From 162fcb3976e292fb7492924f7d493fdfce328551 Mon Sep 17 00:00:00 2001 From: zm-oai Date: Tue, 6 Oct 2026 03:32:00 +0000 Subject: [PATCH] Fix installer checksum verification under Windows PowerShell (#51257) ## Why A native launcher can pass PowerShell 7 module paths to Windows PowerShell, preventing `Get-FileHash` from loading and blocking archive checksum verification. ## What changed Update `scripts/install/install.ps1` to compute SHA-256 directly with .NET APIs after resolving the archive path. Dispose the file stream and hash provider, and retain the existing checksum mismatch error. GitOrigin-RevId: 86e6232bd83c888811fc3b76fcad0aaf046f4bf8 --- scripts/install/install.ps1 | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/scripts/install/install.ps1 b/scripts/install/install.ps1 index cd9c0c7789..05657ee2ff 100644 --- a/scripts/install/install.ps1 +++ b/scripts/install/install.ps1 @@ -214,7 +214,21 @@ function Test-ArchiveDigest { [string]$ExpectedDigest ) - $actualDigest = (Get-FileHash -LiteralPath $ArchivePath -Algorithm SHA256).Hash.ToLowerInvariant() + # A native launcher can pass PowerShell 7 module paths to Windows PowerShell, + # preventing Get-FileHash from loading. Hash directly without module lookup. + $providerPath = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath($ArchivePath) + $sha256 = [System.Security.Cryptography.SHA256CryptoServiceProvider]::new() + try { + $stream = [System.IO.File]::OpenRead($providerPath) + try { + $actualDigest = [System.BitConverter]::ToString($sha256.ComputeHash($stream)).Replace("-", "").ToLowerInvariant() + } finally { + $stream.Dispose() + } + } finally { + $sha256.Dispose() + } + if ($actualDigest -ne $ExpectedDigest) { throw "Downloaded Codex archive checksum did not match expected digest. Expected $ExpectedDigest but got $actualDigest." }