|
| 1 | +param( |
| 2 | + [Parameter(Mandatory = $true)] |
| 3 | + [string] $ModuleRoot, |
| 4 | + |
| 5 | + [string] $SignerModuleRoot, |
| 6 | + |
| 7 | + [switch] $VerifyOnly, |
| 8 | + |
| 9 | + [string] $AzureKeyVaultUrl, |
| 10 | + |
| 11 | + [string] $AzureKeyVaultCertificate, |
| 12 | + |
| 13 | + [string] $AzureKeyVaultClientId, |
| 14 | + |
| 15 | + [string] $AzureKeyVaultClientSecret, |
| 16 | + |
| 17 | + [string] $AzureKeyVaultTenantId, |
| 18 | + |
| 19 | + [string] $TimestampServer, |
| 20 | + |
| 21 | + [ValidateSet('Sha256', 'Sha384', 'Sha512')] |
| 22 | + [string] $HashAlgorithm = 'Sha256', |
| 23 | + |
| 24 | + [ValidateSet('Sha1', 'Sha256', 'Sha384', 'Sha512')] |
| 25 | + [string] $TimestampHashAlgorithm = 'Sha256' |
| 26 | +) |
| 27 | + |
| 28 | +$ErrorActionPreference = 'Stop' |
| 29 | + |
| 30 | +function Get-PsignModuleSigningTargets { |
| 31 | + param( |
| 32 | + [Parameter(Mandatory = $true)] |
| 33 | + [string] $ResolvedModuleRoot |
| 34 | + ) |
| 35 | + |
| 36 | + $topLevelExtensions = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase) |
| 37 | + foreach ($extension in @('.psd1', '.psm1', '.ps1xml')) { |
| 38 | + [void] $topLevelExtensions.Add($extension) |
| 39 | + } |
| 40 | + |
| 41 | + $targets = [System.Collections.Generic.List[string]]::new() |
| 42 | + Get-ChildItem -LiteralPath $ResolvedModuleRoot -File | |
| 43 | + Where-Object { $topLevelExtensions.Contains($_.Extension) } | |
| 44 | + Sort-Object FullName | |
| 45 | + ForEach-Object { [void] $targets.Add($_.FullName) } |
| 46 | + |
| 47 | + $managedAssemblyRoot = Join-Path (Join-Path $ResolvedModuleRoot 'lib') 'net8.0' |
| 48 | + if (Test-Path -LiteralPath $managedAssemblyRoot) { |
| 49 | + Get-ChildItem -LiteralPath $managedAssemblyRoot -Filter '*.dll' -File | |
| 50 | + Sort-Object FullName | |
| 51 | + ForEach-Object { [void] $targets.Add($_.FullName) } |
| 52 | + } |
| 53 | + |
| 54 | + return $targets.ToArray() |
| 55 | +} |
| 56 | + |
| 57 | +function Assert-PsignModuleSigningParameters { |
| 58 | + foreach ($name in @( |
| 59 | + 'AzureKeyVaultUrl', |
| 60 | + 'AzureKeyVaultCertificate', |
| 61 | + 'AzureKeyVaultClientId', |
| 62 | + 'AzureKeyVaultClientSecret', |
| 63 | + 'AzureKeyVaultTenantId', |
| 64 | + 'TimestampServer' |
| 65 | + )) { |
| 66 | + if ([string]::IsNullOrWhiteSpace((Get-Variable -Name $name -ValueOnly))) { |
| 67 | + throw "$name is required when signing a PowerShell module release payload." |
| 68 | + } |
| 69 | + } |
| 70 | +} |
| 71 | + |
| 72 | +function Assert-PsignModuleSignatures { |
| 73 | + param( |
| 74 | + [Parameter(Mandatory = $true)] |
| 75 | + [string[]] $Targets |
| 76 | + ) |
| 77 | + |
| 78 | + foreach ($target in $Targets) { |
| 79 | + $signature = Get-PsignSignature -LiteralPath $target -ErrorAction Stop |
| 80 | + if ($signature.Status -ne [System.Management.Automation.SignatureStatus]::Valid) { |
| 81 | + $relativePath = Resolve-Path -LiteralPath $target -Relative |
| 82 | + throw "Expected valid Authenticode signature for '$relativePath', got '$($signature.Status)': $($signature.StatusMessage)" |
| 83 | + } |
| 84 | + } |
| 85 | +} |
| 86 | + |
| 87 | +$resolvedModuleRoot = (Resolve-Path -LiteralPath $ModuleRoot).Path |
| 88 | +$manifestPath = Join-Path $resolvedModuleRoot 'Devolutions.Psign.psd1' |
| 89 | +if (-not (Test-Path -LiteralPath $manifestPath)) { |
| 90 | + throw "Devolutions.Psign manifest not found at '$manifestPath'." |
| 91 | +} |
| 92 | + |
| 93 | +$resolvedSignerModuleRoot = if ([string]::IsNullOrWhiteSpace($SignerModuleRoot)) { |
| 94 | + $resolvedModuleRoot |
| 95 | +} else { |
| 96 | + (Resolve-Path -LiteralPath $SignerModuleRoot).Path |
| 97 | +} |
| 98 | +$signerManifestPath = Join-Path $resolvedSignerModuleRoot 'Devolutions.Psign.psd1' |
| 99 | +if (-not (Test-Path -LiteralPath $signerManifestPath)) { |
| 100 | + throw "Devolutions.Psign signer manifest not found at '$signerManifestPath'." |
| 101 | +} |
| 102 | + |
| 103 | +$targets = @(Get-PsignModuleSigningTargets -ResolvedModuleRoot $resolvedModuleRoot) |
| 104 | +if ($targets.Count -eq 0) { |
| 105 | + throw "No PowerShell module signing targets were found under '$resolvedModuleRoot'." |
| 106 | +} |
| 107 | + |
| 108 | +Import-Module $signerManifestPath -Force -ErrorAction Stop |
| 109 | + |
| 110 | +if (-not $VerifyOnly.IsPresent) { |
| 111 | + Assert-PsignModuleSigningParameters |
| 112 | + |
| 113 | + $signingArguments = @{ |
| 114 | + AzureKeyVaultUrl = $AzureKeyVaultUrl |
| 115 | + AzureKeyVaultCertificate = $AzureKeyVaultCertificate |
| 116 | + AzureKeyVaultClientId = $AzureKeyVaultClientId |
| 117 | + AzureKeyVaultClientSecret = $AzureKeyVaultClientSecret |
| 118 | + AzureKeyVaultTenantId = $AzureKeyVaultTenantId |
| 119 | + TimestampServer = $TimestampServer |
| 120 | + HashAlgorithm = $HashAlgorithm |
| 121 | + TimestampHashAlgorithm = $TimestampHashAlgorithm |
| 122 | + Force = $true |
| 123 | + } |
| 124 | + |
| 125 | + foreach ($target in $targets) { |
| 126 | + Set-PsignSignature -LiteralPath $target @signingArguments -ErrorAction Stop | Out-Null |
| 127 | + } |
| 128 | +} |
| 129 | + |
| 130 | +Assert-PsignModuleSignatures -Targets $targets |
| 131 | + |
| 132 | +[pscustomobject]@{ |
| 133 | + ModuleRoot = $resolvedModuleRoot |
| 134 | + Signed = -not $VerifyOnly.IsPresent |
| 135 | + TargetCount = $targets.Count |
| 136 | + Targets = $targets |
| 137 | +} |
0 commit comments