Re:Why Package Signing is not the Holy Grail
by voltagex_ on Wednesday July 24, 2013 @02:37AM
(#6094796)
Apologies for hijacking your top comment but I have some additions for Microsoft signing:
An organisation I am familiar with enabled "AllSigned" via group policy. For those who don't know about PowerShell, this forces every script that runs on the system to be signed with a trusted* certificate.
This immediately meant that developers had trouble using NuGet in Visual Studio (lots of packages run init.ps1 to do setup and move files around, but few are signed). You can't even accept the prompt for signed packages (Do you want to run this script signed by "Microsoft Corporation"? [Y] [N]) because the prompt isn't interactive while NuGet is installing packages.
That kind of setup also precludes the use of Choclatey or any other solution that might be using Powershell without the correct signatures.
Finally, if you can run Powershell interactively, you can still just write code or use Invoke-Expression (eval).
Wargh.
*Trusted in this case still means you'll get a prompt the first time you run the script, and a Visual Studio extension installer still runs with enough permissions to install its own certificate into the right store, so I can still be evil if I want. That's assuming the admins haven't accidentally enabled the proxy MITM certificate for code signing (I'll just export and use that instead).
An organisation I am familiar with enabled "AllSigned" via group policy. For those who don't know about PowerShell, this forces every script that runs on the system to be signed with a trusted* certificate.
This immediately meant that developers had trouble using NuGet in Visual Studio (lots of packages run init.ps1 to do setup and move files around, but few are signed). You can't even accept the prompt for signed packages (Do you want to run this script signed by "Microsoft Corporation"? [Y] [N]) because the prompt isn't interactive while NuGet is installing packages.
That kind of setup also precludes the use of Choclatey or any other solution that might be using Powershell without the correct signatures.
Finally, if you can run Powershell interactively, you can still just write code or use Invoke-Expression (eval).
Wargh.
*Trusted in this case still means you'll get a prompt the first time you run the script, and a Visual Studio extension installer still runs with enough permissions to install its own certificate into the right store, so I can still be evil if I want. That's assuming the admins haven't accidentally enabled the proxy MITM certificate for code signing (I'll just export and use that instead).