freecode-sh 0.1.0-alpha.42 → 0.1.0-rc.3

package/install.ps1

@@ -1,683 +0,0 @@
-#Requires -Version 5.1
-
-<#
-.SYNOPSIS
-Installs the Free Code native Windows alpha without administrator access.
-
-.EXAMPLE
-irm https://freecode.sh/install.ps1 | iex
-
-.EXAMPLE
-.\install.ps1 -Version 0.1.0-alpha.1 -NoModifyPath
-#>
-
-[CmdletBinding()]
-param(
-  [string]$Version,
-  [string]$Channel,
-  [string]$BaseUrl,
-  [string]$ChannelBaseUrl,
-  [string]$ArchivePath,
-  [string]$ChecksumPath,
-  [string]$ManifestPath,
-  [string]$ExpectedCurrentVersion,
-  [string]$ExpectedArchiveSha256,
-  [long]$ExpectedArchiveSize,
-  [Alias('InstallRoot')]
-  [string]$InstallDir,
-  [switch]$AllowUnsigned,
-  [switch]$NoModifyPath,
-  [switch]$Rollback,
-  [switch]$Uninstall
-)
-
-Set-StrictMode -Version 2.0
-$ErrorActionPreference = 'Stop'
-$ProgressPreference = 'SilentlyContinue'
-
-$Product = 'freecode-sh'
-$Target = 'windows-x64'
-$AssetName = 'freecode-windows-x64.zip'
-$LauncherRelativePath = 'bin/freecode.exe'
-$InterfaceRelativePath = 'libexec/freecode/freecode-tui.exe'
-$EngineRelativePath = 'libexec/freecode/freecode-engine.exe'
-$DefaultBaseUrl = 'https://releases.freecode.sh/releases'
-$DefaultChannelBaseUrl = 'https://releases.freecode.sh/channels'
-$ReleaseSigningModulusBase64 = '8so4sWArOV0GXihYvoSoxDLI1yMoILnVfCjYQwe4CKQ9EC10JV30cntMJZWXvXZS6STqQGIjyWisa6Op4nIdOuXKDjaEcQIeftgZBzzyGrMmAMC3W57VAi3d+w/F2XnkXBaH3NOphfftF6Fxt3Q02CxN3PjuuFaOGytKsYF5uDLCvEb+MpzJlD3HZoBzhhMCAoY6wmCdlgaDxD20UFdyEigF5wwpcUWpYmbYMFp+6SLe/Fi8IrYirwiCv5eLur6PzFFcwFrJgUeZAdxmGuM8eJzZlc7mK0+gzi8KpC2FZ9eOx1SafPE4An4+u8rZ7WA1Qk5eCAhNU9lm+JAeeKcCXzhQpPUafybJg75dIbIayOC3tf5mn+X+Vl5+uY19nT2qcJsjgUeIcqbMs9FGXiIA2G292N5WppyiDcx8yAIG6rOrAUGzHMYCrhvxQLAx2KP5QfC53VZ3La7yZOATY5icF78qSSBrKDrT42vinbosbX++Wr34YB6pXhiZF6jHPHrx'
-$ReleaseSigningExponentBase64 = 'AQAB'
-
-function Fail([string]$Message) {
-  throw "freecode installer: $Message"
-}
-
-function Get-EnvironmentValue([string]$Name) {
-  return [Environment]::GetEnvironmentVariable($Name, 'Process')
-}
-
-if (-not $Version) { $Version = Get-EnvironmentValue 'FREECODE_INSTALL_VERSION' }
-if (-not $Channel) {
-  $Channel = Get-EnvironmentValue 'FREECODE_INSTALL_CHANNEL'
-  if (-not $Channel) { $Channel = 'alpha' }
-}
-if (-not $BaseUrl) {
-  $BaseUrl = Get-EnvironmentValue 'FREECODE_INSTALL_BASE_URL'
-  if (-not $BaseUrl) { $BaseUrl = $DefaultBaseUrl }
-}
-if (-not $ChannelBaseUrl) {
-  $ChannelBaseUrl = Get-EnvironmentValue 'FREECODE_CHANNEL_BASE_URL'
-  if (-not $ChannelBaseUrl) { $ChannelBaseUrl = $DefaultChannelBaseUrl }
-}
-
-$testReleaseModulus = Get-EnvironmentValue 'FREECODE_TEST_RELEASE_PUBLIC_KEY_MODULUS'
-$testReleaseExponent = Get-EnvironmentValue 'FREECODE_TEST_RELEASE_PUBLIC_KEY_EXPONENT'
-if ($testReleaseModulus -or $testReleaseExponent) {
-  $testBaseUri = $null
-  if (
-    -not $testReleaseModulus -or
-    -not $testReleaseExponent -or
-    -not [Uri]::TryCreate($BaseUrl, [UriKind]::Absolute, [ref]$testBaseUri) -or
-    $testBaseUri.Scheme -ne 'http' -or
-    -not $testBaseUri.IsLoopback
-  ) {
-    Fail 'the test release key override is permitted only with a loopback HTTP release URL'
-  }
-  $ReleaseSigningModulusBase64 = $testReleaseModulus
-  $ReleaseSigningExponentBase64 = $testReleaseExponent
-}
-if (-not $InstallDir) {
-  $InstallDir = Get-EnvironmentValue 'FREECODE_INSTALL_ROOT'
-  if (-not $InstallDir) {
-    if (-not $env:LOCALAPPDATA) { Fail 'LOCALAPPDATA is required' }
-    $InstallDir = Join-Path $env:LOCALAPPDATA 'Freecode'
-  }
-}
-if ((Get-EnvironmentValue 'FREECODE_ALLOW_UNSIGNED_INSTALL') -eq 'true') {
-  $AllowUnsigned = $true
-}
-if ((Get-EnvironmentValue 'FREECODE_INSTALL_EMBEDDED') -eq 'true') {
-  $NoModifyPath = $true
-}
-
-$InstallDir = [IO.Path]::GetFullPath($InstallDir)
-$VersionsDir = Join-Path $InstallDir 'versions'
-$BinDir = Join-Path $InstallDir 'bin'
-$CurrentVersionPath = Join-Path $InstallDir 'current-version'
-$PreviousVersionPath = Join-Path $InstallDir 'previous-version'
-$MarkerPath = Join-Path $InstallDir '.freecode-install.json'
-$ShimPath = Join-Path $BinDir 'freecode.cmd'
-
-function Assert-SafeInstallRoot {
-  if ($InstallDir.IndexOfAny([char[]]@('"', '%', '!', "`r", "`n", ';')) -ge 0) {
-    Fail 'the install directory contains characters that cannot be represented safely in the command shim'
-  }
-  $comparison = [StringComparison]::OrdinalIgnoreCase
-  $driveRoot = [IO.Path]::GetPathRoot($InstallDir)
-  $unsafeRoots = @($driveRoot, $env:USERPROFILE, $env:LOCALAPPDATA) | Where-Object { $_ }
-  foreach ($unsafe in $unsafeRoots) {
-    if ([string]::Equals($InstallDir.TrimEnd('\'), ([IO.Path]::GetFullPath($unsafe)).TrimEnd('\'), $comparison)) {
-      Fail "refusing to use a broad install directory: $InstallDir"
-    }
-  }
-}
-
-function Assert-Version([string]$Value) {
-  if ($Value -notmatch '^\d+\.\d+\.\d+(-[0-9A-Za-z][0-9A-Za-z.-]*)?$') {
-    Fail "invalid release version: $Value"
-  }
-}
-
-function Assert-Channel([string]$Value) {
-  if ($Value -notmatch '^[0-9A-Za-z][0-9A-Za-z._-]*$') {
-    Fail "invalid release channel: $Value"
-  }
-}
-
-function Receive-File([string]$Uri, [string]$Destination) {
-  try {
-    Invoke-WebRequest -UseBasicParsing -Uri $Uri -OutFile $Destination
-  } catch {
-    Fail "could not download $Uri ($($_.Exception.Message))"
-  }
-}
-
-function Read-Json([string]$Path, [string]$Description) {
-  try {
-    return Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
-  } catch {
-    Fail "$Description is not valid JSON"
-  }
-}
-
-function Get-Sha256Hex([string]$Path) {
-  $stream = [IO.File]::OpenRead($Path)
-  $sha256 = [Security.Cryptography.SHA256]::Create()
-  try {
-    return ([BitConverter]::ToString($sha256.ComputeHash($stream))).Replace('-', '').ToLowerInvariant()
-  } finally {
-    $sha256.Dispose()
-    $stream.Dispose()
-  }
-}
-
-function Enter-InstallLock {
-  $normalizedInstallDir = $InstallDir.TrimEnd('\').ToUpperInvariant()
-  $sha256 = [Security.Cryptography.SHA256]::Create()
-  try {
-    $digest = $sha256.ComputeHash([Text.Encoding]::UTF8.GetBytes($normalizedInstallDir))
-  } finally {
-    $sha256.Dispose()
-  }
-  $mutexName = "Local\FreeCodeInstall-$(([BitConverter]::ToString($digest)).Replace('-', ''))"
-  $mutex = [Threading.Mutex]::new($false, $mutexName)
-  $acquired = $false
-  try {
-    try {
-      $acquired = $mutex.WaitOne(0)
-      if (-not $acquired) {
-        Write-Host 'Waiting for another Free Code setup to finish...'
-        $acquired = $mutex.WaitOne([TimeSpan]::FromMinutes(5))
-      }
-    } catch [Threading.AbandonedMutexException] {
-      $acquired = $true
-    }
-    if (-not $acquired) {
-      Fail 'timed out waiting for another Free Code setup to finish'
-    }
-    return $mutex
-  } catch {
-    $mutex.Dispose()
-    throw
-  }
-}
-
-function Exit-InstallLock([Threading.Mutex]$Mutex) {
-  try {
-    $Mutex.ReleaseMutex()
-  } finally {
-    $Mutex.Dispose()
-  }
-}
-
-function Assert-ReleaseManifestSignature([string]$ManifestPath, [string]$SignaturePath, [string]$Description) {
-  if (-not (Test-Path -LiteralPath $SignaturePath -PathType Leaf)) {
-    Fail "$Description does not have a valid Free Code release signature"
-  }
-  $rsa = [Security.Cryptography.RSA]::Create()
-  try {
-    $parameters = New-Object Security.Cryptography.RSAParameters
-    $parameters.Modulus = [Convert]::FromBase64String($ReleaseSigningModulusBase64)
-    $parameters.Exponent = [Convert]::FromBase64String($ReleaseSigningExponentBase64)
-    $rsa.ImportParameters($parameters)
-    $valid = $rsa.VerifyData(
-      [IO.File]::ReadAllBytes($ManifestPath),
-      [IO.File]::ReadAllBytes($SignaturePath),
-      [Security.Cryptography.HashAlgorithmName]::SHA256,
-      [Security.Cryptography.RSASignaturePadding]::Pkcs1
-    )
-  } catch {
-    $valid = $false
-  } finally {
-    $rsa.Dispose()
-  }
-  if (-not $valid) {
-    Fail "$Description does not have a valid Free Code release signature"
-  }
-}
-
-function Get-Asset($Manifest, [string]$Description) {
-  if (-not $Manifest.version) { Fail "$Description does not contain a version" }
-  if (-not $Manifest.assets) { Fail "$Description does not contain release assets" }
-  $property = $Manifest.assets.PSObject.Properties[$Target]
-  if (-not $property) { Fail "$Description does not contain a $Target asset" }
-  return $property.Value
-}
-
-function Assert-PayloadContract($Manifest, [string]$Description) {
-  $payload = $null
-  $payloads = Get-OptionalProperty $Manifest 'payloads'
-  if ($payloads) {
-    $targetPayload = $payloads.PSObject.Properties[$Target]
-    if ($targetPayload) { $payload = $targetPayload.Value }
-  }
-  if (-not $payload) { $payload = Get-OptionalProperty $Manifest 'payload' }
-  if (
-    -not $payload -or
-    [string](Get-OptionalProperty $payload 'launcher') -ne $LauncherRelativePath -or
-    [string](Get-OptionalProperty $payload 'interface') -ne $InterfaceRelativePath -or
-    [string](Get-OptionalProperty $payload 'engine') -ne $EngineRelativePath
-  ) {
-    Fail "$Description does not declare the expected $Target payload paths"
-  }
-}
-
-function Get-OptionalProperty($Object, [string]$Name) {
-  if (-not $Object) { return $null }
-  $property = $Object.PSObject.Properties[$Name]
-  if (-not $property) { return $null }
-  return $property.Value
-}
-
-function Test-UnsignedAsset($Security) {
-  return (Get-OptionalProperty $Security 'testUnsigned') -eq $true
-}
-
-function Assert-WindowsAssetSecurity($Asset, [string]$Description) {
-  $security = Get-OptionalProperty $Asset 'security'
-  if ($security -and (Test-UnsignedAsset $security)) {
-    if (-not $AllowUnsigned) {
-      Fail "$Description is an unsigned test artifact; rerun with -AllowUnsigned only on a trusted test PC"
-    }
-    return
-  }
-  if (
-    -not $security -or
-    $security.windowsAuthenticodeSigned -ne $true -or
-    $security.timestamped -ne $true -or
-    -not $security.publisher
-  ) {
-    Fail "$Description is not marked as Authenticode signed and timestamped"
-  }
-}
-
-function Assert-ZipPaths([string]$Archive, [string]$Destination) {
-  Add-Type -AssemblyName System.IO.Compression.FileSystem
-  $root = [IO.Path]::GetFullPath($Destination).TrimEnd('\') + '\'
-  $zip = [IO.Compression.ZipFile]::OpenRead($Archive)
-  try {
-    foreach ($entry in $zip.Entries) {
-      $name = $entry.FullName.Replace('\', '/')
-      if (
-        [string]::IsNullOrWhiteSpace($name) -or
-        $name.StartsWith('/') -or
-        $name -match '^[A-Za-z]:' -or
-        ($name.Split('/') -contains '..')
-      ) {
-        Fail "release archive contains an unsafe path: $name"
-      }
-      $destinationPath = [IO.Path]::GetFullPath((Join-Path $Destination $name))
-      if (-not $destinationPath.StartsWith($root, [StringComparison]::OrdinalIgnoreCase)) {
-        Fail "release archive escapes the staging directory: $name"
-      }
-    }
-  } finally {
-    $zip.Dispose()
-  }
-}
-
-function Get-RequiredExecutables([string]$Root) {
-  return @(
-    (Join-Path $Root $LauncherRelativePath),
-    (Join-Path $Root $InterfaceRelativePath),
-    (Join-Path $Root $EngineRelativePath)
-  )
-}
-
-function Assert-CompleteInstall([string]$Root) {
-  foreach ($executable in Get-RequiredExecutables $Root) {
-    if (-not (Test-Path -LiteralPath $executable -PathType Leaf)) {
-      Fail "release is missing required executable: $executable"
-    }
-  }
-}
-
-function Assert-BundleIntegrity([string]$Root, [string]$CandidateVersion) {
-  $bundlePath = Join-Path $Root 'libexec\freecode\bundle-manifest.json'
-  $bundle = Read-Json $bundlePath 'bundle manifest'
-  if ([string]$bundle.version -ne $CandidateVersion) {
-    Fail "bundle manifest version $($bundle.version) does not match $CandidateVersion"
-  }
-  if (-not $bundle.payload) { Fail 'bundle manifest does not contain payload checksums' }
-  $rootPrefix = [IO.Path]::GetFullPath($Root).TrimEnd('\') + '\'
-  foreach ($property in $bundle.payload.PSObject.Properties) {
-    $name = $property.Name.Replace('\', '/')
-    if ($name.StartsWith('/') -or $name -match '^[A-Za-z]:' -or ($name.Split('/') -contains '..')) {
-      Fail "bundle manifest contains an unsafe path: $name"
-    }
-    $path = [IO.Path]::GetFullPath((Join-Path $Root $name))
-    if (-not $path.StartsWith($rootPrefix, [StringComparison]::OrdinalIgnoreCase)) {
-      Fail "bundle manifest path escapes the install root: $name"
-    }
-    if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { Fail "bundle payload is missing $name" }
-    $actual = Get-Sha256Hex $path
-    if ($actual -ne [string]$property.Value) { Fail "bundle payload checksum failed for $name" }
-  }
-}
-
-function Assert-Signatures([string]$Root, $Security) {
-  if ((Test-UnsignedAsset $Security) -and $AllowUnsigned) {
-    Write-Warning 'Installing an unsigned draft Windows artifact for testing. Do not redistribute this build.'
-    return
-  }
-  foreach ($executable in Get-RequiredExecutables $Root) {
-    $signature = Get-AuthenticodeSignature -LiteralPath $executable
-    if ([string]$signature.Status -ne 'Valid') {
-      Fail "Authenticode verification failed for $executable ($($signature.Status))"
-    }
-    if (-not $signature.SignerCertificate -or $signature.SignerCertificate.Subject -ne $Security.publisher) {
-      $actual = if ($signature.SignerCertificate) { $signature.SignerCertificate.Subject } else { 'missing' }
-      Fail "unexpected Authenticode publisher for $executable (expected $($Security.publisher), received $actual)"
-    }
-    if (-not $signature.TimeStamperCertificate) {
-      Fail "trusted timestamp is missing from $executable"
-    }
-  }
-}
-
-function Write-TextAtomically([string]$Path, [string]$Text) {
-  $temporary = "$Path.$([Guid]::NewGuid().ToString('N')).tmp"
-  [IO.File]::WriteAllText($temporary, $Text, [Text.UTF8Encoding]::new($false))
-  if (Test-Path -LiteralPath $Path) {
-    $backup = "$Path.$([Guid]::NewGuid().ToString('N')).bak"
-    try {
-      [IO.File]::Replace($temporary, $Path, $backup, $true)
-    } finally {
-      Remove-Item -LiteralPath $backup -Force -ErrorAction SilentlyContinue
-      Remove-Item -LiteralPath $temporary -Force -ErrorAction SilentlyContinue
-    }
-  } else {
-    [IO.File]::Move($temporary, $Path)
-  }
-}
-
-function Write-CommandShim {
-  New-Item -ItemType Directory -Path $BinDir -Force | Out-Null
-  if ((Test-Path -LiteralPath $ShimPath) -and (Get-Item -LiteralPath $ShimPath).PSIsContainer) {
-    Fail "refusing to replace directory at $ShimPath"
-  }
-  $shim = @"
-@echo off
-setlocal
-set "FREECODE_VERSION="
-set /p FREECODE_VERSION=<"$CurrentVersionPath"
-if not defined FREECODE_VERSION (
-  echo Free Code is not activated. Re-run install.ps1. 1>&2
-  exit /b 1
-)
-"$VersionsDir\%FREECODE_VERSION%\bin\freecode.exe" %*
-"@
-  Write-TextAtomically $ShimPath ($shim -replace "`n", "`r`n")
-}
-
-function Move-StagedVersion([string]$Source, [string]$Destination) {
-  # Windows scanners can briefly hold a newly extracted executable open. Retry
-  # only the rename; never copy a partial version or relax payload verification.
-  for ($attempt = 0; $attempt -lt 21; $attempt++) {
-    try {
-      [IO.Directory]::Move($Source, $Destination)
-      return
-    } catch [IO.IOException], [UnauthorizedAccessException] {
-      if ($attempt -eq 20 -or (Test-Path -LiteralPath $Destination)) { throw }
-      if ($attempt -eq 0) { Write-Host 'Waiting for Windows to release the installation files...' }
-      Start-Sleep -Milliseconds 250
-    }
-  }
-}
-
-function Set-UserPath([bool]$Add) {
-  $userPath = [Environment]::GetEnvironmentVariable('Path', 'User')
-  $entries = @($userPath -split ';' | Where-Object { $_ })
-  $comparison = [StringComparer]::OrdinalIgnoreCase
-  $matches = @($entries | Where-Object { $comparison.Equals($_.TrimEnd('\'), $BinDir.TrimEnd('\')) })
-  if ($Add) {
-    if ($matches.Count -eq 0) {
-      $updated = (@($entries) + $BinDir) -join ';'
-      [Environment]::SetEnvironmentVariable('Path', $updated, 'User')
-      Write-Host "Added $BinDir to your user PATH."
-    }
-    if (-not (@($env:Path -split ';') | Where-Object { $comparison.Equals($_.TrimEnd('\'), $BinDir.TrimEnd('\')) })) {
-      $env:Path = "$BinDir;$env:Path"
-    }
-  } elseif ($matches.Count -gt 0) {
-    $updated = @($entries | Where-Object { -not $comparison.Equals($_.TrimEnd('\'), $BinDir.TrimEnd('\')) }) -join ';'
-    [Environment]::SetEnvironmentVariable('Path', $updated, 'User')
-  }
-}
-
-function Test-VersionHealth([string]$CandidateVersion) {
-  $launcher = Join-Path (Join-Path $VersionsDir $CandidateVersion) $LauncherRelativePath
-  $versionOutput = @(& $launcher --version 2>&1)
-  $versionExit = $LASTEXITCODE
-  $versionOutput | ForEach-Object { Write-Host $_ }
-  if ($versionExit -ne 0 -or $versionOutput.Count -eq 0 -or [string]$versionOutput[0] -ne "freecode-sh $CandidateVersion") {
-    return $false
-  }
-  $doctorOutput = @(& $launcher doctor 2>&1)
-  $doctorExit = $LASTEXITCODE
-  $doctorOutput | ForEach-Object { Write-Host $_ }
-  return $doctorExit -eq 0
-}
-
-function Invoke-Uninstall {
-  if (-not (Test-Path -LiteralPath $MarkerPath -PathType Leaf)) {
-    Fail "refusing to remove an unrecognized directory without $MarkerPath"
-  }
-  $marker = Read-Json $MarkerPath 'install marker'
-  if ($marker.product -ne $Product -or $marker.installDir -ne $InstallDir) {
-    Fail 'install marker does not match this Free Code installation'
-  }
-  if (-not $NoModifyPath) { Set-UserPath $false }
-  Remove-Item -LiteralPath $InstallDir -Recurse -Force
-  Write-Host "Free Code was removed from $InstallDir."
-}
-
-function Invoke-Rollback {
-  if (-not (Test-Path -LiteralPath $PreviousVersionPath -PathType Leaf)) {
-    Fail 'there is no previous Free Code version to restore'
-  }
-  $previous = (Get-Content -LiteralPath $PreviousVersionPath -Raw).Trim()
-  Assert-Version $previous
-  $previousRoot = Join-Path $VersionsDir $previous
-  Assert-CompleteInstall $previousRoot
-  Assert-BundleIntegrity $previousRoot $previous
-  $metadataPath = Join-Path $previousRoot 'release-metadata.json'
-  $metadata = Read-Json $metadataPath 'stored release metadata'
-  Assert-WindowsAssetSecurity $metadata.asset 'stored release metadata'
-  Assert-Signatures $previousRoot $metadata.asset.security
-  $current = if (Test-Path -LiteralPath $CurrentVersionPath) { (Get-Content -LiteralPath $CurrentVersionPath -Raw).Trim() } else { '' }
-  Write-TextAtomically $CurrentVersionPath "$previous`n"
-  if (-not (Test-VersionHealth $previous)) {
-    if ($current) { Write-TextAtomically $CurrentVersionPath "$current`n" }
-    Fail 'the previous version failed its health check; activation was restored'
-  }
-  if ($current) { Write-TextAtomically $PreviousVersionPath "$current`n" }
-  Write-CommandShim
-  Write-Host "Rolled back Free Code to $previous."
-}
-
-Assert-SafeInstallRoot
-Assert-Channel $Channel
-
-$localInputs = @(@($ArchivePath, $ChecksumPath, $ManifestPath) | Where-Object { $_ })
-if ($localInputs.Count -ne 0 -and $localInputs.Count -ne 3) {
-  Fail '-ArchivePath, -ChecksumPath, and -ManifestPath must be provided together'
-}
-if ($localInputs.Count -eq 3 -and -not $Version) {
-  Fail '-Version is required when installing local candidate files'
-}
-
-if ($Uninstall -and $Rollback) { Fail '-Uninstall and -Rollback cannot be used together' }
-if ($Uninstall) {
-  $operationMutex = Enter-InstallLock
-  try {
-    Invoke-Uninstall
-  } finally {
-    Exit-InstallLock $operationMutex
-  }
-  exit 0
-}
-if ($Rollback) {
-  $operationMutex = Enter-InstallLock
-  try {
-    Invoke-Rollback
-  } finally {
-    Exit-InstallLock $operationMutex
-  }
-  exit 0
-}
-
-$architecture = if ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } else { $env:PROCESSOR_ARCHITECTURE }
-if ($architecture -ne 'AMD64') {
-  Fail "this beta supports only Windows x64 (detected $architecture)"
-}
-
-# Windows PowerShell 5.1 may otherwise negotiate an obsolete TLS version.
-if ([Net.ServicePointManager]::SecurityProtocol -band [Net.SecurityProtocolType]::Tls12) {
-  [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
-} else {
-  [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
-}
-
-$BaseUrl = $BaseUrl.TrimEnd('/')
-$ChannelBaseUrl = $ChannelBaseUrl.TrimEnd('/')
-$TemporaryDir = Join-Path ([IO.Path]::GetTempPath()) "freecode-install-$([Guid]::NewGuid().ToString('N'))"
-$StageDir = $null
-$InstallMutex = $null
-New-Item -ItemType Directory -Path $TemporaryDir -Force | Out-Null
-
-try {
-  if (-not $Version) {
-    $channelPath = Join-Path $TemporaryDir 'channel.json'
-    $channelSignaturePath = Join-Path $TemporaryDir 'channel.json.sig'
-    Write-Host "Resolving Free Code channel $Channel..."
-    Receive-File "$ChannelBaseUrl/$Channel.json" $channelPath
-    Receive-File "$ChannelBaseUrl/$Channel.json.sig" $channelSignaturePath
-    Assert-ReleaseManifestSignature $channelPath $channelSignaturePath "channel $Channel"
-    $channelManifest = Read-Json $channelPath "channel $Channel"
-    if ($channelManifest.channel -ne $Channel) { Fail "channel manifest identifies $($channelManifest.channel), expected $Channel" }
-    Assert-PayloadContract $channelManifest "channel $Channel"
-    $channelAsset = Get-Asset $channelManifest "channel $Channel"
-    Assert-WindowsAssetSecurity $channelAsset "channel $Channel"
-    $Version = [string]$channelManifest.version
-  }
-  Assert-Version $Version
-
-  $downloadedArchivePath = Join-Path $TemporaryDir $AssetName
-  $downloadedChecksumPath = "$downloadedArchivePath.sha256"
-  $downloadedManifestPath = Join-Path $TemporaryDir 'release-manifest.json'
-  $downloadedSignaturePath = "$downloadedManifestPath.sig"
-  if ($localInputs.Count -eq 3) {
-    Write-Host "Loading local Free Code $Version candidate files..."
-    Copy-Item -LiteralPath ([IO.Path]::GetFullPath($ArchivePath)) -Destination $downloadedArchivePath
-    Copy-Item -LiteralPath ([IO.Path]::GetFullPath($ChecksumPath)) -Destination $downloadedChecksumPath
-    Copy-Item -LiteralPath ([IO.Path]::GetFullPath($ManifestPath)) -Destination $downloadedManifestPath
-    $localSignaturePath = "$([IO.Path]::GetFullPath($ManifestPath)).sig"
-    if (Test-Path -LiteralPath $localSignaturePath -PathType Leaf) {
-      Copy-Item -LiteralPath $localSignaturePath -Destination $downloadedSignaturePath
-    }
-  } else {
-    $releaseRoot = "$BaseUrl/v$Version"
-    Write-Host "Downloading Free Code $Version for Windows x64..."
-    Receive-File "$releaseRoot/$AssetName" $downloadedArchivePath
-    Receive-File "$releaseRoot/$AssetName.sha256" $downloadedChecksumPath
-    Receive-File "$releaseRoot/release-manifest.json" $downloadedManifestPath
-    Receive-File "$releaseRoot/release-manifest.json.sig" $downloadedSignaturePath
-  }
-
-  $manifest = Read-Json $downloadedManifestPath "release $Version"
-  $asset = Get-Asset $manifest "release $Version"
-  $localUnsignedOverride = $localInputs.Count -eq 3 -and $AllowUnsigned -and (Test-UnsignedAsset $asset.security)
-  if (-not $localUnsignedOverride) {
-    Assert-ReleaseManifestSignature $downloadedManifestPath $downloadedSignaturePath "release $Version"
-  }
-  if ([string]$manifest.version -ne $Version) {
-    Fail "release manifest version $($manifest.version) does not match requested version $Version"
-  }
-  if ($manifest.channel -ne $Channel) { Fail "release manifest channel $($manifest.channel) does not match $Channel" }
-  Assert-PayloadContract $manifest "release $Version"
-  Assert-WindowsAssetSecurity $asset "release $Version"
-  if ($asset.archive -ne $AssetName) { Fail "release manifest names unexpected asset $($asset.archive)" }
-  if ($ExpectedArchiveSha256 -and [string]$asset.sha256 -ne $ExpectedArchiveSha256) {
-    Fail 'release archive checksum does not match the signed update channel'
-  }
-  if ($ExpectedArchiveSize -and ([long]$asset.size -ne $ExpectedArchiveSize -or (Get-Item -LiteralPath $downloadedArchivePath).Length -ne $ExpectedArchiveSize)) {
-    Fail 'release archive size does not match the signed update channel'
-  }
-
-  $checksumLine = (Get-Content -LiteralPath $downloadedChecksumPath | Select-Object -First 1)
-  if ($checksumLine -notmatch '^([a-fA-F0-9]{64})\s{1,2}(\*?)([^\s]+)$') {
-    Fail 'release checksum file is malformed'
-  }
-  $expectedChecksum = $Matches[1].ToLowerInvariant()
-  if ($Matches[3] -ne $AssetName) { Fail "checksum file names unexpected asset $($Matches[3])" }
-  if ([string]$asset.sha256 -ne $expectedChecksum) { Fail 'release manifest and checksum file disagree' }
-  $actualChecksum = Get-Sha256Hex $downloadedArchivePath
-  if ($actualChecksum -ne $expectedChecksum) { Fail "checksum verification failed for $AssetName" }
-
-  $InstallMutex = Enter-InstallLock
-  if ($ExpectedCurrentVersion) {
-    $activeVersion = if (Test-Path -LiteralPath $CurrentVersionPath) { (Get-Content -LiteralPath $CurrentVersionPath -Raw).Trim() } else { '' }
-    if ($activeVersion -ne $ExpectedCurrentVersion -and $activeVersion -ne $Version) {
-      Fail 'the active installation changed during the update; retry with the current version'
-    }
-  }
-  New-Item -ItemType Directory -Path $VersionsDir -Force | Out-Null
-  $versionRoot = Join-Path $VersionsDir $Version
-  $newInstall = -not (Test-Path -LiteralPath $versionRoot)
-  if ($newInstall) {
-    $StageDir = Join-Path $InstallDir ".install-$Version-$([Guid]::NewGuid().ToString('N'))"
-    New-Item -ItemType Directory -Path $StageDir -Force | Out-Null
-    Assert-ZipPaths $downloadedArchivePath $StageDir
-    [IO.Compression.ZipFile]::ExtractToDirectory($downloadedArchivePath, $StageDir)
-    Assert-CompleteInstall $StageDir
-    Assert-BundleIntegrity $StageDir $Version
-    Assert-Signatures $StageDir $asset.security
-    @{
-      schemaVersion = 1
-      product = $Product
-      version = $Version
-      asset = $asset
-    } | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath (Join-Path $StageDir 'release-metadata.json') -Encoding UTF8
-    Move-StagedVersion $StageDir $versionRoot
-    $StageDir = $null
-  } else {
-    Assert-CompleteInstall $versionRoot
-    Assert-BundleIntegrity $versionRoot $Version
-    $storedMetadata = Read-Json (Join-Path $versionRoot 'release-metadata.json') 'stored release metadata'
-    if (
-      [string]$storedMetadata.version -ne $Version -or
-      [string]$storedMetadata.asset.sha256 -ne [string]$asset.sha256 -or
-      [string](Get-OptionalProperty $storedMetadata.asset.security 'publisher') -ne [string](Get-OptionalProperty $asset.security 'publisher') -or
-      [bool](Test-UnsignedAsset $storedMetadata.asset.security) -ne [bool](Test-UnsignedAsset $asset.security)
-    ) {
-      Fail "existing version metadata does not match the verified release manifest for $Version"
-    }
-    Assert-Signatures $versionRoot $asset.security
-  }
-
-  New-Item -ItemType Directory -Path $BinDir -Force | Out-Null
-  @{
-    schemaVersion = 1
-    product = $Product
-    installDir = $InstallDir
-    binDir = $BinDir
-  } | ConvertTo-Json | Set-Content -LiteralPath $MarkerPath -Encoding UTF8
-
-  $previous = if (Test-Path -LiteralPath $CurrentVersionPath) { (Get-Content -LiteralPath $CurrentVersionPath -Raw).Trim() } else { '' }
-  if ($previous -and $previous -ne $Version) { Write-TextAtomically $PreviousVersionPath "$previous`n" }
-  Write-TextAtomically $CurrentVersionPath "$Version`n"
-  Write-CommandShim
-
-  if (-not (Test-VersionHealth $Version)) {
-    if ($previous) {
-      Write-TextAtomically $CurrentVersionPath "$previous`n"
-    } else {
-      Remove-Item -LiteralPath $CurrentVersionPath -Force -ErrorAction SilentlyContinue
-    }
-    if ($newInstall) { Remove-Item -LiteralPath $versionRoot -Recurse -Force -ErrorAction SilentlyContinue }
-    Fail 'Free Code health checks failed; restored the previous activation'
-  }
-
-  if (-not $NoModifyPath) { Set-UserPath $true }
-  Write-Host ''
-  Write-Host "Free Code $Version installed successfully."
-  Write-Host "Command: $ShimPath"
-  Write-Host 'Open a new terminal, then run: freecode doctor'
-} finally {
-  if ($StageDir -and (Test-Path -LiteralPath $StageDir)) {
-    Remove-Item -LiteralPath $StageDir -Recurse -Force -ErrorAction SilentlyContinue
-  }
-  if ($InstallMutex) {
-    Exit-InstallLock $InstallMutex
-  }
-  Remove-Item -LiteralPath $TemporaryDir -Recurse -Force -ErrorAction SilentlyContinue
-}