Java Requires Chilkat v11.7.0+

Authenticode Sign a PowerShell Script (.ps1, .psm1, .psd1)

See more Code Signing Examples

Demonstrates how to Authenticode sign a PowerShell script. PowerShell scripts (.ps1), modules (.psm1) and data files (.psd1) can be signed starting in Chilkat v11.7.0. The signature is appended to the file as a comment block, and the file keeps its text encoding. Java

import com.chilkatsoft.chilkat2.Cert;
import com.chilkatsoft.chilkat2.ChilkatException;
import com.chilkatsoft.chilkat2.CodeSign;
import com.chilkatsoft.chilkat2.JsonObject;

public class ChilkatExample {

    public static void main(String[] args) {
        // This example requires the Chilkat API to have been previously unlocked.
        // See Global Unlock Sample for sample code.

        // Signing PowerShell files requires Chilkat v11.7.0 or later.
        // The same code signs a script (.ps1), a module (.psm1), or a data file (.psd1).

        // Load the code signing certificate.  It must have access to its private key.
        Cert cert = new Cert();
        try {
            cert.loadPfxFile("C:/someDir/myCodeSigningCert.pfx", "pfx password");
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        // Sign with SHA256, and ask a timestamp authority for a timestamp.  A timestamp lets the
        // signature continue to validate after the code signing certificate has expired.
        //
        // {
        //   "hashAlg": "sha256",
        //   "timestampToken": {
        //     "enabled": true,
        //     "tsaUrl": "http://timestamp.digicert.com",
        //     "requestTsaCert": true,
        //     "hashAlg": "sha256"
        //   }
        // }
        JsonObject json = new JsonObject();
        json.updateString("hashAlg", "sha256");
        json.updateBool("timestampToken.enabled", true);
        json.updateString("timestampToken.tsaUrl", "http://timestamp.digicert.com");
        json.updateBool("timestampToken.requestTsaCert", true);
        json.updateString("timestampToken.hashAlg", "sha256");

        String scriptPath = "C:/someDir/Deploy.ps1";

        CodeSign signer = new CodeSign();

        // The script is modified in place.  The signature is appended to the end of the file as a comment block:
        //
        //   # SIG # Begin signature block
        //   # MIIoKgYJKoZIhvcNAQcCoIIoGzCCKBcCAQExDzANBglghkgBZQMEAgEFADB5Bgor
        //   # ...
        //   # SIG # End signature block
        //
        // The text encoding of the file (UTF-8, UTF-8 with BOM, or UTF-16) is kept.
        // If the script is already signed, the new signature block replaces the existing one.
        try {
            signer.addSignature(scriptPath, cert, json);
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        System.out.println("Signed the PowerShell script.");

        // Verify the signature that was just added.
        // Any change made to the script after it is signed, even to a comment, invalidates the signature.
        JsonObject sigInfo = new JsonObject();
        try {
            signer.verifySignature(scriptPath, sigInfo);
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        System.out.println("The signature is valid.");
    }
}