psmodules/sign.psm1

   1 <#
   2 .SYNPOSIS
   3
   4 Commands to maintain a local code singing cert.
   5
   6 This is a hack to solve allowing PowerShell to trust a PowerShell profile hosted on a UNC path, without allowing 'Unrestricted' execution policy.
   7
   8 I created this because it annoys me that my mandatory UNC path profile counts as a remote script, and I'm too pedantic to un-restrict all remote scripts just to allow my profile to load.
   9
  10 .NOTES
  11
  12 Works fine under PowerShell Core 6 with ExecutionPolicy RemoteSigned. PowerShell 7
  13
  14 .EXAMPLE
  15
  16 Set-ExecutionPolicy RemoteSigned
  17
  18 Import-Module c:\src\dotfiles\psmodules\sign.psm1
  19
  20 # Make a cert
  21
  22 > New-CodeSignCert
  23 # Install it - you will be promted whether to trust it.
  24
  25 > Install-CodeSignCert
  26
  27 # Sign your UNC path PowerShell profile
  28 > Invoke-CodeSign $profile
  29
  30
  31 #>
  32 $certName = "Local Code Sign Cert"
  33 $codeSigning = ""
  34
  35 function New-CodeSignCert {
  36         $cert = New-SelfSignedCertificate -CertStoreLocation Cert:\CurrentUser\My -Type CodeSigningCert -Subject $certName -KeyAlgorithm RSA -KeyLength 2048 -Provider "Microsoft Enhanced RSA and AES Cryptographic Provider" -KeyUsage "DigitalSignature"
  37
  38 }
  39
  40 function Get-CodeSignCert {
  41         $certName = "Local Code Sign Cert"
  42         return Get-ChildItem -Path Cert:\CurrentUser\My | Select-Object -First 1
  43 #       | ? Subject -EQ "CN=$certName"
  44 }
  45
  46 function Install-CodeSignCert {
  47
  48         $cert = Get-CodeSignCert
  49         Move-Item -Path $cert.PSPath -Destination "Cert:\CurrentUser\Root"
  50 }
  51
  52 function Invoke-CodeSign {
  53         param(
  54                 [string]$Path
  55         )
  56         $cert = Get-CodeSignCert
  57         Set-AuthenticodeSignature -FilePath $Path -Certificate $cert
  58 }
  59
  60 function Invoke-CodeSignProfile {
  61         Invoke-CodeSign -Path $profile
  62 }
  63
  64 Export-ModuleMember -Function New-CodeSignCert
  65 Export-ModuleMember -Function Get-CodeSignCert
  66 Export-ModuleMember -Function Install-CodeSignCert
  67 Export-ModuleMember -Function Invoke-CodeSign
  68 Export-ModuleMember -Function Invoke-CodeSignProfile