Code signing

Code signing is a prerequisite, to ensure that the scripts you have developed are not altered during their life cycles. It is also a very common task in a deployment pipeline. When moving code from development to production, it is signed, and is thereby marked as ready to ship.

Signing scripts and Desired State Configuration (DSC) documents is trivial. There is one cmdlet to sign files, and one to validate signatures, as you can see in the next code sample:

# A certificate is necessary
# Certificates can be self-signed, externally sourced, etc.
$codeSigningCert = Get-ChildItem Cert:\CurrentUser\my -CodeSigningCert

# You can sign ps1, psd1, psm1 and mof files - any files that
# support Subject Interface Package (SIP)
New-Item -ItemType File -Path .\SignedScript.ps1 -Value 'Get-Process -Id $Pid'
Set-AuthenticodeSignature -FilePath .\SignedScript.ps1 -Certificate $codeSigningCert -IncludeChain all

# You can always validate a signature

# Valid
Get-AuthenticodeSignature -FilePath...