.NET 4.8 redistributable downloads have changed its hash and file size.

[ngbrown]

• Which version of WiX are you building with?

3.12.2

• Which version of Visual Studio are you building with (if any)?

Visual Studio 2015

• Which version of the WiX Toolset Visual Studio Extension are you building with (if any)?

N/A

• Which version of .NET are you building with?

.NET Framework 4.8

• If the problem occurs when installing your packages built with WiX, what is the version of Windows the package is running on?

Both Windows 7 SP1 and Windows 10 (unknown build)

• Describe the problem and the steps to reproduce it.

Bootstrapping the .NET framework with NetFx48Redist no longer works. The download is attempted multiple times, and finally fails:

[0480:0950][2021-04-27T17:20:54]e314: Failed to cache payload: NetFx48Redist from working path: C:\Users\win7\AppData\Local\Temp\{37B0BDAE-62CD-406D-AA98-3DDF84901EDE}\NetFx48Redist, error: 0x80070490.
[0480:0950][2021-04-27T17:20:54]e349: Application requested retry of payload: NetFx48Redist, encountered error: 0x80070490. Retrying...
[0480:0950][2021-04-27T17:20:54]w343: Prompt for source of package: NetFx48Redist, payload: NetFx48Redist, path: C:\Users\win7\Desktop\redist\ndp48-x86-x64-allos-enu.exe
[0480:0950][2021-04-27T17:20:57]i338: Acquiring package: NetFx48Redist, payload: NetFx48Redist, download from: https://go.microsoft.com/fwlink/?LinkId=2088631
[0BE4:09F8][2021-04-27T17:23:31]e000: Error 0x80070490: Failed to find expected public key in certificate chain.
[0BE4:09F8][2021-04-27T17:23:31]e000: Error 0x80070490: Failed to verify expected payload against actual certificate chain.
[0BE4:09F8][2021-04-27T17:23:31]e000: Error 0x80070490: Failed to verify signature of payload: NetFx48Redist
[0BE4:09F8][2021-04-27T17:23:31]e310: Failed to verify payload: NetFx48Redist at path: C:\ProgramData\Package Cache\.unverified\NetFx48Redist, error: 0x80070490. Deleting file.
[0BE4:09F8][2021-04-27T17:23:31]e000: Error 0x80070490: Failed to cache payload: NetFx48Redist
[0480:0950][2021-04-27T17:23:31]e314: Failed to cache payload: NetFx48Redist from working path: C:\Users\win7\AppData\Local\Temp\{37B0BDAE-62CD-406D-AA98-3DDF84901EDE}\NetFx48Redist, error: 0x80070490.
[0480:0A04][2021-04-27T17:23:31]e000: Error 0x80070490: Failed while caching, aborting execution.
[0BE4:0BF0][2021-04-27T17:23:31]i372: Session end, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{38c3d820-b454-43c2-a726-62c3b8e43c4a}, resume: None, restart: None, disable resume: No

At some point between 2020-04-20 and 2020-04-27, the file size, version number, and obviously SHA-1 of the file downloaded from https://go.microsoft.com/fwlink/?LinkId=2088631 has changed.

https://github.com/wixtoolset/wix3/blob/2ed6d7906c87bb65b75cfa0020e38a1b1dffa49b/src/ext/NetFxExtension/wixlib/NetFx48.wxs#L16

https://github.com/wixtoolset/wix3/blob/2ed6d7906c87bb65b75cfa0020e38a1b1dffa49b/src/ext/NetFxExtension/wixlib/NetFx48.wxs#L89-L96

The new SHA-1 value is 584FFD3BBB7F73CD149E4486F6465C838D847450, with a file size of 121319368 bytes, and version of 4.8.4115.0. The digital signature is now only sha256 and shows as OK.

The smaller NetFx48Web download from https://go.microsoft.com/fwlink/?LinkId=2085155 has also changed to a SHA-1 of 3727DC47F12D9EA5EBA87145228DFF0CE8076E25 and 1443272 bytes

• Describe the behavior you expected and how it differed from the actual behavior.

I realize this is an interaction with Microsoft controlled web endpoint. I would expect that the downloaded file be stable from these redistribution download URLs. How can WiX better handle this? Since the download is signed, can the digital signature be checked instead?

I'm also not sure how to update the <RemotePayload/> block because the certificate key and thumbprint might have changed too and I don't know where those values come from.

[rseanhall]

This is a duplicate of #6438. You can run heat.exe payload ndp.exe -o net48.wxs to get updated values.

[robmen]

I'm not sure we should rush this. There is a reasonable chance Microsoft is going to learn how disruptive it is to change the binaries this radically without changing the URL.

[ngbrown]

The Microsoft reply didn't indicate they were going to switch back.

Jamshed Damkewala (Microsoft employee) on April 28, 2021 12:14 pm wrote:

[@jozefizso], I’m sorry you’re experiencing the break due to our rebuild of the installers, unfortunately there was no way to avoid the rebuild. The FAQ linked from the post touches upon this scenario and documents the new public key for our installers. Your bootstrapper XML needs to be updated to replace the old public key with this one. I understand its a simple change, yet its impactful when something that was working breaks and needs to be updated.

The quickest workaround in the immediate term is updating your bootstrapper yourself, in the near future we will also ship an updated ClickOnce bootstrapper in a VS update which will allow developers to use VS to simply rebuild their ClickOnce bootstrapper or Visual Studio Installer Project (which also internally uses the CO bootstrapper) to update their .NET Framework redistributable reference to the updated installers.

[jozefizso]

I have the same opinion - it is great we have new installers available singed with strong digital signatures, but old link should serve old installers and these new installers deserve new URLs.

[jozefizso]

I use ClickOnce or a Visual Studio Installer Project to deploy .NET Framework 4.6.2 or later as a pre-requisite for my app, what should I do?

The installers for .NET Framework 4.6.2 and above have been rebuilt, so if you use a bootstrapper to deploy the .NET Framework 4.6.2 or later as a pre-requisite with your app you will need to update PublicKey attribute in Product.xml and Package.xml files in order for the ClickOnce bootstrapper to properly detect the updated .NET installer packages.

If you use another bootstrapper like the WiX Bootstrapper (Burn) you refer to Burn documentation for installing .NET Framework pre-requisites for more information.

Source: https://support.microsoft.com/sk-sk/topic/-net-framework-4-5-2-4-6-4-6-1-end-of-support-faq-72b7d8ca-3057-4f0c-8404-67305d40cc04

[BMurri]

The new .NET 4.8 installer also failed to install into a fresh Windows 10 LTSC 2019 (v1809) VM. It first failed with the VM never having connected to the internet. I connected to the internet, and it still had the same 'unable to check revocation' error. I ran Windows Update for two rounds of updates, and now on a fully patched Windows 10 LTSC 2019 install, the new .NET 4.8 installer works. The old .NET 4.8 installer (with the SHA-1 certificate) worked in all of these scenarios.

The new certificates (the entire reason for rebundling the package, according to the blog post) aren't trusted by un-updated Windows OSs, because they were built before the changeover to the more secure certificates. At minimum, the new root certificate updates must be installed.

[BendicoE]

I just got .NET Framework 4.8 installation to work in latest production release of WiX, 3.11.2. First, I downloaded

https://go.microsoft.com/fwlink/?LinkId=2085155 (web installer, ndp48-web.exe)
https://go.microsoft.com/fwlink/?linkid=2088631 (full installer, ndp48-x86-x64-allos-enu.exe)

Then I ran heat.exe on those two as suggested by @rseanhall to find all the certificate info. I ended up with the following NetFx.wxs:

`

<?define NetFx48MinRelease = 528040 ?>
<?define NetFx48WebLink = https://go.microsoft.com/fwlink/?LinkId=2085155 ?>
<?define NetFx48RedistLink = https://go.microsoft.com/fwlink/?linkid=2088631 ?>
<?define NetFx48EulaLink = https://referencesource.microsoft.com/license.html ?>

<Fragment>
	<PropertyRef Id="WIXNETFX4RELEASEINSTALLED" />
	<Property Id="WIX_IS_NETFRAMEWORK_48_OR_LATER_INSTALLED" Secure="yes" />
	<SetProperty Id="WIX_IS_NETFRAMEWORK_48_OR_LATER_INSTALLED" Value="1" After="AppSearch">
		WIXNETFX4RELEASEINSTALLED >= "#$(var.NetFx48MinRelease)"
	</SetProperty>
</Fragment>

<Fragment>
	<util:RegistrySearchRef Id="NETFRAMEWORK45"/>

	<WixVariable Id="WixMbaPrereqPackageId" Value="NetFx48Web" />
	<WixVariable Id="WixMbaPrereqLicenseUrl" Value="$(var.NetFx48EulaLink)" Overridable="yes" />
	<WixVariable Id="NetFx48WebDetectCondition" Value="NETFRAMEWORK45 &gt;= $(var.NetFx48MinRelease)" Overridable="yes" />
	<WixVariable Id="NetFx48WebInstallCondition" Value="" Overridable="yes" />
	<WixVariable Id="NetFx48WebPackageDirectory" Value="redist\" Overridable="yes" />

	<PackageGroup Id="NetFx48Web">
		<ExePackage
			InstallCommand="/q /norestart /ChainingPackage &quot;[WixBundleName]&quot; /log &quot;[NetFx48FullLog].html&quot;"
			RepairCommand="/q /norestart /repair /ChainingPackage &quot;[WixBundleName]&quot; /log &quot;[NetFx48FullLog].html&quot;"
			UninstallCommand="/uninstall /q /norestart /ChainingPackage &quot;[WixBundleName]&quot; /log &quot;[NetFx48FullLog].html&quot;"
			PerMachine="yes"
			DetectCondition="!(wix.NetFx48WebDetectCondition)"
			InstallCondition="!(wix.NetFx48WebInstallCondition)"
			Id="NetFx48Web"
			Vital="yes"
			Permanent="yes"
			Protocol="netfx4"
			DownloadUrl="$(var.NetFx48WebLink)"
			LogPathVariable="NetFx48FullLog"
			Compressed="no"
			Name="!(wix.NetFx48WebPackageDirectory)ndp48-web.exe">
			<RemotePayload
				CertificatePublicKey="F49F9B33E25E33CCA0BFB15A62B7C29FFAB3880B"
				CertificateThumbprint="ABDCA79AF9DD48A0EA702AD45260B3C03093FB4B"
				Description="Microsoft .NET Framework 4.8 Setup"
				Hash="4181398AA1FD5190155AC3A388434E5F7EA0B667"
				ProductName="Microsoft .NET Framework 4.8"
				Size="1439328"
				Version="4.8.4115.0" />
		</ExePackage>
	</PackageGroup>
</Fragment>

<Fragment>
	<util:RegistrySearchRef Id="NETFRAMEWORK45"/>

	<WixVariable Id="WixMbaPrereqPackageId" Value="NetFx48Redist" />
	<WixVariable Id="WixMbaPrereqLicenseUrl" Value="$(var.NetFx48EulaLink)" Overridable="yes" />
	<WixVariable Id="NetFx48RedistDetectCondition" Value="NETFRAMEWORK45 &gt;= $(var.NetFx48MinRelease)" Overridable="yes" />
	<WixVariable Id="NetFx48RedistInstallCondition" Value="" Overridable="yes" />
	<WixVariable Id="NetFx48RedistPackageDirectory" Value="redist\" Overridable="yes" />

	<PackageGroup Id="NetFx48Redist">
		<ExePackage
			InstallCommand="/q /norestart /ChainingPackage &quot;[WixBundleName]&quot; /log &quot;[NetFx48FullLog].html&quot;"
			RepairCommand="/q /norestart /repair /ChainingPackage &quot;[WixBundleName]&quot; /log &quot;[NetFx48FullLog].html&quot;"
			UninstallCommand="/uninstall /q /norestart /ChainingPackage &quot;[WixBundleName]&quot; /log &quot;[NetFx48FullLog].html&quot;"
			PerMachine="yes"
			DetectCondition="!(wix.NetFx48RedistDetectCondition)"
			InstallCondition="!(wix.NetFx48RedistInstallCondition)"
			Id="NetFx48Redist"
			Vital="yes"
			Permanent="yes"
			Protocol="netfx4"
			DownloadUrl="$(var.NetFx48RedistLink)"
			LogPathVariable="NetFx48FullLog"
			Compressed="no"
			Name="!(wix.NetFx48RedistPackageDirectory)ndp48-x86-x64-allos-enu.exe">
			<RemotePayload
			   CertificatePublicKey="F49F9B33E25E33CCA0BFB15A62B7C29FFAB3880B"
			   CertificateThumbprint="ABDCA79AF9DD48A0EA702AD45260B3C03093FB4B"
			   Description="Microsoft .NET Framework 4.8 Setup"
			   Hash="E322E2E0FB4C86172C38A97DC6C71982134F0570"
			   ProductName="Microsoft .NET Framework 4.8"
			   Size="121307088"
			   Version="4.8.4115.0" />
		</ExePackage>
	</PackageGroup>
</Fragment>

`

Maybe this could help someone who is struggling with the same problem...

[asv]

In 2024, the problem is still relevant...

[15D0:18D4][2024-02-23T08:57:10]i338: Acquiring package: NetFx481Redist, payload: NetFx481Redist, download from: https://go.microsoft.com/fwlink/?linkid=2203305
[1F00:0BAC][2024-02-23T08:57:13]e000: Error 0x80070490: Failed to find expected public key in certificate chain.
[1F00:0BAC][2024-02-23T08:57:13]e000: Error 0x80070490: Failed to verify expected payload against actual certificate chain.
[1F00:0BAC][2024-02-23T08:57:13]e000: Error 0x80070490: Failed to verify signature of payload: NetFx481Redist
[1F00:0BAC][2024-02-23T08:57:13]e310: Failed to verify payload: NetFx481Redist at path: C:\ProgramData\Package Cache\.unverified\NetFx481Redist, error: 0x80070490. Deleting file.
[1F00:0BAC][2024-02-23T08:57:13]e000: Error 0x80070490: Failed to verify payload: NetFx481Redist at path: C:\ProgramData\Package Cache\.unverified\NetFx481Redist
[1F00:0BAC][2024-02-23T08:57:13]e000: Error 0x80070490: Failed to cache payload: NetFx481Redist
[15D0:18D4][2024-02-23T08:57:13]e314: Failed to cache payload: NetFx481Redist from working path: C:\Users\ADMINI~1\AppData\Local\Temp\2\{408C6E0C-B363-42BC-921C-9172D7A952A1}\NetFx481Redist, error: 0x80070490.
[15D0:18D4][2024-02-23T08:57:13]e349: Application requested retry of caching payload: NetFx481Redist, encountered error: 0x80070490. Retrying...
[15D0:18D4][2024-02-23T08:57:16]i338: Acquiring package: NetFx481Redist, payload: NetFx481Redist, download from: https://go.microsoft.com/fwlink/?linkid=2203305
[1F00:0BAC][2024-02-23T08:57:18]e000: Error 0x80070490: Failed to find expected public key in certificate chain.
[1F00:0BAC][2024-02-23T08:57:18]e000: Error 0x80070490: Failed to verify expected payload against actual certificate chain.
[1F00:0BAC][2024-02-23T08:57:18]e000: Error 0x80070490: Failed to verify signature of payload: NetFx481Redist
[1F00:0BAC][2024-02-23T08:57:18]e310: Failed to verify payload: NetFx481Redist at path: C:\ProgramData\Package Cache\.unverified\NetFx481Redist, error: 0x80070490. Deleting file.
[1F00:0BAC][2024-02-23T08:57:18]e000: Error 0x80070490: Failed to verify payload: NetFx481Redist at path: C:\ProgramData\Package Cache\.unverified\NetFx481Redist
[1F00:0BAC][2024-02-23T08:57:18]e000: Error 0x80070490: Failed to cache payload: NetFx481Redist
[15D0:18D4][2024-02-23T08:57:18]e314: Failed to cache payload: NetFx481Redist from working path: C:\Users\ADMINI~1\AppData\Local\Temp\2\{408C6E0C-B363-42BC-921C-9172D7A952A1}\NetFx481Redist, error: 0x80070490.

what did @rseanhall mean when said

heat.exe payload ndp.exe -o net48.wxs
?

In 2024 this exe files not installed with WiX Visual Studio extension.

[chrpai]

@asv Heat.exe can be found in wix 3.14. Run the command and then bring the snippet forward to your v4 source.

[asv]

@chrpai Thanks for the reply, but i don't understand. I have wix v4 extension for visual studio installed and also wix installed via dotnet tool install. on which source v4 should i apply heat.exe? on wix msi project in my solution?

[chrpai]

Download WiX 3.14. In the wixtoolset\bin directory you will see heat. Download ndp.exe from microsoft and run the command quoted above. It will generate net48.wxs. Look at that code and apply it to your bundle.wxs in v4. Consulting services are available if you are completely new to WiX and what I just said made no sense to you.