Conversation
hemarina
requested review from
JeffreyCA,
rajeshkamal5050,
tg-msft,
vhvb1989,
wbreza and
weikanglim
as code owners
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the Windows MSI self-update flow to stop bypassing signature verification and adjusts the PowerShell invocation strategy per update channel.
Changes:
- Removes
-SkipVerifyusage when invokinginstall-azd.ps1so MSI Authenticode verification can run. - Changes
buildInstallScriptArgsbehavior: stable pipes the script toInvoke-Expression, daily downloads to a temp file and runs with-Version 'daily'and-InstallFolder. - Updates/extends unit tests for the new argument structures and removes the now-dead
versionFlagtest.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
cli/azd/pkg/update/msi_windows.go |
Reworks PowerShell command construction to avoid -SkipVerify and to handle daily channel parameters. |
cli/azd/pkg/update/msi_windows_test.go |
Updates tests to validate the new stable/daily argument structure and adds negative-assertions for stable. |
Comment on lines
176
to
+181
| default: | ||
| return "stable" | ||
| script := fmt.Sprintf( | ||
| "Invoke-RestMethod '%s' | Invoke-Expression", | ||
| installScriptURL, | ||
| ) | ||
| return []string{"-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script} |
There was a problem hiding this comment.
For the stable channel, this executes a remote script via Invoke-RestMethod ... | Invoke-Expression. The repository’s own install-azd.ps1 docs note that piping into Invoke-Expression prevents Authenticode validation of the script’s signature, and recommend downloading to a file to validate. Consider using the same “download to temp file then execute” flow for stable (even with no parameters) so the script signature can be validated before running.
Collaborator
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
spboyer
reviewed
Mar 26, 2026
Member
spboyer
left a comment
spboyer
left a comment
There was a problem hiding this comment.
Code Review
1. azd update now requires PowerShell 7
cli/azd/pkg/update/manager.go:513 — High
The MSI update path changed from powershell to pwsh. pwsh.exe (PowerShell 7) is not installed by default on Windows 10/11 — only powershell.exe (5.1) ships pre-installed. This will cause azd update to fail on machines without PowerShell 7. The rest of the codebase handles this with a pwsh -> powershell fallback (see pkg/tools/powershell/powershell.go:40-61). Additionally, verifyAuthenticode at line 713 in the same file still uses powershell, creating an inconsistency.
Fix: Keep using powershell (the install script and Get-AuthenticodeSignature work fine under 5.1), or add an availability check with fallback.
2. Daily-channel install path not escaped for PowerShell
cli/azd/pkg/update/msi_windows.go:169 — Medium
The daily update command formats -InstallFolder '%s' directly. If %LOCALAPPDATA% contains an apostrophe (e.g., username O'Connor), the generated PowerShell command becomes syntactically invalid.
Fix: Escape embedded ' characters for PowerShell single-quoted literals, or pass the install folder as a separate argument.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#7265
This pull request refactors how the Windows MSI installation script arguments are constructed and tested, improving clarity and correctness for different release channels (stable vs. daily). The main change is to simplify and clarify the logic for building PowerShell command arguments, ensuring that stable and daily channels are handled distinctly and tested accordingly.
Refactoring and logic improvements for install script arguments:
versionFlagfunction and refactoredbuildInstallScriptArgsto directly construct the appropriate PowerShell command for each channel, ensuring that stable uses a piped script and daily downloads and executes the script with additional parameters.Test updates for new logic and coverage:
TestVersionFlagand updatedTestBuildInstallScriptArgsto verify the presence or absence of key substrings in the generated arguments, matching the new logic for stable and daily channels. [1] [2] [3]TestBuildInstallScriptArgsandTestBuildInstallScriptArgs_Structureto check for correct argument construction, including validation that stable does not use temporary files or extra parameters, while daily does.