Summary
Two of the three Invoke-WebRequest calls in scripts/install.ps1 omit -UseBasicParsing, and the script never forces TLS 1.2. Both matter only on Windows PowerShell 5.1, which is the shell the README's PowerShell install line runs under.
Detail
All Invoke-WebRequest call sites in scripts/install.ps1:
96: return (Invoke-WebRequest -UseBasicParsing -Uri $PinUrl).Content
612: Invoke-WebRequest -Uri $DownloadUrl -OutFile $ArchivePath
613: Invoke-WebRequest -Uri $ChecksumUrl -OutFile $ChecksumPath
Line 96 is correct. Lines 612-613 are the archive and checksum downloads — the two calls that actually fetch the release payload.
scripts/check-release-installer.ps1:51 also passes -UseBasicParsing, so line 96 and that file represent the intended house style; 612-613 are the outliers.
Why -UseBasicParsing matters
Without it, Windows PowerShell 5.1 routes the response through the Internet Explorer DOM engine to build ParsedHtml. That engine is absent or unconfigured on Windows Server images with IE removed and on hosts where IE first-launch configuration was never completed, and the call throws instead of downloading.
This survives today only because GitHub serves release assets as application/octet-stream, so 5.1 skips HTML parsing. It is a latent dependency on a response header, not on anything the script controls.
Why TLS 1.2 matters
grep -n 'SecurityProtocol\|Tls12' scripts/install.ps1 returns nothing. Windows PowerShell 5.1 inherits the .NET Framework default protocol set, which on older or policy-restricted hosts does not include TLS 1.2. GitHub requires TLS 1.2. The failure surfaces as a connection error with no hint about the protocol.
Suggested fix
[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest -UseBasicParsing -Uri $DownloadUrl -OutFile $ArchivePath
Invoke-WebRequest -UseBasicParsing -Uri $ChecksumUrl -OutFile $ChecksumPath
Set the protocol once near the top of the script rather than per call.
Severity
Hardening rather than a live outage: on a current Windows 11 or Server 2022 host with default settings, the install works today. It fails on hosts where IE is absent or TLS 1.2 is not in the default set — exactly the locked-down environments where a clear error matters most.
Provenance
Found by a read-only Windows compatibility audit (finding F6). Line numbers verified against the current tree. No files were modified.
Summary
Two of the three
Invoke-WebRequestcalls inscripts/install.ps1omit-UseBasicParsing, and the script never forces TLS 1.2. Both matter only on Windows PowerShell 5.1, which is the shell the README's PowerShell install line runs under.Detail
All
Invoke-WebRequestcall sites inscripts/install.ps1:Line 96 is correct. Lines 612-613 are the archive and checksum downloads — the two calls that actually fetch the release payload.
scripts/check-release-installer.ps1:51also passes-UseBasicParsing, so line 96 and that file represent the intended house style; 612-613 are the outliers.Why
-UseBasicParsingmattersWithout it, Windows PowerShell 5.1 routes the response through the Internet Explorer DOM engine to build
ParsedHtml. That engine is absent or unconfigured on Windows Server images with IE removed and on hosts where IE first-launch configuration was never completed, and the call throws instead of downloading.This survives today only because GitHub serves release assets as
application/octet-stream, so 5.1 skips HTML parsing. It is a latent dependency on a response header, not on anything the script controls.Why TLS 1.2 matters
grep -n 'SecurityProtocol\|Tls12' scripts/install.ps1returns nothing. Windows PowerShell 5.1 inherits the .NET Framework default protocol set, which on older or policy-restricted hosts does not include TLS 1.2. GitHub requires TLS 1.2. The failure surfaces as a connection error with no hint about the protocol.Suggested fix
Set the protocol once near the top of the script rather than per call.
Severity
Hardening rather than a live outage: on a current Windows 11 or Server 2022 host with default settings, the install works today. It fails on hosts where IE is absent or TLS 1.2 is not in the default set — exactly the locked-down environments where a clear error matters most.
Provenance
Found by a read-only Windows compatibility audit (finding F6). Line numbers verified against the current tree. No files were modified.