mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 18:45:53 +00:00
rcourtman
2541e4b6a7
install.ps1 set ServicePointManager's certificate callback to a PowerShell scriptblock. ServicePointManager can invoke that callback on a worker thread that has no runspace, where a scriptblock delegate fails closed, so agent downloads died with a TLS error even though the certificate policy would have accepted them (hit by an rc.6 tester with Skip TLS verification enabled). The copied install command already migrated to a compiled validator for exactly this reason in rc.6; the downloaded script now does the same. Validation policy is unchanged, with fingerprint pinning first, then insecure, then clean chains, then the custom CA. Verified with pwsh covering all four policy branches plus the callback running on a runspace-free worker thread. Contract-Neutral: installer TLS callback implementation moved to a compiled type; same validation policy, no payload or endpoint change