PSADT 4.1.8 extern code signing

The Toolkit General Discussion
1

Hi everyone,
I need your help again. I'm currently creating a package for a client that will subsequently undergo code signing. It involves an external script provided by the client, which works without any issues under PSADT 3.8.4.
However, when I try to launch the package using PSADT 4.1.8, absolutely nothing happens. Are there now restrictions within PSADT regarding external code-signing scripts? How can this be resolved?
Thanks for your help.

cu

bolle

2

Any issues with code signing are probably isolated to your environment.
PSADT uses a Cert that is related to a root-cert that most computer already have installed.
IF anything needs to be signed, it's the Invoke-AppDeployToolkit.ps1 file.

If you have already signed your modified Invoke-AppDeployToolkit.ps1 with your OWN cert that you know is valid then it's probably something else.

3

Okay, but where do I need to look for the error? I didn't see anything in the script itself that would explain why it works with PSADT 3.8.4 but not with PSADT 4.1.8. When I compare the two old and new PS1 files, the signed area looks exactly the same. The fingerprint and the signed block look different in the script, of course.

# Set Parameters
$CertificateThumbprint = "XXX"

# Get the Certificate from Cert Store
$CodeSignCert = Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object {$_.Thumbprint -eq $CertificateThumbprint}

# Function to normalize the path
function Normalize-Path {
    param (
        [string]$Path
    )
    $Path = $Path.Trim('"')  # Remove surrounding quotes if any
    return $Path
}

# Function to sign a single file
function Sign-SingleFile {
    param (
        [string]$ScriptPath
    )
    $ScriptPath = Normalize-Path -Path $ScriptPath
    if (Test-Path $ScriptPath) {
        Set-AuthenticodeSignature -FilePath $ScriptPath -Certificate $CodeSignCert
        Write-Host "Signed: $ScriptPath"
    } else {
        Write-Host "File not found: $ScriptPath"
    }
}

# Function to sign all .ps1 files in a folder
function Sign-AllFilesInFolder {
    param (
        [string]$FolderPath,
        [bool]$Recurse = $false
    )
    $FolderPath = Normalize-Path -Path $FolderPath
    if (Test-Path $FolderPath) {
        $files = Get-ChildItem -Path $FolderPath -Filter *.ps1 -Recurse:$Recurse
        foreach ($file in $files) {
            Set-AuthenticodeSignature -FilePath $file.FullName -Certificate $CodeSignCert
            Write-Host "Signed: $($file.FullName)"
        }
    } else {
        Write-Host "Folder not found: $FolderPath"
    }
}

# Main Script
Write-Host "Choose an option:"
Write-Host "1: Sign a single specified .ps1 file"
Write-Host "2: Sign all .ps1 files in a folder"
Write-Host "3: Sign all .ps1 files in a folder and subfolders"
$choice = Read-Host "Enter your choice (1, 2, or 3)"

switch ($choice) {
    "1" {
        $filePath = Read-Host "Enter the full path to the .ps1 file"
        Sign-SingleFile -ScriptPath $filePath
    }
    "2" {
        $folderPath = Read-Host "Enter the folder path"
        Sign-AllFilesInFolder -FolderPath $folderPath -Recurse $false
    }
    "3" {
        $folderPath = Read-Host "Enter the folder path"
        Sign-AllFilesInFolder -FolderPath $folderPath -Recurse $true
    }
    default {
        Write-Host "Invalid choice, exiting..."
    }
}

# SIG # Begin signature block
# XXXXXXXXXXXXX
# SIG # End signature block
4

Hi everyone,
I solved the problem. It's not enough to just sign the ps1 files, you also need to sign the psm1 and psd1 files. Now it works.

cu

bolle01

5

You HAD to re-sign the PSADT psd1/psm1 files or the extensions psd1/psm1 files ?

6

Hi,
i've already signed all ps1, psm1, and psd1 files in all folders and subfolders. I don't know if signing only these files is sufficient.

Invoke-AppDeployToolkit.ps1
PSAppDeployToolkit.psd1
PSAppDeployToolkit.psm1
PSAppDeployToolkit.Extensions.psd1
PSAppDeployToolkit.Extensions.psm1

cu

bolle01