Skip to content

Conversation

@GabiNun
Copy link
Contributor

@GabiNun GabiNun commented Dec 23, 2025

Using -UseBasicParsing makes it so it dosen't ask you to confirm execution, and you dont need the other things choco already dose them for you

Copy link
Contributor

@Real-MullaC Real-MullaC left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should kept in a try catch just so if there is any issues with it installing it will say.

@GabiNun
Copy link
Contributor Author

GabiNun commented Jan 5, 2026

@Real-MullaC ye but the catch message dosen't do anything anyway

Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR simplifies the Chocolatey installation function by using -UseBasicParsing with Invoke-WebRequest and removing manual setup steps that Chocolatey's installation script already handles.

Key Changes:

  • Removed try-catch error handling block
  • Removed manual execution policy and security protocol configuration
  • Simplified installation to a single Invoke-WebRequest command with -UseBasicParsing piped to Invoke-Expression

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.



Write-Host "Chocolatey is not installed, installing now."
Invoke-WebRequest https://community.chocolatey.org/install.ps1 -UseBasicParsing | Invoke-Expression
Copy link

Copilot AI Jan 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The line Invoke-WebRequest https://community.chocolatey.org/install.ps1 -UseBasicParsing | Invoke-Expression downloads and immediately executes a remote PowerShell script without any integrity or authenticity verification beyond basic TLS, creating a supply-chain RCE risk if the Chocolatey host, DNS, or a trusted CA is compromised. An attacker who can tamper with responses from community.chocolatey.org could execute arbitrary code with the privileges of this script during installation. To mitigate, avoid the curl | IEX pattern by downloading the installer to disk, verifying a strong checksum/signature or pinning to a trusted hash/version, and only then executing the verified script.

Copilot uses AI. Check for mistakes.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants