GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | ||||||||||||||||||||||||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | ||||||||||||||||||||||||||
GeezerVison is showing github.com — Change signature validation logic to call first without the file content by JamesWTruher · Pull Request #14849 · PowerShell/PowerShell Conversation
|
|
James Truher (@JamesWTruher) Is there a way we can add a test for the change? |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Does this change need to be backported to Windows PowerShell?
Sorry, something went wrong.
There was an error while loading. Please reload this page.
| { | ||
| string verificationContents = System.Text.Encoding.Unicode.GetString(script.OriginalEncoding.GetPreamble()) + script.ScriptContents; | ||
| Signature signature = SignatureHelper.GetSignature(path, verificationContents); | ||
| // Invoke the SIP directly with the most simple method |
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
This comment is confusing to me, what is the simple method? I think it should say something like 'first try to get a catalog signature, by passing in null content'.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
My understanding is that the missing catalog look up is only part of the problem, and that we should be letting the SIP try to validate with out our "help". Travis Plunk (@TravisEz13) can perhaps address additional points.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
I think getting the catalog is only half of it, like James is saying. If we fail to get a catalog signature, we try to get the embedded signature without modifying the content. This should be what we try first. It is the only thing we do in Get-AuthenticodeSignature.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
Aditya Patwardhan (@adityapatwardhan) I couldn't think of one other than the tests we have, and I'm not sure why the tests we have didn't find this. It may be that Paul Higinbotham (@PaulHigin) can figure out a way |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
Paul Higinbotham (@PaulHigin) we initially checked against WinPS and for whatever reason it doesn't fail in WinPS. I compared the code between WinPS and PS7 and don't see any differences in this specific code path so it remains a mystery why it only fails on PS7. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
Steve Lee (@SteveL-MSFT) Hmm, I don't like those kinds of mysteries. Could it be a PInvoke difference between .Net frameworks? But this seems like the right fix since it matches what |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
I think the difference lies here:
|
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
I wonder that
It could be so if a test script file is in Unicode but without BOM otherwise StreamReader() detected right an encoding of the file. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
|
Although it may be just the same [System.Text.Encoding] :: Utf8.GetPreamble () 239 187 191 I mean, now we get the default BOM for Uft8 when it shouldn't be (in |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
I see. This does seem like it could be the culprit. But the comment in |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
I am marking this PR as WIP as more discussion is required here. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
This change looks good to me. I feel we can look into the SIP issue separately.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
🎉 Handy links: |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
Successfully merging this pull request may close these issues.
There was an error while loading. Please reload this page.