Repository navigation
Broken installer hash with winget when installing 3.67.1 #11030
Description
Bug Report
Description
Attempting to use winget to install the latest version of dvc fails
Reproduce
Attempt to install dvc via winget:
C:\Users\bhargrea>winget install --id Iterative.DVC --silent --accept-source-agreements
Found Data Version Control [Iterative.DVC] Version 3.67.1
This application is licensed to you by its owner.
Microsoft is not responsible for, nor does it grant any licenses to, third-party packages.
Downloading https://dvc.org/download/win/dvc-3.67.1
██████████████████████████████ 80.9 MB / 80.9 MB
Installer hash does not match; this cannot be overridden when running as admin
PS C:\Users\bhargrea> echo $?
False
Expected
Installing 3.67.0 is fine:
C:\Users\bhargrea>winget install --id Iterative.DVC --silent --accept-source-agreements --version 3.67.0
Found Data Version Control [Iterative.DVC] Version 3.67.0
This application is licensed to you by its owner.
Microsoft is not responsible for, nor does it grant any licenses to, third-party packages.
Downloading https://dvc.org/download/win/dvc-3.67.0
██████████████████████████████ 80.5 MB / 80.5 MB
Successfully verified installer hash
Starting package install...
Environment information
OS Name: Microsoft Windows 11 Enterprise
OS Version: 10.0.26200 N/A Build 26200
Activity
skshetry commentedon Apr 21, 2026
Thanks, this is due to a bug in CI. The binary was rebuilt and published (which runs in a cron job).
Usually, winget automatically detects these kinds of cases, and automatically fixes it. One example:
I'll fix the CI, but this may get resolved automatically soon.
rehan243 commentedon May 22, 2026
oh interesting, are you on winget v1.x or the newer v1.7+? We hit this exact hash mismatch a couple times, usually when the DVC installer gets updated but the manifest in winget’s repo hasn’t caught up yet. The thing is, winget validates against its manifest hash, not the remote file hash — so if iterative pushed a new build (even just a minor repack), the winget repo needs to update the hash or it’ll block the install. We saw this once after a hotfix where the file on dvc.org changed, but the manifest stayed old for ~24h.
Not gonna lie, winget's caching can mess you up too — sometimes it’ll use a stale manifest if you haven’t forced a sync. You can try
winget source updateand then re-run the install, but if the repo hasn’t updated, you’re still stuck. Installing 3.67.0 works because its manifest hash matches the file on their server — we had to roll back once in prod for the same reason.Curious: are you blocked on this for CI builds, or just local dev?