[Bug Report] - Updater ignores MD5 if file size matches

[MadManMarkAu]

In the update.txt file, there is an MD5 hash and a file size stored for the MSI installer. When updater.exe downloads update.txt, it checks the file size against the previously downloaded (cached) MSI. If the file size matches, it does NOT check the MD5 of the previosly downloaded MSI and instead tries to use the existing cached version to install. This fails because that version is already installed.

We have found a workaround by checking the "Delete update package file after installation" in the updater project. Sadly, this does not fix existing installations out in the wild. We have to add a dummy file to the MSI so the file size changes. Then the MD5 hash is checked, passes, and the new version is downloaded and installed.

I can supply a test case (2 x MSI and 2 x TXT files) via direct message if needed.

Reproduction Steps
1. Build an MSI, with the updater service included.
2. Build an update.txt. DO NOT check "Delete package after install".
3. Copy MSI and TXT to web server.
4. Install the MSI on target machine.
5. Increment version number in MSI project.
6. Build new MSI.
7. Build new update.txt.
8. Copy MSI and TXT to web server.
9. Run Update.exe. Update downloads and installs (no cached MSI).
10. Increment version number in MSI project.
11. Build new MSI.
12. Build new update.txt.
13. Copy MSI and TXT to web server.
14. Confirm old MSI file size is the same as new MSI file size. If not, update and return to step 10.
15. Attempt to update target machine using Update.exe. Update does not download (uses cached MSI); install fails.

What We Should See
Updater should say "New version available". Updater should download MSI. Updater should install MSI. New version should be present on target.

What We Actually See
Updater says "New version available". Updater does NOT download MSI (reuses existing cached MSI). Updater attempts to install MSI, fails.

Affected Versions
Tested to be an issue on 22.5 and 22.9.1 (latest currently available).

Example

Version 2025.8.1911.0:

Code: Select all

;aiu;

[Update]
Name = [redacted]
ProductVersion = 2025.8.1911.0
URL = http://[redacted]/[redacted].msi
Size = 37174272
MD5 = 7229936e652c8e16deb9b064dedf4fbb
ServerFileName = [redacted]
Flags = Advertises
RegistryKey = HKLM\Software\[redacted]\[redacted]\Version
Version = 2025.8.1911.0

Version 2025.8.1912.0:

Code: Select all

;aiu;

[Update]
Name = [redacted]
ProductVersion = 2025.8.1912.0
URL = http://[redacted]/[redacted].msi
Size = 37174272
MD5 = cdda776a87eb03a3e667b1bea22a0438
ServerFileName = [redacted]
Flags = Advertises
RegistryKey = HKLM\Software\[redacted]\[redacted]\Version
Version = 2025.8.1912.0

Screenshots
https://www.dropbox.com/scl/fi/wr7unrig ... 2nql7&dl=0
https://www.dropbox.com/scl/fi/3403h3y0 ... 4kf8v&dl=0
https://www.dropbox.com/scl/fi/hnd18s98 ... gfn9y&dl=0

[Catalin]

Hello,

Thank you for the detailed test-case.

After following it, I was able to reproduce the issue.

For the moment, I created a ticket so that this can be fixed in a future version of Advanced Installer.

However, as the option you already mentioned, not quite sure how this will affect the already rolled updates.

With that in mind, I would advise simply adding a temporary file to your package so that it does not have the exact same size - also, the fact that two updates have the exact same size is really rare.

Best regards,
Catalin