Title: Visual Studio Community 2026 Stable 18.11.2 — VisualStudio.vsman size and SHA-256 mismatch with official channel manifest

I am preparing to install Visual Studio Community 2026, but the catalog downloaded from Microsoft's official URL does not match the size and SHA-256 declared in the official channel manifest.

I stopped before installing or bypassing any integrity checks.

Environment and channel

• Product: Visual Studio Community 2026

Channel: Stable

Product version: 18.11.2

Build version: 18.11.12324.101

HTTP client: .NET HttpClient / HttpClientHandler

Automatic decompression: explicitly disabled

Channel URI: https://aka.ms/vs/stable/channel

The saved channel manifest is 118,473 bytes with SHA-256:

81190fd42f993460f9a2172c42f8722d43bcb1f8ba1523f98a1d629994aacdb4

Catalog reference from the channel manifest

Package ID: Microsoft.VisualStudio.Manifests.VisualStudio

Version: 18.11.12324.101

File: VisualStudio.vsman

Declared size: 31,255,666 bytes

Declared SHA-256: b7aefeb168ba0be6c55db436328ef42f1800013146390350aed9ecb6d39f9bd6

Catalog URL: https://download.visualstudio.microsoft.com/download/pr/9a3f23c2-cc94-49a0-88c0-f9f19f2ac9df/b7aefeb168ba0be6c55db436328ef42f1800013146390350aed9ecb6d39f9bd6/VisualStudio.vsman

Observed result from one GET

HTTP status: 200

Redirects: 0

Content-Type: application/octet-stream

Content-Length: 18,407,220 bytes

Received bytes: 18,407,220

Observed SHA-256: 976b2ce70dfe7d8d8ab349663ef14d8c4a29a8c3ec840b96e5d38e118e0a5379

The client read the content stream to EOF, buffered the bytes, and computed SHA-256 before any BOM processing, UTF-8 decoding, or JSON parsing.

Automatic decompression was disabled. The actual outgoing Accept-Encoding header and raw response headers were not retained, although the code verified that the parsed Content-Encoding collection was empty.

The received catalog body was not saved after the integrity mismatch, so independent rehashing or inspection of that exact response is no longer possible.

No retries, checksum overrides, installations, or execution of the downloaded catalog were performed.

Questions for Microsoft

Are the size and sha256 properties in this channel manifest expected to match the exact downloaded HTTP payload bytes, or do they refer to a different representation?

Is there an officially documented standalone verification procedure for the channel and catalog, including digital signature and canonicalization rules?

Is there a known publishing or CDN inconsistency affecting this specific Visual Studio 2026 Stable channel/catalog pair?

What is the supported official acquisition and verification method that should be used when the declared and observed values differ?

I found a similar report concerning Visual Studio Build Tools 2022, but I am not assuming that it has the same cause:

https://learn.microsoft.com/en-us/answers/questions/6007242/visual-studio-build-tools-2022-official-catalog-si

I would appreciate clarification of the authoritative integrity-verification procedure before proceeding with installation.Title: Visual Studio Community 2026 Stable 18.11.2 — VisualStudio.vsman size and SHA-256 mismatch with official channel manifest

I am preparing to install Visual Studio Community 2026, but the catalog downloaded from Microsoft's official URL does not match the size and SHA-256 declared in the official channel manifest.

I stopped before installing or bypassing any integrity checks.

Environment and channel

Product: Visual Studio Community 2026

Channel: Stable

Product version: 18.11.2

Build version: 18.11.12324.101

HTTP client: .NET HttpClient / HttpClientHandler

Automatic decompression: explicitly disabled

Channel URI:
https://aka.ms/vs/stable/channel

The saved channel manifest is 118,473 bytes with SHA-256:

81190fd42f993460f9a2172c42f8722d43bcb1f8ba1523f98a1d629994aacdb4

Catalog reference from the channel manifest

Package ID: Microsoft.VisualStudio.Manifests.VisualStudio

Version: 18.11.12324.101

File: VisualStudio.vsman

Declared size: 31,255,666 bytes

Declared SHA-256: b7aefeb168ba0be6c55db436328ef42f1800013146390350aed9ecb6d39f9bd6

Catalog URL:
https://download.visualstudio.microsoft.com/download/pr/9a3f23c2-cc94-49a0-88c0-f9f19f2ac9df/b7aefeb168ba0be6c55db436328ef42f1800013146390350aed9ecb6d39f9bd6/VisualStudio.vsman

Observed result from one GET

HTTP status: 200

Redirects: 0

Content-Type: application/octet-stream

Content-Length: 18,407,220 bytes

Received bytes: 18,407,220

Observed SHA-256: 976b2ce70dfe7d8d8ab349663ef14d8c4a29a8c3ec840b96e5d38e118e0a5379

The client read the content stream to EOF, buffered the bytes, and computed SHA-256 before any BOM processing, UTF-8 decoding, or JSON parsing.

Automatic decompression was disabled. The actual outgoing Accept-Encoding header and raw response headers were not retained, although the code verified that the parsed Content-Encoding collection was empty.

The received catalog body was not saved after the integrity mismatch, so independent rehashing or inspection of that exact response is no longer possible.

No retries, checksum overrides, installations, or execution of the downloaded catalog were performed.

Questions for Microsoft

Are the size and sha256 properties in this channel manifest expected to match the exact downloaded HTTP payload bytes, or do they refer to a different representation?

Is there an officially documented standalone verification procedure for the channel and catalog, including digital signature and canonicalization rules?

Is there a known publishing or CDN inconsistency affecting this specific Visual Studio 2026 Stable channel/catalog pair?

What is the supported official acquisition and verification method that should be used when the declared and observed values differ?

I found a similar report concerning Visual Studio Build Tools 2022, but I am not assuming that it has the same cause:

https://learn.microsoft.com/en-us/answers/questions/6007242/visual-studio-build-tools-2022-official-catalog-si

I would appreciate clarification of the authoritative integrity-verification procedure before proceeding with installation.