Skip to content
fuck-powershell

Execution policy blocks your downloaded installer — irm | iex is the workaround, not a style choice

ci agents · case

5.1hard-errorinteractivescriptfirst-partyrepro: verifiedexecution-policy-gate
Affectspowershell 51, windows
Fails asPSSECURITYEXCEPTION
Mechanismexecution policy gate
Safe fixirm iex

Symptom

Section titled “Symptom”

A user downloads install.ps1 and runs it. Windows PowerShell refuses: “running scripts is disabled on this system” (PSSecurityException, UnauthorizedAccess). The same content pasted into the terminal runs fine — confusing everyone.

Repro

Section titled “Repro”
Terminal window
# Default Windows PowerShell policy is Restricted (client SKUs):
powershell -File .\install.ps1
# File ... cannot be loaded because running scripts is disabled on this system.

Cause

Section titled “Cause”

Execution policy gates SCRIPT FILES, not commands: -File and .ps1 dispatch are blocked under Restricted/AllSigned (and unsigned downloads under RemoteSigned via Mark-of-the-Web), while in-memory text execution is not. That asymmetry is why installer one-liners are irm URL | iex — piping text into the session bypasses file policy. It is a distribution constraint, not slop.

Workaround

Section titled “Workaround”
  • Distribute the documented entrypoint as irm <url> | iex (and then follow irm-iex-kills-host: the script must throw, never exit).
  • For local runs, powershell -ExecutionPolicy Bypass -File install.ps1 scopes the override to one process — do not change machine policy.
  • CI runners set Bypass for shell: powershell/pwsh already; this trap bites end-user machines, not Actions.

Refs

Section titled “Refs”