From e04c8639d7d87f8b2285fd62db6d1463d3882aa2 Mon Sep 17 00:00:00 2001
From: freelw <“freelw81@qq.com“>
Date: Thu, 13 Aug 2026 09:51:51 +0800
Subject: [PATCH] Fix Windows PowerShell bootstrap downloads

---
 .github/workflows/ci.yml                      | 12 +++++++++
 .../lexmount-webfetch/scripts/bootstrap.ps1   | 27 +++++++++++++++++--
 2 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8e319b8..4b0b4ce 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -60,3 +60,15 @@ jobs:
           unzip -Z1 dist/lexmount-webfetch.zip | grep -qx 'SKILL.md'
           ! unzip -Z1 dist/lexmount-webfetch.zip | grep -q '^lexmount-webfetch/'
           ! unzip -Z1 dist/lexmount-webfetch.zip | grep -q '^bin/'
+
+  windows-bootstrap:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: Bootstrap from COS with Windows PowerShell 5.1
+        shell: powershell
+        run: |
+          if ($PSVersionTable.PSVersion.Major -ne 5) { throw "Expected Windows PowerShell 5.1" }
+          $env:LEXMOUNT_WEBFETCH_CLI_INSTALL_DIR = Join-Path $env:RUNNER_TEMP "webfetch-cli-bootstrap"
+          & .\skills\lexmount-webfetch\scripts\bootstrap.ps1
+          & (Join-Path $env:LEXMOUNT_WEBFETCH_CLI_INSTALL_DIR "webfetch-cli.exe") version
diff --git a/skills/lexmount-webfetch/scripts/bootstrap.ps1 b/skills/lexmount-webfetch/scripts/bootstrap.ps1
index 0920129..7aa75dc 100644
--- a/skills/lexmount-webfetch/scripts/bootstrap.ps1
+++ b/skills/lexmount-webfetch/scripts/bootstrap.ps1
@@ -1,4 +1,17 @@
 $ErrorActionPreference = "Stop"
+
+function Invoke-Tls12Download {
+  param(
+    [Parameter(Mandatory = $true)][string]$Uri,
+    [Parameter(Mandatory = $true)][string]$OutFile
+  )
+  try {
+    Invoke-WebRequest -UseBasicParsing -Uri $Uri -OutFile $OutFile
+  } catch {
+    throw "Failed to download $Uri with TLS 1.2 enabled: $($_.Exception.Message)"
+  }
+}
+
 $version = if ($env:LEXMOUNT_WEBFETCH_CLI_VERSION) { $env:LEXMOUNT_WEBFETCH_CLI_VERSION } else { "0.1.1" }
 $downloadBaseUrl = if ($env:LEXMOUNT_WEBFETCH_CLI_DOWNLOAD_BASE_URL) { $env:LEXMOUNT_WEBFETCH_CLI_DOWNLOAD_BASE_URL.TrimEnd('/') } else { "https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/webfetch-cli" }
 $architecture = if ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } else { $env:PROCESSOR_ARCHITECTURE }
@@ -8,8 +21,18 @@ $repo = "$downloadBaseUrl/v$version"
 $tmp = Join-Path ([IO.Path]::GetTempPath()) ([Guid]::NewGuid().ToString())
 New-Item -ItemType Directory -Path $tmp | Out-Null
 try {
-  Invoke-WebRequest -UseBasicParsing "$repo/$asset" -OutFile (Join-Path $tmp $asset)
-  Invoke-WebRequest -UseBasicParsing "$repo/SHA256SUMS" -OutFile (Join-Path $tmp "SHA256SUMS")
+  $previousSecurityProtocol = [Net.ServicePointManager]::SecurityProtocol
+  try {
+    [Net.ServicePointManager]::SecurityProtocol = $previousSecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
+  } catch {
+    throw "Failed to enable TLS 1.2 for COS downloads: $($_.Exception.Message)"
+  }
+  try {
+    Invoke-Tls12Download "$repo/$asset" (Join-Path $tmp $asset)
+    Invoke-Tls12Download "$repo/SHA256SUMS" (Join-Path $tmp "SHA256SUMS")
+  } finally {
+    [Net.ServicePointManager]::SecurityProtocol = $previousSecurityProtocol
+  }
   # GNU sha256sum prefixes binary filenames with `*`; shasum uses plain whitespace.
   $line = Get-Content (Join-Path $tmp "SHA256SUMS") | Where-Object { $_ -match "\s+\*?$([regex]::Escape($asset))$" } | Select-Object -First 1
   if (-not $line) { throw "No checksum published for $asset" }