Duplicate InstallerSha256 across versions, version test

[khaffner]

Take this example:

There are three versions/manifests of GitKraken here that all contain the same installer. And it still just installs version 9.10.0.

This discussion is not necessarily about correcting GitKraken (fyi @PckgrBot ), but:

1. The fact that multiple manifests across versions can have the same InstallerSha256 value. Why is this ok? If the installer were of the "online" type, meaning it automatically installs the newest version from the internet, then I believe the old manifests should be removed.
2. In my opinion the tests here should verify that the version in the manifest matches the version that gets installed. This seems not to be the case.

[Trenly]

The fact that multiple manifests across versions can have the same InstallerSha256 value. Why is this ok? If the installer were of the "online" type, meaning it automatically installs the newest version from the internet, then I believe the old manifests should be removed.

Yes, I would agree. With the amount of manifests in the repository, sometimes things just get missed. It would be a great idea to submit removal PRs to remove 9.11.0 and 9.11.1 since only 9.10.0 is installable with that file hash. There is a warning label that gets applied when a duplicate hash is detected, which does help with this, but sometimes things still get overlooked.

In my opinion the tests here should verify that the version in the manifest matches the version that gets installed. This seems not to be the case.

There are reasons that the version might not match. It's possible that an installer doesn't write a display version, or it's possible that the package writes a commit hash as the display version and the package uses AppsAndFeaturesEntries. Moderators do review each PR manually and should be checking for the version to match, but if it's an online installer then they might not catch that there are older versions that need to be removed. Similarly, it's possible that if it is an online installer, the version is updated and matches the manifest, but then the publisher could roll back to a previous version (as seems to be the case for GitKraken).

[PckgrBot]

@khaffner Ah it looks like the installer has been moved to https://release.axocdn.com/windows/GitKrakenSetup.exe which does download the latest version. I'll update the automation. I understand this is part of a bigger conversation though :D