PowerShell scripts should have valid signatures

[jspaquet]

Describe the bug
PowerShell scripts should have valid signatures to allow running on systems with ExecutionPolicy set to AllSigned via GPO.

Environment

• OS: Windows
• Compiler: N/A

To Reproduce
Steps to reproduce the behavior:

1. Get-AuthenticodeSignature -FilePath .\scripts\bootstrap.ps1
2. Get-AuthenticodeSignature -FilePath .\scripts\buildsystems\msbuild\applocal.ps1

Expected behavior
Signature should be successfully verified.

Failure logs

• N/A

Additional context
There might be more PowerShell scripts needed, these are the only two I ran across.

[MonicaLiu0311]

The result are as follows:

PS F:\vcpkg> Get-AuthenticodeSignature -FilePath .\scripts\bootstrap.ps1


    Directory: F:\vcpkg\scripts


SignerCertificate                         Status                                                          Path
-----------------                         ------                                                          ----
                                          NotSigned                                                       bootstrap.ps1


PS F:\vcpkg> Get-AuthenticodeSignature -FilePath .\scripts\buildsystems\msbuild\applocal.ps1


    Directory: F:\vcpkg\scripts\buildsystems\msbuild


SignerCertificate                         Status                                                          Path
-----------------                         ------                                                          ----
8740DF4ACB749640AD318E4BE842F72EC651AD80  HashMismatch                                                    applocal.ps1

[MonicaLiu0311]

@BillyONeal Please help take a look at this issue.

[BillyONeal]

Looks like it was broken in May 2023 with nobody noticing: #29894

There was an attempted fix March 2024: #37820
which was reverted almost immediately: #37843

As a workaround for now you can grab https://github.com/microsoft/vcpkg-tool/releases/download/2025-02-11/applocal.ps1

[BillyONeal]

Looks like it was broken in May 2023 with nobody noticing: #29894

There was an attempted fix March 2024: #37820 which was reverted almost immediately: #37843

To clarify, this is about applocal.ps1 only, not bootstrap. I'm not sure if we have a good story for that one. Once upon a time we had URIs in there which made signing it somewhat impractical; after #32677 it might be doable now. Will consider for next tool release.