-
Notifications
You must be signed in to change notification settings - Fork 8.1k
Description
Related to #1195 / Found with chocolatey/choco#1203
You are likely to see this more now that PowerShell is cross platform. We just had an issue filed about attempting to run scripts with execution policy "AllSigned". Upon researching this, we were able to determine that any scripts that were UTF-8 / CRLF, those would load just fine. However any scripts that were UTF8 / LF, it would error saying 'filename "may have been tampered because the hash of the file does not match the hash stored in the digital signature."'
I have not had an attempted to check this with the new versions of PowerShell just yet but I did check it against PowerShell v3 and v4 (so far). After talking to @lzybkr and @vors (https://gitter.im/PowerShell/PowerShell?at=58cc405c6d7eb18404dbca07), they said to followup with an issue as they have not had a report of this anywhere.
Steps to reproduce
- Create a script with LF line endings. Save it as
FileSignedWithUnixLineEndings.ps1 - Authenticode sign the script.
- Open the script and note that it now has
LFin the script code andCRLFin the authenticode signature (Mixed mode line endings). - Check to be sure the signature is valid.
Get-AuthenticodeSignature .\FileSignedWithUnixLineEndings.ps1 - Change execution policy to all signed.
Set-ExecutionPolicy AllSigned - Attempt to run the script.
.\FileSignedWithUnixLineEndings.ps1
Expected behavior
It should run the script as it has not been modified since it was signed.
Actual behavior
It thinks the file has been modified:
.\FileSignedWithUnixLineEndings.ps1 : File FileSignedWithUnixLineEndings.ps1 cannot be
loaded. The contents of file FileSignedWithUnixLineEndings.ps1 may have been tampered
because the hash of the file does not match the hash stored in the digital signature. The
script will not execute on the system. Please see "get-help about_signing" for more
details..
At line:1 char:1
+ .\FileSignedWithUnixLineEndings.ps1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : SecurityError: (:) [], PSSecurityException
+ FullyQualifiedErrorId : UnauthorizedAccess