PowerShell installer for .NET, Visual C++ and DirectX that bundles no binaries and resolves every download from Microsoft at run time

Rebuilt an old batch project of mine in PowerShell. It installs the .NET SDKs, the Visual C++ redistributables (current v14 plus the final 2005-2013 ones) and the June 2010 DirectX runtimes. Nothing is bundled and there are no hardcoded download URLs, so it locates everything on Microsoft's own hosts every run, then verifies each file before it executes.

Every discovery page and every payload URL goes through a check like this before anything gets fetched:

function Test-AllowedMicrosoftDiscoveryUri { [CmdletBinding()] [OutputType([bool])] param( [Parameter(Mandatory = $true)] [string]$Uri ) try { $parsedUri = [uri]$Uri if (-not $parsedUri.IsAbsoluteUri) { return $false } if ($parsedUri.Scheme -cne 'https') { return $false } if ($parsedUri.Port -ne 443) { return $false } if (-not [string]::IsNullOrEmpty($parsedUri.UserInfo)) { return $false } return $parsedUri.DnsSafeHost -match $script:AllowedMicrosoftDiscoveryHostPattern } catch { return $false } } 

Discovery pages and payloads use two separate host allowlists, so allowing a docs host never authorizes an executable coming from it. curl's reported effective URL gets checked the same way after redirects.

Verification depends on what Microsoft actually publishes. The .NET SDKs have a SHA-512 in the release metadata. The final 2005-2013 and DirectX packages never change, so those are pinned to SHA-256 values I checked by hand. The rolling v14 redistributable has no published hash at all, so that one gets Authenticode plus a version floor read out of the signed file. Nothing installs until the whole selected set has resolved, and a file that fails verification gets deleted even if you asked to keep the downloads.

Windows PowerShell 5.1 compatible, uses pwsh if it's in PATH. Source and usage notes:

slyfox1186/msft-visual-c-and-directx-offline-installer