Forum Discussion

Vanbogie1200's avatar
Vanbogie1200
Copper Contributor
Apr 06, 2021

Can MSIX packages be signed via PS cmdlet 'Set-AuthenticodeSignature'

Our older code signing cert is about to expire so we're attempting to move the process to lean on our newer code signing process where the cert never leaves a particular server. This process at it's root relies on the PowerShell cmdlet 'Set-AuthenticodeSignature'.

Attempting to sign MSIX builds with the same parameters we use for scripts and exe's appears not to be working. I have verified the Certificate Subject matches the MSIX's publisher entry in the manifest file. The error returned is vague, so I'm not sure if the msix format is supported or if there's something else wrong here.

To clarify, we're not using the msix repackaging tool or any third party repackaging tool to sign the files. 
Some basic's behind the commands we're using:

$MSIxToSign = "$PSScriptRoot\Application.msix"
$CSCert = Get-ChildItem Cert:\ -Recurse -ErrorAction SilentlyContinue -CodeSigningCert | Where-Object Thumbprint -eq 'OurThumbPrint' | Select-Object -First 1

$SignatureParams = @{
    Certificate=$CSCert
    IncludeChain='notroot'
    TimestampServer='http://timestamp.digicert.com'
    Force=$true
}

try {
    $result = Set-AuthenticodeSignature -FilePath $MSIxToSign @SignatureParams -ErrorAction Stop
}
catch {
    Write-error "Doh!!"
}

PS C:\Users\me> $result.Status
'UnknownError'
PS C:\Users\me> $result.StatusMessage
'The form specified for the subject is not one supported or known by the specified trust provider'

 

Other details:

  • Cert is valid until 2024
  • It is a code signing certificate
  • Issued by Digicert
  • Running on Server 2016
  • Server has PSVersion 5.1

 

    • Vanbogie1200's avatar
      Vanbogie1200
      Copper Contributor
      Hi Dian, I was able to start signing the MSIX builds again using the signtool. So thanks for the suggestion.

      On a side note, I suspect the issue with that cmdlet 'Set-AuthenticodeSignature' is that it's being run from PS 5.1. I noticed that PowerShell 5.1 also cannot view the signature on an MSIX while 7.0 has no issue. I plan on installing PS 7.0 on our signing server on Monday and will provide an update here in case there are anyone else is trying to sign this way.

Share

Resources