vcredist_x86.exe' has changed since it was initially published.

  • Anonymous
    December 30, 2015
    I Have same error in VS 2013. I Googled alot but found nothing to fix my problem. It throws exception in win7 but not in win8 or win 10.