openAgent

1param(
2  [Parameter(ValueFromRemainingArguments = $true)]
3  [string[]] $Path
4)
5 
6$ErrorActionPreference = "Stop"
7 
8if (-not $Path -or $Path.Count -eq 0) {
9  throw "At least one path is required"
10}
11 
12if ($env:GITHUB_ACTIONS -ne "true") {
13  Write-Host "Skipping Windows signing because this is not running on GitHub Actions"
14  exit 0
15}
16 
17$vars = @{
18  endpoint = $env:AZURE_TRUSTED_SIGNING_ENDPOINT
19  account = $env:AZURE_TRUSTED_SIGNING_ACCOUNT_NAME
20  profile = $env:AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE
21}
22 
23if ($vars.Values | Where-Object { -not $_ }) {
24  Write-Host "Skipping Windows signing because Azure Artifact Signing is not configured"
25  exit 0
26}
27 
28$moduleVersion = "0.5.8"
29$module = Get-Module -ListAvailable -Name TrustedSigning | Where-Object { $_.Version -eq [version] $moduleVersion }
30 
31if (-not $module) {
32  try {
33    Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser | Out-Null
34  }
35  catch {
36    Write-Host "NuGet package provider install skipped: $($_.Exception.Message)"
37  }
38 
39  Install-Module -Name TrustedSigning -RequiredVersion $moduleVersion -Force -Repository PSGallery -Scope CurrentUser
40}
41 
42Import-Module TrustedSigning -RequiredVersion $moduleVersion -Force
43 
44$files = @($Path | ForEach-Object { Resolve-Path $_ -ErrorAction SilentlyContinue } | Select-Object -ExpandProperty Path -Unique)
45 
46if (-not $files -or $files.Count -eq 0) {
47  throw "No files matched the requested paths"
48}
49 
50$params = @{
51  Endpoint                         = $vars.endpoint
52  CodeSigningAccountName           = $vars.account
53  CertificateProfileName           = $vars.profile
54  Files                            = ($files -join ",")
55  FileDigest                       = "SHA256"
56  TimestampDigest                  = "SHA256"
57  TimestampRfc3161                 = "http://timestamp.acs.microsoft.com"
58  ExcludeEnvironmentCredential     = $true
59  ExcludeWorkloadIdentityCredential = $true
60  ExcludeManagedIdentityCredential = $true
61  ExcludeSharedTokenCacheCredential = $true
62  ExcludeVisualStudioCredential    = $true
63  ExcludeVisualStudioCodeCredential = $true
64  ExcludeAzureCliCredential        = $false
65  ExcludeAzurePowerShellCredential = $true
66  ExcludeAzureDeveloperCliCredential = $true
67  ExcludeInteractiveBrowserCredential = $true
68}
69 
70Invoke-TrustedSigning @params
71