How to sign a PowerShell script easily?

Question

I'd prefer using the AllSigned execution policy with PowerShell, but self-signing my scripts seems to require several hundreds of megabytes of downloading and installation and the signing process seems to be a hassle.

Is there a simpler way to sign a PowerShell script than described in the documentation?

Answer 1

To do the signing you can use the Set-AuthenticodeSignature cmdlet. This, of course, requires a certificate. If you have a Certificate Authority (unlikely) that will be able to create a code signing certificate. Otherwise there are various tools to create a self-signed certificate.

You install the certificate in your certificate store (open the .cer or .pfx file in Windows Explorer to do this), and then pass it to Set-AuthenticodeSignature (the cert: provider/drive gives access to certificates in your store).

Use

help about_signing

for details (including creating a self-signed certificate using the Windows SDK tools[1]).

[1] I assume this is the big download: you can just install the bits you need, or make use of other tools (OpenSSL includes certificate generation). Getting the SDK is, for this purpose, a one off activity

Answer 2

I use this PowerShell script:

## sign-script.ps1
## Sign a powershell script with a Thawte certificate and 
## timestamp the signature
##
## usage: ./sign-script.ps1 c:\foo.ps1 

param([string] $file=$(throw “Please specify a script filepath.”)) 

$certFriendlyName = "Thawte Code Signing"
$cert = gci cert:\CurrentUser\My -codesigning | where -Filter 
  {$_.FriendlyName -eq $certFriendlyName}

# https://www.thawte.com/ssl-digital-certificates/technical-  
#   support/code/msauth.html#timestampau
# We thank VeriSign for allowing public use of their timestamping server.
# Add the following to the signcode command line: 
# -t http://timestamp.verisign.com/scripts/timstamp.dll 
$timeStampURL = "http://timestamp.verisign.com/scripts/timstamp.dll"

if($cert) {
    Set-AuthenticodeSignature -filepath $file -cert $cert -IncludeChain All -   
      TimeStampServer $timeStampURL
}
else {
    throw "Did not find certificate with friendly name of `"$certFriendlyName`""
}