DSC stops setting configuration if `WinGet/Source` encounters "hash incompatible" error

[Kenya-West]

Hello! This is a copy of PowerShell/DSC#1685 (comment) because their team thinks that this is the problem with WinGet's declared resource. In short: winget fails checking hash, and dsc stops working because of that.

Here's a copy of the issue:

Summary

If WinGet has a package that is updated but the package manifest contains an outdated SHA-256 hash, it fails with this error:

> winget install -e --id PKI.NCALayer
Найдено NCALayer [PKI.NCALayer] Версия 1.4-260623
Download from https://ncl.pki.gov.kz/images/NCALayer/NCALayerInstall_x64.exe
  ██████████████████████████████  63.7 MB / 63.7 MB
Installer hash does not match # <-- THIS

– that's expected, and can be skipped by supplying additional parameters.

The dsc, when underlying winget encounters the error, all of sudden stops working, See the error below.

---

That's unexpected behaviour for me as DSC user because the documentation says it work per-item:

The DSC resources handle the how for each instance.

The result for each instance...

Provides metadata about the operation as a whole and for each resource instance

I thought it is assumed that if one resource item fails, other proceed to be executed as independent (they are independent from each other, in config below).

Steps to reproduce

1. Create this configuration:

Details

# yaml-language-server: $schema=https://aka.ms/configuration-dsc-schema/0.3
$schema: https://raw.githubusercontent.com/PowerShell/DSC/main/schemas/2023/08/config/document.json
metadata:
  winget:
    processor:
      identifier: "dscv3"
resources:
  - name: winget_Microsoft.PreIndexed.Package
    type: Microsoft.WinGet/Source
    metadata:
      description: "winget_Microsoft.PreIndexed.Package: настройка"
      winget:
        securityContext: "elevated"
    properties:
      type: "Microsoft.PreIndexed.Package"
      trustLevel: "trusted"
      argument: "https://cdn.winget.microsoft.com/cache"
      name: "winget"
  - name: winget_Logitech.GHUB
    type: Microsoft.WinGet/Package
    metadata:
      description: "Установить Logitech.GHUB"
    dependsOn:
      - "[resourceId('Microsoft.WinGet/Source', 'winget_Microsoft.PreIndexed.Package')]"
    properties:
      id: "Logitech.GHUB"
      source: "winget"
  - name: winget_Microsoft.GameInput
    type: Microsoft.WinGet/Package
    metadata:
      description: "Установить Microsoft.GameInput"
    dependsOn:
      - "[resourceId('Microsoft.WinGet/Source', 'winget_Microsoft.PreIndexed.Package')]"
    properties:
      id: "Microsoft.GameInput"
      source: "winget"
  - name: winget_NexusMods.Vortex
    type: Microsoft.WinGet/Package
    metadata:
      description: "Установить NexusMods.Vortex"
    dependsOn:
      - "[resourceId('Microsoft.WinGet/Source', 'winget_Microsoft.PreIndexed.Package')]"
    properties:
      id: "NexusMods.Vortex"
      source: "winget"
  - name: winget_ParadoxInteractive.ParadoxLauncher
    type: Microsoft.WinGet/Package
    metadata:
      description: "Установить ParadoxInteractive.ParadoxLauncher"
    dependsOn:
      - "[resourceId('Microsoft.WinGet/Source', 'winget_Microsoft.PreIndexed.Package')]"
    properties:
      id: "ParadoxInteractive.ParadoxLauncher"
      source: "winget"
  - name: winget_ElectronicArts.EADesktop
    type: Microsoft.WinGet/Package
    metadata:
      description: "Установить ElectronicArts.EADesktop"
    dependsOn:
      - "[resourceId('Microsoft.WinGet/Source', 'winget_Microsoft.PreIndexed.Package')]"
    properties:
      id: "ElectronicArts.EADesktop"
      source: "winget"
  - name: winget_EpicGames.EpicGamesLauncher
    type: Microsoft.WinGet/Package
    metadata:
      description: "Установить EpicGames.EpicGamesLauncher"
    dependsOn:
      - "[resourceId('Microsoft.WinGet/Source', 'winget_Microsoft.PreIndexed.Package')]"
    properties:
      id: "EpicGames.EpicGamesLauncher"
      source: "winget"
  - name: winget_Ubisoft.Connect
    type: Microsoft.WinGet/Package
    metadata:
      description: "Установить Ubisoft.Connect"
    dependsOn:
      - "[resourceId('Microsoft.WinGet/Source', 'winget_Microsoft.PreIndexed.Package')]"
    properties:
      id: "Ubisoft.Connect"
      source: "winget"
  - name: winget_Valve.Steam
    type: Microsoft.WinGet/Package
    metadata:
      description: "Установить Valve.Steam"
    dependsOn:
      - "[resourceId('Microsoft.WinGet/Source', 'winget_Microsoft.PreIndexed.Package')]"
    properties:
      id: "Valve.Steam"
      source: "winget"
  - name: winget_Blizzard.BattleNet
    type: Microsoft.WinGet/Package
    metadata:
      description: "Установить Blizzard.BattleNet"
    dependsOn:
      - "[resourceId('Microsoft.WinGet/Source', 'winget_Microsoft.PreIndexed.Package')]"
    properties:
      id: "Blizzard.BattleNet"
      source: "winget"

2. Verify with dsc config test --file "E:\Сеть\gaming.winget" to see the syntax is correct;

3. Try to apply the config dsc config set --file "E:\Сеть\gaming.winget" - and you will encounter an error with SHA-256 mismatch;

4. After the error happened, see that next items in the resource are not "set" (or installed, in terms of WinGet):

Details

PS> dsc config get --file "E:\Сеть\gaming.winget"
executionInformation:
  duration: PT106.57571S
  endDatetime: 2026-08-21T21:22:48.042501300+07:00
  executionType: actual
  operation: get
  securityContext: restricted
  startDatetime: 2026-08-21T21:21:01.466791300+07:00
  version: 3.2.3
metadata:
  Microsoft.DSC:
    duration: PT106.5754106S
    endDatetime: 2026-08-21T21:22:48.042201900+07:00
    executionType: actual
    operation: get
    securityContext: restricted
    startDatetime: 2026-08-21T21:21:01.466791300+07:00
    version: 3.2.3
results:
- executionInformation:
    duration: PT0.4021512S
  metadata:
    Microsoft.DSC:
      duration: PT0.4021512S
  name: winget_Microsoft.PreIndexed.Package
  type: Microsoft.WinGet/Source
  result:
    actualState:
      _exist: true
      argument: https://cdn.winget.microsoft.com/cache
      explicit: false
      name: winget
      trustLevel: trusted
      type: Microsoft.PreIndexed.Package
- executionInformation:
    duration: PT46.2572849S
  metadata:
    Microsoft.DSC:
      duration: PT46.2572849S
  name: winget_Logitech.GHUB
  type: Microsoft.WinGet/Package
  result:
    actualState:
      _exist: true
      id: Logitech.GHUB
      source: winget
      useLatest: true
      version: 2026.5.939708
- executionInformation:
    duration: PT1.0847518S
  metadata:
    Microsoft.DSC:
      duration: PT1.0847518S
  name: winget_Microsoft.GameInput
  type: Microsoft.WinGet/Package
  result:
    actualState:
      _exist: true
      id: Microsoft.GameInput
      source: winget
      useLatest: false
      version: 3.3.221.0
- executionInformation:
    duration: PT1.0564382S
  metadata:
    Microsoft.DSC:
      duration: PT1.0564382S
  name: winget_NexusMods.Vortex
  type: Microsoft.WinGet/Package
  result:
    actualState:
      _exist: true
      id: NexusMods.Vortex
      source: winget
      useLatest: true
      version: 2.5.0
- executionInformation:
    duration: PT1.0319307S
  metadata:
    Microsoft.DSC:
      duration: PT1.0319307S
  name: winget_ParadoxInteractive.ParadoxLauncher
  type: Microsoft.WinGet/Package
  result:
    actualState:
      _exist: false
      id: ParadoxInteractive.ParadoxLauncher
      source: winget
- executionInformation:
    duration: PT24.1893277S
  metadata:
    Microsoft.DSC:
      duration: PT24.1893277S
  name: winget_ElectronicArts.EADesktop
  type: Microsoft.WinGet/Package
  result:
    actualState:
      _exist: true
      id: ElectronicArts.EADesktop
      source: winget
      useLatest: false
      version: 13.443.0.5956
- executionInformation:
    duration: PT1.044192S
  metadata:
    Microsoft.DSC:
      duration: PT1.044192S
  name: winget_EpicGames.EpicGamesLauncher
  type: Microsoft.WinGet/Package
  result:
    actualState:
      _exist: false
      id: EpicGames.EpicGamesLauncher
      source: winget
- executionInformation:
    duration: PT1.0269845S
  metadata:
    Microsoft.DSC:
      duration: PT1.0269845S
  name: winget_Ubisoft.Connect
  type: Microsoft.WinGet/Package
  result:
    actualState:
      _exist: false
      id: Ubisoft.Connect
      source: winget
- executionInformation:
    duration: PT23.4049799S
  metadata:
    Microsoft.DSC:
      duration: PT23.4049799S
  name: winget_Valve.Steam
  type: Microsoft.WinGet/Package
  result:
    actualState:
      _exist: true
      id: Valve.Steam
      source: winget
      useLatest: true
      version: 2.10.91.91
- executionInformation:
    duration: PT1.0425187S
  metadata:
    Microsoft.DSC:
      duration: PT1.0425187S
  name: winget_Blizzard.BattleNet
  type: Microsoft.WinGet/Package
  result:
    actualState:
      _exist: false
      id: Blizzard.BattleNet
      source: winget
messages: []
hadErrors: false

Expected behavior

Once meet the error with one resource item, `dsc` should proceed to the next independent item.

Actual behavior

It stops working for all next entries once it gets error in underlying `winget`.

Error details

PS> dsc config set --file "E:\Сеть\gaming.winget"
2026-08-21T12:23:58.220183Z ERROR Failed to run process 'winget': Command: Resource 'winget' [exit code -1978335215] <E> [CLI ] Package hash verification failed. SHA256 in manifest [7684a4317d9963102e7ba4ed3820e8fc9d7f6fb70f70c3aa8eb5d9299e29affb] does not match download [273d053b130d4a3daae34b6bfac8775d8ef2b9bf5c86bb8a605de58ad8418612] with file size [161619120] and content type [application/x-msdownload]
<E> [CLI ] Terminating context: 0x8a150011 at C:\__w\1\s\external\pkg\src\AppInstallerCLICore\Workflows\DownloadFlow.cpp:244
<E> [CLI ] Terminating context: 0x8a150011 at :0

2026-08-21T12:23:58.221775Z ERROR Error: Command: Resource 'winget' [exit code -1978335215] <E> [CLI ] Package hash verification failed. SHA256 in manifest [7684a4317d9963102e7ba4ed3820e8fc9d7f6fb70f70c3aa8eb5d9299e29affb] does not match download [273d053b130d4a3daae34b6bfac8775d8ef2b9bf5c86bb8a605de58ad8418612] with file size [161619120] and content type [application/x-msdownload]
<E> [CLI ] Terminating context: 0x8a150011 at C:\__w\1\s\external\pkg\src\AppInstallerCLICore\Workflows\DownloadFlow.cpp:244
<E> [CLI ] Terminating context: 0x8a150011 at :0

Environment data

PS> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.6.5
PSEdition                      Core
GitCommitId                    7.6.5
OS                             Microsoft Windows 10.0.26200
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.4
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Version

3.2.3

Visuals

No response

[github-actions]

Possible duplicate(s):

Thank you for submitting this issue.

The issue(s) below may already track your request or bug. Please take a look — if one of them matches, give that issue a 👍 and close this one as a duplicate. Older or curated issues are preferred as the canonical one to follow.

• Microsoft.Office Installer Hash does not match #6418 — Reports the same "Package hash verification failed / SHA256 in manifest does not match download" error at DownloadFlow.cpp:244, which is the root cause that triggers DSC to stop processing subsequent resources.
• Provide mechanism to report SHA256 mismatch #870 — Tracks a feature request to provide a mechanism to detect and report SHA256 hash mismatches in package manifests, which is the underlying catalog-health issue causing this failure.

Template: msftbot/duplicate/surfaced by Duplicate Surfacing