Function: New-SignedScript – Easily Sign One or Many Scripts with Your Code Signing Cert
Signs a PowerShell script with a code signing certificate.
New-SignedScript [[-path] ] [-Verbose] [-Debug] [-ErrorAction ] [-WarningAction ] [-ErrorVariable ] [-WarningVariable ] [-OutVariable ] [-OutBuffer ] [-WhatIf] [-Confirm]
One of the concerns about using a PowerShell script is that it often requires the user to change the Execution Policy on the machine the script is running on. This can cause security concerns, because when the Execution Policy is lowered, any script can run, including those with malicious intent. For more information on setting the Execution Policy, see Set-ExecutionPolicy.
Of course, you need a code signing certificate in order to sign scripts. Fellow Exchange MVP Mike Pfeiffer wrote an informative article, Obtaining a Code Signing Certificate and Signing PowerShell Scripts that covers using an internal Certificate Authority. Third party Certificate Authorities (CAs) such as Digicert also provide code signing certificates. I can’t recommend Digicert enough. I have both a standard code signing certificate and an Extended Validation code signing certificate.
But signing scripts manually can be a little cumbersome. This function gets the current code signing certificate, verifies it’s not expired, and then signs the script. The script will only sign .ps1 files, and will not attempt to sign a script that’s already signed.
New-SignedScript -path [path to script]
New-SignedScript -path .\myscript.ps1
You can also pipeline files to this function, for example:
Get-Item *.ps1 | New-SignedScript
Nothing special here. Once you have a valid code signing certificate installed, the function should work as designed.
v1.1 – 06-10-2014 – New-SignedScript.v1.1.zip
v1.0 – 09-20-2012 – New-SignedScript.v1.0.zip
See changelog for info on latest versions, including bug fixes, code tweaks, etc.