Add portable Authenticode PowerShell cmdlets#8
Merged
Marc-André Moreau (mamoreau-devolutions) merged 10 commits intoMay 22, 2026
Merged
Conversation
Introduce the portable core/FFI, PowerShell 7.4 module cmdlets, MSIX signing support, module-directory signing, expanded end-to-end tests, packaging, CI, and documentation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Marc-André Moreau (mamoreau-devolutions)
requested a review
from a team
as a code owner
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Default IncludeChain to NotRoot and add XML/MOF PowerShell script marker signing support so ps1xml files sign and verify through the portable cmdlets. Extend module directory coverage and E2E tests for the new behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep fmt-and-lockfile focused on rustfmt and lockfile validation, move the heavier portable clippy/test matrix into a separate cached portable-checks job to make the formatting gate complete faster without dropping coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Split the slow ci-unix portable checks into parallel clippy, crate-test, and matrixed CLI-test jobs. Keep a lightweight portable-checks aggregate job so required-check semantics are preserved while reducing wall-clock time for the cli_pe_digest feature runs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Stage the FFI shared library as psign-core.dll, libpsign-core.so, or libpsign-core.dylib and update the PowerShell module resolver to import psign-core. Rename the C ABI symbols to the psign_core prefix while keeping the Cargo target name as psign_core because Rust target names cannot contain hyphens. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Build psign-core shared libraries alongside psign-tool in the release matrix, sign Windows DLLs through the existing release signing flow, and package the PowerShell module from downloaded native artifacts. Add PSGallery publishing based on the Pinget release workflow using PSGALLERY_NUGET_API_KEY. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Marc-André Moreau (mamoreau-devolutions)
merged commit 5358c83
into
master
38 of 39 checks passed
Marc-André Moreau (mamoreau-devolutions)
deleted the
mamoreau-devolutions/portable-authenticode-cmdlets
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Devolutions.Psign) withGet-PortableSignatureandSet-PortableSignaturebacked by the Rustpsign_portableshared library through P/Invoke.IncludeChain, RFC3161 timestamping, explicit anchor trust policy, portable cert-store thumbprint selection, Force/WhatIf behavior, and richPortableSignaturemetadata.Validation
cargo fmt --all --checkcargo clippy --workspace --all-targets --locked -- -D warningscargo test --workspace --lockeddotnet build .\dotnet\Devolutions.Psign.PowerShell\Devolutions.Psign.PowerShell.csproj -c Releasepwsh -NoLogo -NoProfile -File .\PowerShell\tests\Invoke-PortableSignatureTests.ps1 -Configuration Releasepwsh -NoLogo -NoProfile -File .\PowerShell\package.ps1 -Configuration Release