[Feature Request] Provide quick way to sign PS scripts with the extension

[squawkingVFR]

System Details

• Operating system name and version: Windows 10 1607
• VS Code version: 1.10.2
• PowerShell extension version: 0.10.0

Issue Description

I am experiencing a problem with...

Attached Logs

Follow the instructions in the README
about capturing and sending logs.

[daviwil]

Could be a helpful task, we'll look into it.

[daviwil]

/cc @dotps1 @daGup

So how do you normally sign your scripts, something like this?

$cert = dir cert:currentuser\my\ -CodeSigningCert | select -First 1
$timeStampUrl = "some url"
Set-AuthenticodeSignature ScriptPath.ps1 -IncludeChain All -TimeStampServer $timeStampURL

I could pretty easily expose a task for signing the current script with some configuration parameters to set the cert path, timeStampUrl, etc. I could also try to auto-sign scripts before running them in the debugger. Would that be helpful?

[daGup]

Yah. I was looking at how to do something like this as a vscode task as its like a build step but couldn't get my head around the setup of the task with powershell I never thought to do it as a dir select first filter though usually just grab 1st entry from the cert array. On May 31, 2017 4:40 PM, "David Wilson" <notifications@github.com> wrote: /cc @dotps1 <https://github.com/dotps1> @daGup <https://github.com/dagup> So how do you normally sign your scripts, something like this? $cert = dir cert:currentuser\my\ -CodeSigningCert | select -First 1$timeStampUrl = "some url"Set-AuthenticodeSignature ScriptPath.ps1 -IncludeChain All -TimeStampServer $timeStampURL I could pretty easily expose a task for signing the current script with some configuration parameters to set the cert path, timeStampUrl, etc. I could also try to auto-sign scripts before running them in the debugger. Would that be helpful? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#548 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/APGicuoOijNGRzi9dxGKUoAmKoVutSYuks5r_fpsgaJpZM4MeAud> .

[daviwil]

Which specific parameters do you use on Set-AuthenticodeSignature? Do you use -IncludeChain All or just the Path and TimeStampServer parameters?

[daGup]

Normally just path. I just followed what was online. However I do like the parameters you added. Is it something that can be optional input?

…

On May 31, 2017 4:56 PM, "David Wilson" ***@***.***> wrote: Which specific parameters do you use on Set-AuthenticodeSignature? Do you use -IncludeChain All or just the Path and TimeStampServer parameters? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#548 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/APGicpwSNgZqf7D3qHgts-Pn38uy7BEHks5r_f47gaJpZM4MeAud> .

[daviwil]

Yep, it's possible to make those configurable.

[rkeithhill]

@daGup I'm curious if you would you prefer a mini-build/release process that does the script signing for you - kind of like the task you were trying to set up?

One issue with signing scripts is that you often don't want to sign the "original" script especially if it is checked into source control. It's much easier to develop & debug against a unsigned script and then sign the script when you're ready to release it. And if you ever put your source up on something like GitHub, you don't want the checked in script(s) to be signed since folks who fork your repo won't have your code-signing cert.

Ideally, I'd like to see a build system that could be configured to do as little or as much as you need. Something where perhaps all you need to do to get your script(s) signed is to fill out a few settings in a file (build.settings.ps1) e.g.:

    # ----------------------- Basic properties --------------------------------

    # The root directory containing scripts to process
    $SrcRootDir  = "$PSScriptRoot"

    # ------------------- Script signing properties ---------------------------

    # Set to $true if you want to sign your scripts. You will need to have a code-signing certificate.
    # You can specify the certificate's subject name below. If not specified, you will be prompted to
    # provide either a subject name or path to a PFX file.  After this one time prompt, the value will
    # saved for future use and you will no longer be prompted.
    [System.Diagnostics.CodeAnalysis.SuppressMessage('PSUseDeclaredVarsMoreThanAssigments', '')]
    $ScriptSigningEnabled = $false

    # Specify the Subject Name of the certificate used to sign your scripts.  Leave it as $null and the
    # first time you build, you will be prompted to enter your code-signing certificate's Subject Name.
    # This variable is used only if $SignScripts is set to $true.
    #
    # This does require the code-signing certificate to be installed to your certificate store.  If you
    # have a code-signing certificate in a PFX file, install the certificate to your certificate store
    # with the command below. You may be prompted for the certificate's password.
    #
    # Import-PfxCertificate -FilePath .\myCodeSigingCert.pfx -CertStoreLocation Cert:\CurrentUser\My
    #
    [System.Diagnostics.CodeAnalysis.SuppressMessage('PSUseDeclaredVarsMoreThanAssigments', '')]
    $CertSubjectName = $null

Then press Ctrl+Shift+B and the build copies your scripts to another folder (release or out) where they get signed.

[daGup]

That's awesome while reading this on my phone. I'll punch it up on pc in a bit. Trying to implement something as easy for me to force down people's throats. There wasn't much code signing being done so I'm hoping to get this implemented. I really like the build process you've outlined. On May 31, 2017 5:29 PM, "Keith Hill" <notifications@github.com> wrote: @daGup <https://github.com/dagup> I'm curious if you would you prefer a mini-build/release process that does the script signing for you - kind of like the task you were trying to set up? One issue with signing scripts is that you often don't want to sign the "original" script especially if it is checked into source control. It's much easier to develop & debug against a unsigned script and then sign the script when you're ready to release it. And if you ever put your source up on something like GitHub, you don't want the checked in script(s) to be signed since folks who fork your repo won't have your code-signing cert. Ideally, I'd like to see a build system that could be configured to do as little or as much as you need. Something where perhaps all you need to do to get your script(s) signed is to fill out a few settings in a file (build.settings.ps1) e.g.: # ----------------------- Basic properties -------------------------------- # The root directory containing scripts to process $SrcRootDir = "$PSScriptRoot" # ------------------- Script signing properties --------------------------- # Set to $true if you want to sign your scripts. You will need to have a code-signing certificate. # You can specify the certificate's subject name below. If not specified, you will be prompted to # provide either a subject name or path to a PFX file. After this one time prompt, the value will # saved for future use and you will no longer be prompted. [System.Diagnostics.CodeAnalysis.SuppressMessage('PSUseDeclaredVarsMoreThanAssigments', '')] $ScriptSigningEnabled = $false # Specify the Subject Name of the certificate used to sign your scripts. Leave it as $null and the # first time you build, you will be prompted to enter your code-signing certificate's Subject Name. # This variable is used only if $SignScripts is set to $true. # # This does require the code-signing certificate to be installed to your certificate store. If you # have a code-signing certificate in a PFX file, install the certificate to your certificate store # with the command below. You may be prompted for the certificate's password. # # Import-PfxCertificate -FilePath .\myCodeSigingCert.pfx -CertStoreLocation Cert:\CurrentUser\My # [System.Diagnostics.CodeAnalysis.SuppressMessage('PSUseDeclaredVarsMoreThanAssigments', '')] $CertSubjectName = $null Then press Ctrl+Shift+B and the build copies your scripts to another folder (release or out) where they get signed. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#548 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/APGicj4kUVKu5HJ4uPYAgkyl6CD5wVEbks5r_gYFgaJpZM4MeAud> .