Re:Preparing Windows Server Technical Preview for Windows Co...
by revelation on Wednesday August 19, 2015 @06:33PM
(#10089014)
As you note, the redirect breaks all benefits of HTTPS. That can just be trivially stripped.
Powershell, in any case, allows for scripts to be signed. Since the script in question is semi-auto-generated in any case, they should just include that as a step in the build. But serving unsigned scripts over HTTP is just beyond the pale.
https://raw.githubusercontent.com/Microsoft/Virtualization-D...
If you're worried just enter the above instead, fully HTTPS-ed. Invoke-WebRequest (aliased to wget in this example) follows 301 links unless told not to, so you're actually downloading the script over HTTPS all the time, but someone could still MITM the link shortening service.