[Bug]: MSI with Constrained Language Mode

[AdamJParker]

The problem

Pushing MSI from Intune, so its as managed installer is allowing past WDAC, but constrained language mode seems to be an issue with as DotSource is not supported.

WixQuietExec: C:\Program Files\Winget-AutoUpdate\config\WAU-MSI_Actions.ps1 : Cannot dot-source this command because it was defined
WixQuietExec: in a different language mode. To invoke this command without importing its contents, omit the '.' operator.
WixQuietExec: + CategoryInfo : InvalidOperation: (:) , NotSupportedException
WixQuietExec: + FullyQualifiedErrorId : DotSourceNotSupported,WAU-MSI_Actions.ps1
WixQuietExec:
WixQuietExec: Error 0x80070001: Command line returned an error.
WixQuietExec: Error 0x80070001: QuietExec Failed
WixQuietExec: Error 0x80070001: Failed in ExecCommon method
CustomAction CA_PowerShell_Install returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)

What version of WAU has the issue?

2.9.1

What version of Windows are you using (ex. Windows 11 22H2)?

No response

What version of winget are you using?

v1.12.440

Log information

Additional information

No response

[AdamJParker]

No one else having this issue ?

[Romanitho]

nope sorry :/

[KnifMelti]

We (at my work) don't use Constrained Language Mode and I haven't heard about anyone in Skåne (the most southern part of Sverige) using it.
But what do I know...

[AdamJParker]

WUA Msi install fails under WDAC/UMCI because PowerShell is running in ConstrainedLanguage and blocks dot-sourcing
On devices where WDAC/UMCI is enabled, powershell.exe runs as ConstrainedLanguage even as SYSTEM (e.g. $ExecutionContext.SessionState.LanguageMode = ConstrainedLanguage).
In this mode, WAU’s scripts fail because they heavily rely on dot-sourcing (e.g. Get-ChildItem .\functions*.ps1 | ForEach-Object { . $_.FullName } in Winget-Upgrade.ps1, plus dot-sourcing in WAU-Policies.ps1, Winget-Install.ps1, etc.).
This results in DotSourceNotSupported errors and prevents scheduled tasks / upgrades from functioning, even when the scripts are properly signed and allowed by WDAC.

Suggested fix: eliminate dot-sourcing to support CLM environments. The common pattern is to ship WAU functions as a proper PowerShell module (single signed .psm1) and replace dot-sourcing blocks with Import-Module, or alternatively generate a single self-contained script during build/release that inlines required functions. For task creation, avoiding COM (New-Object -ComObject Schedule.Service) and using schtasks.exe can further improve compatibility with CLM.

[timmargieson]

also having this issue with the latest version (2.10.0) we have constrained language mode enabled and have had to put an exception in to allow the install

[KnifMelti]

So, @timmargieson creates an exception to allow installing.. ..how about running then?
According to @AdamJParker running it also fails due to dot-sourcing.

[timmargieson]

still having issues with the install even with exceptions added to applocker
Log name; Microsoft-Windows Applocker/MSI and Script
eventid 8028
C:\Program Files\Winget-AutoUpdate\config\WAU-MSI_Actions.ps1 was allowed to run but would have been prevented if the Config CI policy were enforced.

however the log for the installer still reports it is in CLM