From 964b93a9d3cf547513d81debaf30168fda3daa2a Mon Sep 17 00:00:00 2001
From: Andrew Ensley <aensley@users.noreply.github.com>
Date: Sat, 4 Jul 2026 16:52:06 -0500
Subject: [PATCH] fix: :bug: unblock the powershell module

---
 src/backdrop.psm1 | 1 +
 src/install.ps1   | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/src/backdrop.psm1 b/src/backdrop.psm1
index c55abda..091077e 100644
--- a/src/backdrop.psm1
+++ b/src/backdrop.psm1
@@ -695,6 +695,7 @@ function Invoke-BackdropUpgrade {
   $tmp = [System.IO.Path]::GetTempFileName()
   try {
     Save-BackdropFile $rawUrl $tmp -TimeoutSec 60
+    Unblock-File $tmp -ErrorAction SilentlyContinue
     Copy-Item $tmp $modPath -Force
     Write-Host "backdrop: upgraded to v$latestVer. Restart PowerShell to use the new version."
   }
diff --git a/src/install.ps1 b/src/install.ps1
index e04ee0b..f067b8f 100644
--- a/src/install.ps1
+++ b/src/install.ps1
@@ -51,6 +51,13 @@ try {
     if ($tmp -and (Test-Path $tmp)) { Remove-Item $tmp -Recurse -Force -ErrorAction SilentlyContinue }
 }
 
+# Files fetched via Invoke-WebRequest carry the Mark of the Web (Zone.Identifier),
+# which NTFS Copy-Item preserves. Under the default RemoteSigned policy, that mark
+# blocks the module from loading in any future session, so strip it here rather
+# than relying on the Bypass override below (which only applies to this process).
+Unblock-File (Join-Path $destDir 'backdrop.psm1') -ErrorAction SilentlyContinue
+Unblock-File (Join-Path $destDir 'backdrop.psd1') -ErrorAction SilentlyContinue
+
 Write-Host "backdrop: installed to $destDir"
 
 # Load the module and enable the scheduled task.