Error when you publish a ClickOnce application in Visual Studio 2010 and the .NET Framework 4.5 with custom prerequisites

This article provides information about resolving the error (File has ... changed... or may be corrupt) when you publish a ClickOnce application in Microsoft Visual Studio 2010 and the .NET Framework 4.5 or a later version.

Original product version:   Visual Studio Premium 2010, Visual Studio Professional 2010, Visual Studio Ultimate 2010, .NET Framework 4.5
Original KB number:   3072421

Symptoms

When you publish a ClickOnce application by using Visual Studio 2010 on a computer that has the .NET Framework 4.5, 4.5.1, 4.5.2 or a newer version installed, the redistributable prerequisite packages aren't packaged correctly if they aren't signed. Therefore, the user receives the following error message when Setup.exe runs:

An error occurred while installing system components for <Application_Name>. Setup cannot continue until all system components have been successfully installed.
Setup has detected that the file <path to a temporary location of the MSI file> has either changed since it was initially published or may be corrupt.
See the setup log file located at <path to the Install.log file in the temporary directory under the user's profile> for more information.

Additionally, the following entry is logged in the Install.log file to indicate that hash verification has failed for the unsigned prerequisite file:

Verifying file integrity of <path to a temporary location of the MSI file>
Verifying file hash
Error: Setup has detected that the file <path to a temporary location of the MSI file> has either changed since it was initially published or may be corrupt.

Cause

This problem occurs because the build process generates the prerequisite file's digest by using the SHA2 hashing algorithm when it packages the prerequisite file. However, Setup.exe file tries to read the digest by using the SHA1 algorithm. Therefore, a mismatch occurs between the expected digests and the actual digests, and Setup.exe determines the .msi file to be either missing or corrupted.

Resolution

To resolve this issue, make sure that the custom prerequisite (.msi) file is signed so that the problematic digest isn't generated.

Alternatively, use Visual Studio 2012 or a later version. These program versions don't experience this problem.

More information

Visual Studio 2010 runs MSBUILD tasks that are distributed with the .NET Framework in the Microsoft.Build.Tasks.v4.0.dll assembly. If the .NET Framework 4.5 or a later version is installed on the development computer, this build task generates an SHA2 hash of the prerequisite file if that file isn't signed. During installation on the user's computer, that hash can't be verified by the bootstrapper engine (Setup.exe) that is generated by Visual Studio 2010.