🎓 A1Learner
🔍
0 of 46 lessons completed

PowerShell Script Signing Concepts

Script signing is the practice of marking a script with a digital signature that proves who published it. The signature also proves the script has not been changed since it was signed.

Check whether signing is available here

The signing command does not exist on Linux PowerShell, so this lesson teaches signing as concepts only. This check proves that honestly instead of claiming a signed script.

$found = Get-Command Get-AuthenticodeSignature -ErrorAction SilentlyContinue
"Available: " + ($found -ne $null)

A hash shows the tamper-evidence idea

Signing rests on the same idea as a file hash. A hash is a short fingerprint of a file, and any change to the file changes the fingerprint.

Set-Content -Path "note.txt" -Value "hello"
(Get-FileHash -Path "note.txt").Algorithm

Read a signature status in plain words

A signature check returns a status word, and each status has a plain meaning. This switch turns a status word into its meaning without signing anything.

$status = "Valid"
switch ($status) {
  "Valid" { "Signed and trusted" }
  "NotSigned" { "No signature found" }
  default { "Do not trust this script" }
}

Example

Set-Content -Path "myscript.ps1" -Value "hello"
(Get-FileHash -Path "myscript.ps1").Algorithm
$found = Get-Command Get-AuthenticodeSignature -ErrorAction SilentlyContinue
"Signing available: " + ($found -ne $null)
"A real signature would prove this script is unchanged since signing."

Key points

  • Digital signature: a mark on a script that proves who published it and that the script is unchanged.
  • Certificate: a digital identity document that a publisher uses to create a signature.
  • A signature lets a reader trust a script without trusting every word in it on sight.
  • If a signed script is changed after signing, the signature no longer matches the script.
  • An execution policy can require scripts to carry a valid signature before they run.

In this example, a small script file is first created and its hash algorithm is printed to show the fingerprint idea. The script then checks for the signing command and prints that signing is not available on this platform. It closes with the plain meaning of a signature, without ever claiming the file was signed.

Note

Signing is concepts only on this Linux platform. The signing command is not available here, so no script is signed in this lesson.

Try it Yourself

Edit the code, then press Run.

Running is simulated

Exercise

What does a valid digital signature prove about a script?