Visual Studio Build Tools 2022 17.14.40 — Catalog SHA-256 mismatch and MSVC VSIX size discrepancy

Emile Cotte 0 Reputation points
2026-10-25T13:09:05.4033333+00:00

Hello,

I am investigating two integrity metadata inconsistencies involving Visual Studio Build Tools 2022 version 17.14.40 (build 17.14.37628.2).

I would like clarification on the official published artifacts before proceeding with a native Windows application build.

1. VisualStudio.vsman catalog mismatch

The fixed Visual Studio Release channel manifest declares:

File: VisualStudio.vsman

Version: 17.14.37628.2

Expected size: 30,442,868 bytes

Expected SHA-256: 469B3396A3493DF91870CE13C52015A92283A2D1C6FD12E5F7E55669BE8050CA

However, the catalog downloaded on October 24, 2026 had:

Actual size: 17,954,404 bytes

Actual SHA-256: B60EFAC8768E31B4B0BB74D312A3FD3145DE9BEF7F794C050D498D079E540E11

The HTTP response returned 200 OK, with Content-Length: 17954404, no observed redirect, and no automatic decompression.

Four preserved copies are identical and contain a validly readable JSON catalog identifying itself as VisualStudio/17.14.40+37628.2, with 19,354 packages.

2. MSVC VSIX package size discrepancy

Package: Microsoft.VC.14.44.17.14.Tools.HostX64.TargetX64.base

Version: 14.44.35228

Declared size: 26,660,160 bytes

Actual size: 26,604,670 bytes

Declared and actual SHA-256: EE0BAAA3A112D255F19F6C27DCC0FF6E496949EB9F1F37BE0AC908C562A7076C

The SHA-256 matches, but the file size differs by 55,490 bytes.

The installed cl.exe and link.exe match the corresponding files in the cached VSIX.

3. Questions

Could Microsoft clarify:

What are the correct official size and SHA-256 of VisualStudio.vsman for build 17.14.37628.2?

Could this discrepancy result from outdated metadata, a revised catalog, different serialization, or another documented mechanism?

Why does the MSVC VSIX have a matching SHA-256 but a different size from the declared metadata?

What is the officially supported method for independently validating the catalog's JSON signature and trust chain?

Is the historically installed toolchain considered valid, or is corrective action recommended?

No security compromise is being alleged. My objective is to establish the provenance and integrity of these files.

A subsequent verification attempt was blocked by name-resolution failures in a restricted execution environment and provided no new HTTP response.

I can provide relevant manifest entries, HTTP headers, file hashes, and selected installation logs if needed.

Thank you for your assistance.

Developer technologies | Visual Studio | Setup
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Brian Pham (WICLOUD CORPORATION) 1,090 Reputation points Microsoft External Staff Moderator
    2026-10-26T06:31:10.64+00:00

    Hi @Emile Cotte ,

    Thank you for providing the detailed investigation results. I understand that the difference between the catalog size and the actual download size may be concerning.

    So far, we haven’t received any reports indicating that this discrepancy affects Visual Studio functionality or causes installation errors. To avoid any issue, we recommend downloading & install the latest version of Visual Studio on this link.

    If you would like an authoritative explanation of this discrepancy, I recommend posting your question on the Visual Studio Developer Community, where the engineer team can review and provide more insight about your concern. You can submit your question using this link or open Visual Studio Installer and click "Report a Problem workflow ". Please include the relevant logs and other diagnostic information if available, as these details may help the product team investigate the issue.

    If you have an eligible Visual Studio subscription that includes Technical Support benefits, you can submit a support ticket for advanced assistance, such as a 1:1 consultation, remote support, or a Teams meeting with a support engineer. This is an effective way to resolve your concern.

    I hope this information helps address your concern. If you have any questions about submitting a Developer Community report or creating a support case through one of the options above, please feel free to leave a comment. I’ll be happy to assist.

    You’re also welcome to share your feedback on my response by following this guidance.

    Have a nice day! I look forward to hearing from you.

    Was this answer helpful?

    1 person found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.