Rebuild msi package , Hash changes even no file changes.

[WTGLouisZhou]

Hey guys:
If I use Visual studio build a package twice with no file changes. I found the file hash changed. This could lead to some issue in some scenario.
Like in a CI CD env, we have a bundle a two msis. For msi1 it changes often, but for msi2 not, it does not change often. but we build bundle and msis for each deployment. and we would use bundle download msi on server for upgrading and installation. For each upgrade, even the version of second msi does not change, it would still need to download and recache due to mismatch hash value. Any good idea for this ?

[chrpai]

I typically have different pipelines for scenarios like this. Build MSI2 and put it on the shelf. (Artifactory for example.) Build complete solution, pull in a pinned version of msi2, build msi1 and build bootstrapper. Update to newer pinned version of MSI2 as needed.

As for why the checksum is changing, this is usually because it's creating a new packagecode every time. (v3 Package@Id v4 seems to have taken away that ability.)

[WTGLouisZhou]

Thanks for your reply, I was just thinking about this solution. but it would be better if we can rebuild the package and that does not change the check sum.

[robmen]

@chrpai's suggestion is a good one, but you can also use an MSBuild bin log file to investigate what is causing the build to be rebuilt when no inputs are changed. Or rather, the log file will show you which inputs changed and you can go down the rabbit hole to fix the build process.

[chrpai]

@robmen am I correct in not seeing the ability to specify PackageCode in v4? Or atleast have wixcop throw an error or warning saying the specified Id couldn't be migrated.

I haven't used this in a long time but at my last job we'd have build reproducibility audits and we were expected to be able to recreate a build from a specified tag and end up with the same checksum. Surprisingly it's possible! :)

Then again there's also the "Small Update" scenario but that one doesn't hold much weight with me as useful.

[WTGLouisZhou]

That is just our pipeline. if any changes in whole solution, then all projects in this solution would be built again. Maybe we need to take chrpai's idea if we cannot achieve that no checksum changes when recreate a build.

[barnson]

MSI databases don't have reproducible builds.

[chrpai]

An msi is just a file and windows installer doesn't have any concept of build at all for that matter.

But it has been my experience that when building an msi with wix with identical inputs you'll get a binary equal output. Code signing and time stamping not included.

Or atleast I could in v3 when I could specify the package code.