@trillboards/edge-sdk 0.2.25 → 0.2.36

package/deploy/windows/ci/verify-allsigned-enforcement.ps1

@@ -57,6 +57,12 @@
                            signed (by Azure Trusted Signing) and are proved
                            as-is, with the unsigned control derived by stripping
                            the signature block from a copy.
+.PARAMETER RetainSelfSignedFixturePath
+                           In hermetic mode, retain the exact proven root until
+                           a downstream proof cleans it and write only its
+                           subject/thumbprint metadata to this path. The owning
+                           harness emits this directly; callers must not scan
+                           the certificate provider after the proof.
 
 .NOTES
   .cmd/.bat have no Authenticode SIP and cmd.exe has no execution policy, so a
@@ -71,7 +77,8 @@ param(
   [string]$CanaryPs1 = "",
   [string]$CanaryVbs = "",
   [switch]$SelfSign,
-  [switch]$AlreadySigned
+  [switch]$AlreadySigned,
+  [string]$RetainSelfSignedFixturePath = ""
 )
 
 $ErrorActionPreference = 'Stop'
@@ -81,12 +88,17 @@ if (-not ($SelfSign -xor $AlreadySigned)) {
   Write-Error 'Choose exactly one of -SelfSign or -AlreadySigned.'
   exit 2
 }
+if ($RetainSelfSignedFixturePath -and -not $SelfSign) {
+  Write-Error '-RetainSelfSignedFixturePath is valid only with -SelfSign.'
+  exit 2
+}
 
 $PolicyKey = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell'
 $WshKey = 'HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings'
 $Work = Join-Path ([IO.Path]::GetTempPath()) ("tb-allsigned-" + [Guid]::NewGuid().ToString('N').Substring(0, 8))
 $failures = New-Object System.Collections.Generic.List[string]
 $addedThumbprints = New-Object System.Collections.Generic.List[string]
+$retainedRootThumbprint = $null
 
 function Say($m) { Write-Host "[allsigned] $m" }
 function Fail($m) { $script:failures.Add($m); Write-Host "[allsigned] FAIL: $m" -ForegroundColor Red }
@@ -288,6 +300,7 @@ try {
     # reason.
     Add-CertToStore -Cert $pub -StoreName 'Root'
     $addedThumbprints.Add('Root|' + $pub.Thumbprint)
+    if ($RetainSelfSignedFixturePath) { $retainedRootThumbprint = $pub.Thumbprint }
     foreach ($f in @(Get-ChildItem -LiteralPath $signedDir -File)) {
       $r = Set-AuthenticodeSignature -FilePath $f.FullName -Certificate $cert -HashAlgorithm SHA256
       if ($r.Status -ne 'Valid') { throw "self-signing produced $($r.Status) for $($f.Name)" }
@@ -589,6 +602,7 @@ try {
     elseif (Test-Path $WshKey) { Remove-ItemProperty -Path $WshKey -Name 'UseWINSAFER' -ErrorAction SilentlyContinue }
     foreach ($entry in $addedThumbprints) {
       $parts = $entry.Split('|')
+      if ($retainedRootThumbprint -and $parts[0] -eq 'Root' -and $parts[1] -eq $retainedRootThumbprint) { continue }
       Remove-CertFromStore -Thumbprint $parts[1] -StoreName $parts[0]
     }
   } catch {
@@ -604,5 +618,14 @@ if ($failures.Count -gt 0) {
   exit 1
 }
 
+if ($RetainSelfSignedFixturePath) {
+  if (-not $cert -or -not $cert.HasPrivateKey -or $cert.Thumbprint -ne $retainedRootThumbprint) {
+    Write-Error 'the retained self-signed fixture is not the exact proven certificate'
+    exit 1
+  }
+  @([pscustomobject]@{ subject = $cert.Subject; thumbprint = $cert.Thumbprint }) |
+    ConvertTo-Json -Depth 3 | Set-Content -LiteralPath $RetainSelfSignedFixturePath -Encoding UTF8
+}
+
 Say 'PASSED - unsigned is blocked, untrusted-publisher is blocked, tampered is blocked, and every shipped script is admitted.'
 exit 0