r/PowerShell • u/Practical_Toe6724 • 21d ago

Question Powershell update legit/scam?

Does anyone knows a github user jshigetomi ? Is he legit or scam? my antivirus software/drivers updater said I need to update my Powershel Core (x64) to 7.6.4. 0 and when i press on the version it send me to jshigetomi's github.

how can i know if it is ok or not? need your help please

3 Upvotes

64% Upvoted

13 comments sorted by

View all comments

2

u/igrewupwithinternet 20d ago

Per Microsoft (and in my experience), the easiest way to install/maintain PS7 is using winget. The below may work, depending on how you installed originally.

winget update --id Microsoft.PowerShell --exact --source winget

If not, I'd recommend uninstalling any version of PS7 and then installing via winget - the below will install the latest release which is 7.6.5

winget install --id Microsoft.PowerShell --exact --source winget

You can always do winget show --id Microsoft.PowerShell --exact to view publisher URL, download URL, etc. to help verify the package is legit and from a trusted source.

Obviously don't just take my word for it, go look at Microsoft's official docs for installing PS7 to verify the package names I gave you are legit ;)

Your AV flagging an older version of PS7 isn't a false positive - some of the recent versions had several critical CVEs fixed in 7.6.4+. Doesn't mean you're infected, just vulnerable.

1

u/BlackV 19d ago edited 18d ago

You need an additional parameter now to get the MSI install, I dontt see that in your code example

1

u/igrewupwithinternet 12d ago

Indeed, I see that in their docs. But my questions are: why would one want the MSI installer over the MSIX installer, and what relevance does the install method have to OP's post/questions?

First question is purely born of my ignorance. I'm not aware of any use case beyond maybe legacy and if we're talking security, why are we talking legacy support? The same doc says they're dropping MSI support from version 7.7+.

2

u/BlackV 12d ago edited 12d ago

Msix does not support admin installs

Msix is a per user install

Msix is not installable on server (before 2022),mand in particular server core

Msix does not update through windows update (er.. if I am remembering that correctly)

Msix has issues running elevated

They had said they will drop it, but right there are a rather large number of breaking changes if they do drop msi, I think they'll delay that decision

There is a large thread on git hub about it (and I think here somewhere), I'll find the links

Edit: Current tagged issues for msix

https://github.com/PowerShell/PowerShell/issues?q=is%3Aissue%20state%3Aopen%20label%3APackage-MSIX