From 42b40bc0998e18192cc3b0d1e620ef1c8b5a9c08 Mon Sep 17 00:00:00 2001
From: "claude@clouddev1" <claude-clouddev1@oliversturm.ch>
Date: Fri, 19 Jun 2026 14:22:28 +0000
Subject: [PATCH] fix(install): make install.ps1 work on Windows PowerShell 5.1

The in-box Windows shell (5.1, .NET Framework) is the baseline we must
support; PowerShell 7 is an opt-in install most users don't have.

- arch detection: read PROCESSOR_ARCHITECTURE/ARCHITEW6432 from the
  environment instead of RuntimeInformation::OSArchitecture, which
  resolves from a .NET Framework facade lacking that property under 5.1
  and throws under StrictMode (the reported failure).
- force TLS 1.2 before any web request (5.1 may default to TLS 1.0/1.1).
- pass -UseBasicParsing to Invoke-WebRequest (5.1 otherwise uses the IE
  engine and can fail when it is absent).

All three are no-ops on PowerShell 7. Relates to ADR-0055.
---
 scripts/install.ps1 | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/scripts/install.ps1 b/scripts/install.ps1
index b2ffe2c..6a9228d 100644
--- a/scripts/install.ps1
+++ b/scripts/install.ps1
@@ -37,15 +37,30 @@ param(
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
+# Windows PowerShell 5.1 (the in-box shell) can negotiate only TLS 1.0/1.1 by
+# default, which modern hosts reject. Opt into TLS 1.2 without disturbing any
+# protocols already enabled. (No-op on PowerShell 7.)
+[Net.ServicePointManager]::SecurityProtocol =
+    [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
+
 $Repo = 'https://git.lazyeval.net/oli/rdbms-playground'
 $Api = 'https://git.lazyeval.net/api/v1/repos/oli/rdbms-playground'
 $Bin = 'rdbms-playground'
 
 # Map the host CPU to the target triple we publish for Windows.
-$osArch = [System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture
+# Read the architecture from the environment rather than
+# RuntimeInformation::OSArchitecture: under Windows PowerShell 5.1 that type
+# resolves from a .NET Framework facade that lacks OSArchitecture, which (with
+# StrictMode) throws "property cannot be found". PROCESSOR_ARCHITECTURE is set
+# on every PowerShell version; PROCESSOR_ARCHITEW6432 reports the true OS
+# architecture when a 32-bit shell runs under WOW64.
+$osArch = [Environment]::GetEnvironmentVariable('PROCESSOR_ARCHITEW6432')
+if (-not $osArch) {
+    $osArch = [Environment]::GetEnvironmentVariable('PROCESSOR_ARCHITECTURE')
+}
 switch ($osArch) {
-    'X64' { $target = 'x86_64-pc-windows-gnu' }
-    'Arm64' { $target = 'aarch64-pc-windows-gnullvm' }
+    'AMD64' { $target = 'x86_64-pc-windows-gnu' }
+    'ARM64' { $target = 'aarch64-pc-windows-gnullvm' }
     default { throw "install: unsupported CPU architecture: $osArch" }
 }
 
@@ -65,8 +80,11 @@ try {
     $shaFile = "$exe.sha256"
 
     Write-Host "downloading $asset ..."
-    Invoke-WebRequest -Uri $url -OutFile $exe
-    Invoke-WebRequest -Uri "$url.sha256" -OutFile $shaFile
+    # -UseBasicParsing: Windows PowerShell 5.1's Invoke-WebRequest otherwise
+    # tries to use the Internet Explorer engine and can fail when it is absent.
+    # (No-op on PowerShell 7.)
+    Invoke-WebRequest -UseBasicParsing -Uri $url -OutFile $exe
+    Invoke-WebRequest -UseBasicParsing -Uri "$url.sha256" -OutFile $shaFile
 
     # The sidecar is "<hash>  <name>"; compare just the hash.
     $expected = ((Get-Content -Raw $shaFile) -split '\s+')[0].ToLower()