Add Authenticode signing support for PowerShell modules

[HeyItsGilbert]

Summary

This PR adds comprehensive Authenticode code-signing capabilities to PowerShellBuild, enabling modules to be signed with digital certificates from multiple sources. It includes three new public functions and corresponding build tasks for signing module files and creating/signing Windows catalog files.

Key Changes

• New Function: Get-PSBuildCertificate - Resolves code-signing X509Certificate2 objects from five different sources:

  • Auto (environment variable or certificate store, configurable)
  • Windows certificate store (with optional thumbprint filtering)
  • Base64-encoded PFX from environment variables (CI/CD pipelines)
  • PFX files on disk with optional password protection
  • Pre-resolved certificate objects (for custom providers like Azure Key Vault)

• New Function: Invoke-PSBuildModuleSigning - Signs PowerShell module files (*.psd1, *.psm1, *.ps1) with Authenticode signatures, supporting configurable timestamp servers and hash algorithms (SHA256, SHA384, SHA512, SHA1)

• New Function: New-PSBuildFileCatalog - Creates Windows catalog (.cat) files that record cryptographic hashes of module contents for tamper detection

• New Build Tasks - Added to both psakeFile.ps1 and IB.tasks.ps1:

  • SignModule - Signs module files with Authenticode
  • BuildCatalog - Creates a Windows catalog file
  • SignCatalog - Signs the catalog file
  • Sign - Meta-task that orchestrates the full signing pipeline

• Configuration - Extended build.properties.ps1 with comprehensive Sign configuration section supporting:

  • Certificate source selection and parameters
  • Timestamp server configuration
  • Hash algorithm selection
  • File inclusion patterns
  • Catalog generation settings (version, filename)

• Localization - Added localized messages for certificate resolution, file signing, and catalog creation

Implementation Details

• All signing operations include platform checks (Windows-only) with appropriate warnings
• Pre-condition checks ensure signing is only attempted when enabled and dependencies are available
• Certificate resolution supports both explicit configuration and environment-based auto-detection
• Task dependencies ensure proper execution order: Build → SignModule → BuildCatalog → SignCatalog
• Verbose logging throughout for troubleshooting certificate resolution and signing operations

https://claude.ai/code/session_01Bt5Xb9HLoSppQ22PQUTyGP

[Copilot]

Pull request overview

Adds Authenticode signing support to the PowerShellBuild pipeline by introducing certificate resolution + module/catalog signing functions and wiring them into both psake and Invoke-Build task graphs.

Changes:

• Adds new public functions for certificate resolution, module file signing, and Windows catalog generation.
• Extends build configuration and localized messages to support signing options.
• Introduces new build tasks (SignModule/BuildCatalog/SignCatalog/Sign) in both psake and Invoke-Build task files.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 16 comments.

Show a summary per file

File	Description
PowerShellBuild/psakeFile.ps1	Adds signing/catalog tasks and dependency defaults to the psake build pipeline.
PowerShellBuild/IB.tasks.ps1	Adds equivalent signing/catalog tasks for Invoke-Build.
PowerShellBuild/build.properties.ps1	Introduces Sign configuration (cert sources, timestamp, algorithms, catalog settings).
PowerShellBuild/en-US/Messages.psd1	Adds localized strings for certificate resolution, signing, and catalog creation.
PowerShellBuild/Public/Get-PSBuildCertificate.ps1	New public function to resolve certificates from Store/Thumbprint/EnvVar/PfxFile.
PowerShellBuild/Public/Invoke-PSBuildModuleSigning.ps1	New public function to sign module files using Set-AuthenticodeSignature.
PowerShellBuild/Public/New-PSBuildFileCatalog.ps1	New public function to generate a Windows catalog file via New-FileCatalog.
PowerShellBuild/PowerShellBuild.psd1	Exports the newly added public functions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The certificate-resolution block is duplicated across SignModule and SignCatalog tasks (and also repeated in IB.tasks.ps1). This increases the risk of future drift (e.g., adding a new cert source/parameter in one place but not the other). Consider factoring this into a shared helper (e.g., Resolve-PSBuildSigningCertificate) used by both tasks.

Suggested change

	Task SignModule -Depends $PSBSignModuleDependency-PreCondition $signModulePreReqs {
	$certParams=@{
	CertificateSource =$PSBPreference.Sign.CertificateSource
	CertStoreLocation =$PSBPreference.Sign.CertStoreLocation
	CertificateEnvVar =$PSBPreference.Sign.CertificateEnvVar
	CertificatePasswordEnvVar =$PSBPreference.Sign.CertificatePasswordEnvVar
	}
	if ($PSBPreference.Sign.Thumbprint) {
	$certParams.Thumbprint=$PSBPreference.Sign.Thumbprint
	}
	if ($PSBPreference.Sign.PfxFilePath) {
	$certParams.PfxFilePath=$PSBPreference.Sign.PfxFilePath
	}
	if ($PSBPreference.Sign.PfxFilePassword) {
	$certParams.PfxFilePassword=$PSBPreference.Sign.PfxFilePassword
	}
	$certificate=if ($PSBPreference.Sign.Certificate) {
	$PSBPreference.Sign.Certificate
	} else {
	Get-PSBuildCertificate@certParams
	}
	functionResolve-PSBuildSigningCertificate {
	param(
	[Parameter(Mandatory=$true)]
	$SignPreference
	)
	$certParams=@{
	CertificateSource =$SignPreference.CertificateSource
	CertStoreLocation =$SignPreference.CertStoreLocation
	CertificateEnvVar =$SignPreference.CertificateEnvVar
	CertificatePasswordEnvVar =$SignPreference.CertificatePasswordEnvVar
	}
	if ($SignPreference.Thumbprint) {
	$certParams.Thumbprint=$SignPreference.Thumbprint
	}
	if ($SignPreference.PfxFilePath) {
	$certParams.PfxFilePath=$SignPreference.PfxFilePath
	}
	if ($SignPreference.PfxFilePassword) {
	$certParams.PfxFilePassword=$SignPreference.PfxFilePassword
	}
	if ($SignPreference.Certificate) {
	return$SignPreference.Certificate
	}
	returnGet-PSBuildCertificate@certParams
	}
	Task SignModule -Depends $PSBSignModuleDependency-PreCondition $signModulePreReqs {
	$certificate=Resolve-PSBuildSigningCertificate-SignPreference $PSBPreference.Sign