Fix Windows install security warning from Invoke-WebRequest#122
Merged
Conversation
Replace the artifact probe loop (Invoke-WebRequest HEAD requests) with
a membership check against the GitHub release asset list already fetched
via Invoke-RestMethod. This eliminates Invoke-WebRequest entirely, which
was triggering a PowerShell 5.1 IE-parser security warning on every
install.
- For 'latest': extract $ReleaseAssets from the existing API response
at no extra cost.
- For a specific version: add an Invoke-RestMethod call to
/releases/tags/{tag} to fetch the same asset list.
- Replace the HEAD probe loop with a simple -contains membership check.
- Improve the error message: show available Windows assets from the
release when no compatible binary is found.
Fixes #118
|
Coverage after merging fix/windows-install-security-warning into main will be
Coverage Report
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the Windows install script to avoid Windows PowerShell 5.1 security prompts by removing Invoke-WebRequest usage during artifact selection and instead using the GitHub release asset list.
Changes:
- Derive
$ReleaseAssetsfrom the GitHub release API response and use it to select the best Windows artifact variant (with x64 fallbacks). - For
-Versioninstalls, fetch the release-by-tag metadata to obtain the asset list. - Improve the “no compatible binary” error by printing available Windows assets from the release.
When installing a specific version (-Version v1.x.y) and the GitHub API is blocked or rate-limited, set $ReleaseAssets to $null instead of failing hard, then fall back to probing candidate artifact URLs with 'curl.exe -fsI' (HEAD requests). curl.exe ships with Windows 10 1803+ and is already used for the binary download, so the dependency is not new. This preserves the behaviour of the original script in API-restricted environments while avoiding Invoke-WebRequest (which triggers the PS5.1 security warning). Addresses code-review feedback on PR #122.
|
Coverage after merging fix/windows-install-security-warning into main will be
Coverage Report
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause
On Windows PowerShell 5.1,
Invoke-WebRequestuses the Internet Explorer HTML parser by default. Any call to it — even a simpleHEADrequest — triggers a security prompt:The install script used
Invoke-WebRequestto probe each candidate artifact with a HEAD request before downloading it (to detect which variant —x64-modern,x64-baselineorx64— was available in the release). This caused one security warning per install, alarming users and leading to abandoned installs.Fix
Replace the
Invoke-WebRequestHEAD probe loop with a membership check against the GitHub release asset list, which is already available viaInvoke-RestMethod(the existing pattern in the script).latestcase: extract$ReleaseAssetsfrom the response already fetched — zero extra requests.Invoke-RestMethodcall to/repos/{repo}/releases/tags/{tag}to obtain the same asset list.if ($ReleaseAssets -contains $CandidateArtifact)check — no network I/O, noInvoke-WebRequest, no security warning.Steps to reproduce (before the fix)
Steps to verify (after the fix)
Fixes #118