Change signature validation logic to call first without the file content

[JamesWTruher]

Only validate the signature with the content if the first non-content validation fails

PR Summary

When ExecutionPolicy is set to require a signature, under some circumstances a signature placed in a file will not execute with a "hash mismatch" error, even though Get-AuthenticodeSignature will return that the signature is valid.
This is because Get-AuthenticodeSignature and our invocation path are not symmetrical. This PR adds the same check that we do in Get-AuthenticodeSignature into our invocation path.

PR Context

PR Checklist

• PR has a meaningful title
  • Use the present tense and imperative mood when describing your changes
• Summarized changes
• Make sure all .h, .cpp, .cs, .ps1 and .psm1 files have the correct copyright header
• This PR is ready to merge and is not Work in Progress.
  • If the PR is work in progress, please add the prefix WIP: or [ WIP ] to the beginning of the title (the WIP bot will keep its status check at Pending while the prefix is present) and remove the prefix when the PR is ready.
• Breaking changes
  • None
  • OR
  • Experimental feature(s) needed
    • Experimental feature name(s):
• User-facing changes
  • Not Applicable
  • OR
  • Documentation needed
    • Issue filed:
• Testing - New and feature
  • N/A or can only be tested interactively
  • OR
  • Make sure you've added a new test if existing tests do not effectively test the code changed
• Tooling
  • I have considered the user experience from a tooling perspective and don't believe tooling will be impacted.
  • OR
  • I have considered the user experience from a tooling perspective and opened an issue in the relevant tool repository. This may include:
    • Impact on PowerShell Editor Services which is used in the PowerShell extension for VSCode
      (which runs in a different PS Host).
      • Issue filed:
    • Impact on Completions (both in the console and in editors) - one of PowerShell's most powerful features.
      • Issue filed:
    • Impact on PSScriptAnalyzer (which provides linting & formatting in the editor extensions).
      • Issue filed:
    • Impact on EditorSyntax (which provides syntax highlighting with in VSCode, GitHub, and many other editors).
      • Issue filed:

[TravisEz13]

I believe this is correct.
GetSignature should be called without contents first, because:

1. The underlying validation should never return a false valid, so the call is safe.
2. we cannot validate windows signatures, when called WITH contents. So, we should try without contents first.
3. manipulating the contents makes it more likely to get a false invalid.

[adityapatwardhan]

@JamesWTruher Is there a way we can add a test for the change?

[PaulHigin]

Does this change need to be backported to Windows PowerShell?

[PaulHigin]

This comment is confusing to me, what is the simple method? I think it should say something like 'first try to get a catalog signature, by passing in null content'.

[JamesWTruher]

My understanding is that the missing catalog look up is only part of the problem, and that we should be letting the SIP try to validate with out our "help". @TravisEz13 can perhaps address additional points.

[TravisEz13]

I think getting the catalog is only half of it, like James is saying. If we fail to get a catalog signature, we try to get the embedded signature without modifying the content. This should be what we try first. It is the only thing we do in Get-AuthenticodeSignature.

[JamesWTruher]

@adityapatwardhan I couldn't think of one other than the tests we have, and I'm not sure why the tests we have didn't find this. It may be that @PaulHigin can figure out a way

[SteveL-MSFT]

@PaulHigin we initially checked against WinPS and for whatever reason it doesn't fail in WinPS. I compared the code between WinPS and PS7 and don't see any differences in this specific code path so it remains a mystery why it only fails on PS7.

[PaulHigin]

@SteveL-MSFT Hmm, I don't like those kinds of mysteries. Could it be a PInvoke difference between .Net frameworks? But this seems like the right fix since it matches what Get-AuthenticodeSignature does.

[rjmholt]

I think the difference lies here:

PowerShell/src/System.Management.Automation/engine/ExternalScriptInfo.cs

Line 518 in 3c7f4b5

Encoding defaultEncoding = ClrFacade.GetDefaultEncoding();

[iSazonov]

I wonder that Get-AuthenticodeSignature -Content assumes the Content is always in Unicode.

I think the difference lies here:

PowerShell/src/System.Management.Automation/engine/ExternalScriptInfo.cs

Line 518 in 3c7f4b5

Encoding defaultEncoding = ClrFacade.GetDefaultEncoding();

It could be so if a test script file is in Unicode but without BOM otherwise StreamReader() detected right an encoding of the file.

[iSazonov]

Although it may be just the same

[System.Text.Encoding] :: Utf8.GetPreamble ()
239
187
191

I mean, now we get the default BOM for Uft8 when it shouldn't be (in GetSignatureWithEncodingRetry()).

[PaulHigin]

I see. This does seem like it could be the culprit. But the comment in GetSignatureWithEncodingRetry says the SIP will (may?) replace with a Unicode BOM when signing, in which case the code should handle it. We should investigate this more.

[adityapatwardhan]

I am marking this PR as WIP as more discussion is required here.

[PaulHigin]

This change looks good to me. I feel we can look into the SIP issue separately.

[ghost]

🎉v7.2.0-preview.4 has been released which incorporates this pull request.:tada:

Handy links:

• Release Notes