wingetcreate reports new error I never got before about "Multiple matches found for Neutral Msix installer detected"

[lovettchris]

Brief description of your issue

This command line used to work, because I have a winget published verion 2.9.0.14, but when I run it again on the same msixbundle it now fails

Steps to reproduce

wingetcreate update Microsoft.XMLNotepad --version 2.9.0.14 -o %WINGET_SRC% -u https://github.com/microsoft/XmlNotepad/releases/download/2.9.0.14/XmlNotepadPackage_2.9.0.14_AnyCPU.msixbundle

Expected behavior

no error

Actual behavior

Each new installer URL must have a single match to an existing installer based on architecture, installer type and scope. The following installers failed to match an existing installer:
Multiple matches found for Neutral Msix installer detected from the url: https://github.com/microsoft/XmlNotepad/releases/download/2.9.0.14/XmlNotepadPackage_2.9.0.14_AnyCPU.msixbundle

Environment

Windows Package Manager Manifest Creator v1.10.3.0
Copyright (c) Microsoft Corporation. All rights reserved.

Operating System: Microsoft Windows NT 10.0.26200.0
System Architecture: X64

Winget-Create Directories  Path                                                                                                          
------------------------------------------------------------------------------------------------------------------------------------------
Logs                       %LOCALAPPDATA%\Packages\Microsoft.WindowsPackageManagerManifestCreator_8wekyb3d8bbwe\LocalState\DiagOutputDir 
User settings              %LOCALAPPDATA%\Packages\Microsoft.WindowsPackageManagerManifestCreator_8wekyb3d8bbwe\LocalState\settings.json 
Installer cache            %TEMP%\wingetcreate

[mdanish-kh]

Chris Lovett (@lovettchris) wingetcreate uses the latest manifest on winget-pkgs as the "base" for updating a package. It requires that all of the incoming installers in the command match what exists on the current manifest at winget-pkgs. Looking at the latest 2.9.0.17 manifest as of writing this, it appears that it uses an MSI installer and you're trying to upgrade using an MSIX, which wingetcreate is blocking.

To resolve, either provide the ZIP installer in the upgrade command, or we should update the manifest at winget-pkgs to use MSIXBundle. Even better, one can provide both installers in the winget-pkgs manifest and in the update command for flexibility

[lovettchris]

Please ignore the latest installer, the bug above shows a repro using an "existing published installer" version 2.9.0.14 which previous version of wingetcreate was fine with. When I try and update the 2.9.0.14 version of my winget .xml files with the 2.9.0.14 installer, it fails with this same error. The XML Notepad winget installer has always been based on my .msix installer. Every release has been an msixbundle, for example: https://github.com/microsoft/XmlNotepad/releases/download/2.9.0.8/XmlNotepadPackage_2.9.0.8_AnyCPU.msixbundle

In the latest version 2.9.0.18 I did make one change which is the .package is now signed, could it be that is also a problem - switching from unsigned to signed?

[lovettchris]

I'm still blocked on this, any ideas?

[mdanish-kh]

Chris Lovett (@lovettchris) Since the latest manifest has both ZIP & MSIXBundle installers, the correct command to use is:

wingetcreate update Microsoft.XMLNotepad `
--version 2.9.0.19 `
--urls https://github.com/microsoft/XmlNotepad/releases/download/2.9.0.19/XmlNotepadPackage_2.9.0.19_AnyCPU.msixbundle https://github.com/microsoft/XmlNotepad/releases/download/2.9.0.18/XmlNotepadSetup.zip `
--submit

However, I checked that this command still fails, but for a totally different reason. It appears that for an MSIX package, wingetcreate expects it to be signed. The MSIXBundle appears to be missing the AppxSignature.p7x file that wingetcreate looks for. It's an uncaught exception thrown here

winget-create/src/WingetCreateCore/Common/PackageParser.cs

Line 1158 in e0f96c2

IAppxFile signatureFile = bundle.AppxBundleReader.GetFootprintFile(APPX_BUNDLE_FOOTPRINT_FILE_TYPE.APPX_BUNDLE_FOOTPRINT_FILE_TYPE_SIGNATURE);

Would you consider signing the XMLNotepad package?

[mdanish-kh]

It appears version 2.9.0.18 was indeed signed and contains the AppxSignature.p7x but this was missed in the 2.9.0.19 release