Signed powershell script not signed after source control

Question

I'm trying to set up some PowerShell build scripts. I've got a self-signed certificate that I can use to sign the script and get it to run with AllSigned. The problem is, this doesn't carry across our scm (git).

Whenever I try to clone and run the script, or change it and revert, I get the error that the file is unsigned.

File <> cannot be loaded. The file <> is not digitally signed. The script will not execute on the system. ...

If I re-sign the script, the signature block changes and I can run it again.

Is there any way to preserve the signing?

Turch · Accepted Answer · 2013-09-20 13:09:36Z

3

Dug into this a little more this morning:

Along with the signature block appended to the actual file, there is signature information stored as extended attributes for the file.

As can be expected, git doesn't track ea's. For attributes like permissions, the standard advice is to use a git hook. I haven't been able to find any way to set the attributes for a digital signature without re-signing the file.

This leaves 3 options:

Switch the build server and any other computers needing to run the script to RemoteSigned.
Use some shell voodoo, git hooks, and SignTool to re-sign the file each time the attribute is removed. Fragile and hacky.
Rework the build / deploy process so that powershell scripts aren't required. I'm in the early stages, so this is my best option.

answered Sep 20, 2013 at 13:09

Turch

1,5462 gold badges15 silver badges32 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

alroc · Accepted Answer · 2013-09-20 00:05:55Z

2

Something related to your source control is modifying the script. For example, if you're using Subversion, expansion of keywords like $Id or $URL$ via svn:keywords will cause your script to change with each revision. Another possibility is EOL markers or file encoding (UTF-8 vs. ASCII) being modified.

answered Sep 20, 2013 at 0:05

alroc

28.3k6 gold badges55 silver badges106 bronze badges

1 Comment

Turch Over a year ago

Well, the problem occurs even when reverting to a committed, signed version of the file (with EOL markers being the same). The root cause is that some signing information is stored as an extended attribute, which git doesn't track.

Collectives™ on Stack Overflow

Signed powershell script not signed after source control

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related