Fix installer checksum verification under Windows PowerShell (#51257)

## Why

A native launcher can pass PowerShell 7 module paths to Windows PowerShell, preventing `Get-FileHash` from loading and blocking archive checksum verification.

## What changed

Update `scripts/install/install.ps1` to compute SHA-256 directly with .NET APIs after resolving the archive path. Dispose the file stream and hash provider, and retain the existing checksum mismatch error.

GitOrigin-RevId: 86e6232bd83c888811fc3b76fcad0aaf046f4bf8
This commit is contained in:
zm-oai
2026-10-06 03:43:46 +00:00
committed by copyberry
parent 580b18cb74
commit 162fcb3976
+15 -1
View File
@@ -214,7 +214,21 @@ function Test-ArchiveDigest {
[string]$ExpectedDigest
)
$actualDigest = (Get-FileHash -LiteralPath $ArchivePath -Algorithm SHA256).Hash.ToLowerInvariant()
# A native launcher can pass PowerShell 7 module paths to Windows PowerShell,
# preventing Get-FileHash from loading. Hash directly without module lookup.
$providerPath = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath($ArchivePath)
$sha256 = [System.Security.Cryptography.SHA256CryptoServiceProvider]::new()
try {
$stream = [System.IO.File]::OpenRead($providerPath)
try {
$actualDigest = [System.BitConverter]::ToString($sha256.ComputeHash($stream)).Replace("-", "").ToLowerInvariant()
} finally {
$stream.Dispose()
}
} finally {
$sha256.Dispose()
}
if ($actualDigest -ne $ExpectedDigest) {
throw "Downloaded Codex archive checksum did not match expected digest. Expected $ExpectedDigest but got $actualDigest."
}