Complete artifact signing module paths

Route MSIX signing through the shared portable signing provider so Artifact Signing and Key Vault cover that format too. Let the PowerShell module package signing helper use either Azure Key Vault or Artifact Signing parameters.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: mamoreau-devolutions

PowerShell/package.ps1

@@ -22,6 +22,22 @@ param(
 
     [string] $AzureKeyVaultTenantId,
 
+    [string] $ArtifactSigningEndpoint,
+
+    [string] $ArtifactSigningAccountName,
+
+    [string] $ArtifactSigningProfileName,
+
+    [string] $ArtifactSigningAccessToken,
+
+    [switch] $ArtifactSigningManagedIdentity,
+
+    [string] $ArtifactSigningTenantId,
+
+    [string] $ArtifactSigningClientId,
+
+    [string] $ArtifactSigningClientSecret,
+
     [string] $TimestampServer,
 
     [ValidateSet('Sha256', 'Sha384', 'Sha512')]
@@ -84,6 +100,14 @@ if ($SignModule) {
         -AzureKeyVaultClientId $AzureKeyVaultClientId `
         -AzureKeyVaultClientSecret $AzureKeyVaultClientSecret `
         -AzureKeyVaultTenantId $AzureKeyVaultTenantId `
+        -ArtifactSigningEndpoint $ArtifactSigningEndpoint `
+        -ArtifactSigningAccountName $ArtifactSigningAccountName `
+        -ArtifactSigningProfileName $ArtifactSigningProfileName `
+        -ArtifactSigningAccessToken $ArtifactSigningAccessToken `
+        -ArtifactSigningManagedIdentity:$ArtifactSigningManagedIdentity `
+        -ArtifactSigningTenantId $ArtifactSigningTenantId `
+        -ArtifactSigningClientId $ArtifactSigningClientId `
+        -ArtifactSigningClientSecret $ArtifactSigningClientSecret `
         -TimestampServer $TimestampServer `
         -HashAlgorithm $HashAlgorithm `
         -TimestampHashAlgorithm $TimestampHashAlgorithm | Out-Host

PowerShell/sign-module.ps1

@@ -16,6 +16,22 @@ param(
 
     [string] $AzureKeyVaultTenantId,
 
+    [string] $ArtifactSigningEndpoint,
+
+    [string] $ArtifactSigningAccountName,
+
+    [string] $ArtifactSigningProfileName,
+
+    [string] $ArtifactSigningAccessToken,
+
+    [switch] $ArtifactSigningManagedIdentity,
+
+    [string] $ArtifactSigningTenantId,
+
+    [string] $ArtifactSigningClientId,
+
+    [string] $ArtifactSigningClientSecret,
+
     [string] $TimestampServer,
 
     [ValidateSet('Sha256', 'Sha384', 'Sha512')]
@@ -54,39 +70,96 @@ function Get-PsignModuleSigningTargets {
     return $targets.ToArray()
 }
 
-function Assert-PsignModuleSigningParameters {
-    foreach ($name in @(
-        'AzureKeyVaultUrl',
-        'AzureKeyVaultCertificate',
-        'AzureKeyVaultClientId',
-        'AzureKeyVaultClientSecret',
-        'AzureKeyVaultTenantId',
-        'TimestampServer'
-    )) {
+function Test-TextValue {
+    param([string] $Value)
+
+    return -not [string]::IsNullOrWhiteSpace($Value)
+}
+
+function Assert-RequiredTextParameters {
+    param([string[]] $Names)
+
+    foreach ($name in $Names) {
         if ([string]::IsNullOrWhiteSpace((Get-Variable -Name $name -ValueOnly))) {
             throw "$name is required when signing a PowerShell module release payload."
         }
     }
 }
 
+function Assert-PsignModuleSigningParameters {
+    Assert-RequiredTextParameters -Names @('TimestampServer')
+
+    $hasAzureKeyVault = (Test-TextValue $AzureKeyVaultUrl) -or
+        (Test-TextValue $AzureKeyVaultCertificate)
+    $hasArtifactSigning = (Test-TextValue $ArtifactSigningEndpoint) -or
+        (Test-TextValue $ArtifactSigningAccountName) -or
+        (Test-TextValue $ArtifactSigningProfileName)
+
+    if ($hasAzureKeyVault -eq $hasArtifactSigning) {
+        throw "Provide exactly one cloud signing provider for the PowerShell module release payload: Azure Key Vault or Artifact Signing."
+    }
+
+    if ($hasAzureKeyVault) {
+        Assert-RequiredTextParameters -Names @(
+            'AzureKeyVaultUrl',
+            'AzureKeyVaultCertificate',
+            'AzureKeyVaultClientId',
+            'AzureKeyVaultClientSecret',
+            'AzureKeyVaultTenantId'
+        )
+        return
+    }
+
+    Assert-RequiredTextParameters -Names @(
+        'ArtifactSigningEndpoint',
+        'ArtifactSigningAccountName',
+        'ArtifactSigningProfileName'
+    )
+}
+
 function Invoke-PsignModuleSigning {
     param(
         [Parameter(Mandatory = $true)]
         [string] $Target
     )
 
-    Set-PsignSignature `
-        -LiteralPath $Target `
-        -AzureKeyVaultUrl $AzureKeyVaultUrl `
-        -AzureKeyVaultCertificate $AzureKeyVaultCertificate `
-        -AzureKeyVaultClientId $AzureKeyVaultClientId `
-        -AzureKeyVaultClientSecret $AzureKeyVaultClientSecret `
-        -AzureKeyVaultTenantId $AzureKeyVaultTenantId `
-        -TimestampServer $TimestampServer `
-        -TimestampHashAlgorithm $TimestampHashAlgorithm `
-        -HashAlgorithm $HashAlgorithm `
-        -Force `
-        -ErrorAction Stop | Out-Null
+    $signArgs = @{
+        LiteralPath = $Target
+        TimestampServer = $TimestampServer
+        TimestampHashAlgorithm = $TimestampHashAlgorithm
+        HashAlgorithm = $HashAlgorithm
+        Force = $true
+        ErrorAction = 'Stop'
+    }
+
+    if (Test-TextValue $AzureKeyVaultUrl) {
+        $signArgs.AzureKeyVaultUrl = $AzureKeyVaultUrl
+        $signArgs.AzureKeyVaultCertificate = $AzureKeyVaultCertificate
+        $signArgs.AzureKeyVaultClientId = $AzureKeyVaultClientId
+        $signArgs.AzureKeyVaultClientSecret = $AzureKeyVaultClientSecret
+        $signArgs.AzureKeyVaultTenantId = $AzureKeyVaultTenantId
+    } else {
+        $signArgs.ArtifactSigningEndpoint = $ArtifactSigningEndpoint
+        $signArgs.ArtifactSigningAccountName = $ArtifactSigningAccountName
+        $signArgs.ArtifactSigningProfileName = $ArtifactSigningProfileName
+        if (Test-TextValue $ArtifactSigningAccessToken) {
+            $signArgs.ArtifactSigningAccessToken = $ArtifactSigningAccessToken
+        }
+        if ($ArtifactSigningManagedIdentity.IsPresent) {
+            $signArgs.ArtifactSigningManagedIdentity = $true
+        }
+        if (Test-TextValue $ArtifactSigningTenantId) {
+            $signArgs.ArtifactSigningTenantId = $ArtifactSigningTenantId
+        }
+        if (Test-TextValue $ArtifactSigningClientId) {
+            $signArgs.ArtifactSigningClientId = $ArtifactSigningClientId
+        }
+        if (Test-TextValue $ArtifactSigningClientSecret) {
+            $signArgs.ArtifactSigningClientSecret = $ArtifactSigningClientSecret
+        }
+    }
+
+    Set-PsignSignature @signArgs | Out-Null
 }
 
 function Assert-PsignModuleSignatures {

crates/psign-portable-core/src/lib.rs

@@ -1063,21 +1063,17 @@ fn sign_msix(request: &PortableSignRequest, output_path: &Path) -> Result<()> {
         std::fs::read(&request.path).with_context(|| format!("read {}", request.path.display()))?;
     let staged = stage_flat_msix_for_signature(&package, request.hash_algorithm)
         .with_context(|| format!("stage {} for MSIX signing", request.path.display()))?;
-    let (signer_cert, private_key, chain) = load_signing_material(request)?;
-    let pkcs7 = pkcs7::create_msix_authenticode_pkcs7_der_rsa(
-        &staged,
-        &ext,
-        request.hash_algorithm.into(),
-        signer_cert,
-        chain,
-        private_key,
-    )
-    .with_context(|| {
-        format!(
-            "create portable MSIX Authenticode signature for {}",
-            request.path.display()
-        )
-    })?;
+    let provider = load_signing_provider(request)?;
+    let digest_algorithm = request.hash_algorithm.into();
+    let indirect = pkcs7::msix_spc_indirect_data(&staged, &ext, digest_algorithm)?;
+    let pkcs7 = provider
+        .create_authenticode_pkcs7(indirect, digest_algorithm)
+        .with_context(|| {
+            format!(
+                "create portable MSIX Authenticode signature for {}",
+                request.path.display()
+            )
+        })?;
     let pkcs7 = maybe_timestamp_pkcs7(request, pkcs7)
         .with_context(|| format!("timestamp {}", request.path.display()))?;
     let mut p7x = b"PKCX".to_vec();

crates/psign-sip-digest/src/pkcs7.rs

@@ -343,6 +343,23 @@ pub fn create_msix_authenticode_pkcs7_der_rsa(
     chain_certs: Vec<Certificate>,
     private_key: RsaPrivateKey,
 ) -> Result<Vec<u8>> {
+    let indirect =
+        msix_spc_indirect_data(package_with_signature_part, extension, digest_algorithm)?;
+    create_authenticode_pkcs7_der_rsa(
+        indirect,
+        digest_algorithm,
+        signer_cert,
+        chain_certs,
+        private_key,
+    )
+}
+
+/// Build the Authenticode `SpcIndirectDataContent` for a cleartext MSIX / APPX package.
+pub fn msix_spc_indirect_data(
+    package_with_signature_part: &[u8],
+    extension: &str,
+    digest_algorithm: AuthenticodeSigningDigest,
+) -> Result<SpcIndirectDataContent> {
     let (kind, appx_blob) =
         crate::msix_digest::msix_authenticode_digest_blob(package_with_signature_part, extension)?;
     if kind != digest_algorithm.pe_hash_kind() {
@@ -352,7 +369,7 @@ pub fn create_msix_authenticode_pkcs7_der_rsa(
             digest_algorithm
         ));
     }
-    let indirect = SpcIndirectDataContent {
+    Ok(SpcIndirectDataContent {
         data: SpcAttributeTypeAndOptionalValue {
             value_type: SPC_MSI_SIGINFO_OBJID,
             value: Any::from_der(SPC_MSI_SIGINFO_VALUE_DER)
@@ -363,14 +380,7 @@ pub fn create_msix_authenticode_pkcs7_der_rsa(
             digest: OctetString::new(appx_blob)
                 .map_err(|e| anyhow!("APPX SpcIndirectData digest OCTET STRING: {e}"))?,
         },
-    };
-    create_authenticode_pkcs7_der_rsa(
-        indirect,
-        digest_algorithm,
-        signer_cert,
-        chain_certs,
-        private_key,
-    )
+    })
 }
 
 /// Create PKCS#7 `ContentInfo(SignedData)` DER for a PE Authenticode signature using an RSA private key.

docs/portable-powershell-module.md

@@ -33,6 +33,8 @@ The portable cert store follows the same layout as `psign-tool cert-store`: `<ba
 
 `Set-PsignSignature` supports `-IncludeChain Signer|NotRoot|All` (default `NotRoot`), optional `-ChainCertificatePath`, `-TimestampServer`, and `-TimestampHashAlgorithm Sha1|Sha256|Sha384|Sha512`.
 
+Cloud signing is available through Azure Key Vault parameters (`-AzureKeyVaultUrl`, `-AzureKeyVaultCertificate`, and access token, managed identity, or client credentials) or Azure Artifact Signing / Trusted Signing parameters (`-ArtifactSigningEndpoint`, account/profile, and access token, managed identity, or client credentials). The portable module native library is built with both cloud-signing feature sets.
+
 ## Explicit trust
 
 `Get-PsignSignature` validates digest binding by default and does not claim OS trust. Explicit portable trust can be requested with anchors:
@@ -86,7 +88,7 @@ pwsh -File .\PowerShell\package.ps1 -Configuration Release -NativeArtifactsRoot
 
 The native artifact root should contain directories such as `psign-core-win-x64`, `psign-core-linux-x64`, and `psign-core-osx-arm64`, each containing the packaged native library name for that RID.
 
-Release packaging can also sign the staged module payload before creating the `.nupkg`. The release workflow Authenticode-signs the module manifest, root script module, format file, and managed assemblies with `Set-PsignSignature`, then verifies them through the built `Devolutions.Psign` module, while preserving the separately signed Windows native `psign-core.dll` artifacts imported from the native signing job. The release ZIP remains only a transport archive for those signed files; it is not signed as a custom ZIP Authenticode package.
+Release packaging can also sign the staged module payload before creating the `.nupkg`. The release workflow Authenticode-signs the module manifest, root script module, format file, and managed assemblies with `Set-PsignSignature`, then verifies them through the built `Devolutions.Psign` module, while preserving the separately signed Windows native `psign-core.dll` artifacts imported from the native signing job. The packaging helper accepts Azure Key Vault or Azure Artifact Signing parameters; the release workflow currently supplies Azure Key Vault secrets. The release ZIP remains only a transport archive for those signed files; it is not signed as a custom ZIP Authenticode package.
 
 ## Migrating from built-in Authenticode cmdlets