Code signing remark still valid for labconfig #612

Activity

1. machv commented on Nov 20, 2024

   

   Vladimír (machv)

   on Nov 20, 2024

   Collaborator

   More actions

   This change, I hope, is only temporary until I resolve needed changes on the build infrastructure. But as Windows Server 2025 has recently been released, I didn't want to further block MSLAB new release.

   👍React with 👍1Reacted by Karl Wester-Ebbinghaus
2. Karl-WE commented on Nov 21, 2024

   

   Karl Wester-Ebbinghaus (Karl-WE)

   on Nov 21, 2024

   Last edited by Karl-WE

   ContributorAuthor

   More actions

   Thanks!
   So only labconfig.ps1 will remain unsigned in future? I mean this one needs to be edited and then re-signed anyway.

   This is well described but I wonder why we are doing this in the first place?
   I understand it more for all scripts.

   I never had any issues running Deploy with an unsigned labconfig. That's my point.

   Thank you for your explaination why it's feasible to sign it, while it's a dynamic file.

   Reference
   Also please keep in mind that any change to LabConfig.ps1 file would then require to sign that file again as any change in LabConfig would invalidate initial signature.

   To sign LabConfig.ps1 file you can use this snippet that would select first available Code Signing certificate on your computer:

   Get a Code signing certificate from store $certificate = Get-ChildItem -Path Cert:\CurrentUser\My\ -CodeSigningCert | Select-Object -First 1 # Add signature to a LabConfig file Set-AuthenticodeSignature -FilePath "LabConfig.ps1" -Certificate $certificate