pwsh.exe shim from .NET tool install is not signed

[mthalman]

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest released version
• Search the existing issues.
• Refer to the FAQ.
• Refer to Differences between Windows PowerShell 5.1 and PowerShell.

Steps to reproduce

dotnet tool install --global PowerShell

Expected behavior

`%USERPROFILE%\.dotnet\tools\pwsh.exe` should be a signed file

This is particularly needed for the .NET SDK container images which [install PowerShell as a global tool](https://github.com/dotnet/dotnet-docker/blob/6ba62d6825b9f45b3d665ab6cc930808a40d63c6/src/sdk/8.0/nanoserver-ltsc2022/amd64/Dockerfile#L39-L47).

Actual behavior

`%USERPROFILE%\.dotnet\tools\pwsh.exe` is unsigned

Error details

No response

Environment data

PowerShell 7.3.8

Visuals

No response

[mthalman]

There is documentation for how this shim can be predelivered rather than generated at install time. This would allow PowerShell to deliver a signed version of it.

https://github.com/dotnet/sdk/blob/main/documentation/general/signing-global-tool-packages.md

[SteveL-MSFT]

cc @adityapatwardhan

[microsoft-github-policy-service]

📣 Hey @mthalman, how did we do? We would love to hear your feedback with the link below! 🗣️

🔗 https://aka.ms/PSRepoFeedback

Microsoft Forms