Skip to content

Commit 6315b7e

Browse files
sergei-pyshnoisergei-pyshnoi
authored
[Windows] Add signature validation (#8390)
1 parent 47a634e commit 6315b7e

26 files changed

+122
-59
lines changed

‎images/win/scripts/ImageHelpers/ImageHelpers.psm1‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,4 +57,5 @@ Export-ModuleMember -Function @(
5757
'Get-ModuleVersionAsJob'
5858
'Use-ChecksumComparison'
5959
'Get-HashFromGitHubReleaseBody'
60+
'Test-FileSignature'
6061
)

‎images/win/scripts/ImageHelpers/InstallHelpers.ps1‎

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ function Install-Binary
2929
[Parameter(Mandatory, ParameterSetName="LocalPath")]
3030
[String] $FilePath,
3131
[String[]] $ArgumentList,
32-
[String] $ExpectedSignature
32+
[String[]] $ExpectedSignature
3333
)
3434

3535
if ($PSCmdlet.ParameterSetName -eq "LocalPath")
@@ -47,14 +47,13 @@ function Install-Binary
4747
if ($ExpectedSignature)
4848
{
4949
Test-FileSignature -FilePath $filePath -ExpectedThumbprint $ExpectedSignature
50-
5150
}
5251
else
5352
{
5453
throw "ExpectedSignature parameter is specified, but no signature is provided."
5554
}
5655
}
57-
56+
5857
# MSI binaries should be installed via msiexec.exe
5958
$fileExtension = ([System.IO.Path]::GetExtension($Name)).Replace(".", "")
6059
if ($fileExtension -eq "msi")
@@ -722,18 +721,27 @@ function Test-FileSignature {
722721
[Parameter(Mandatory=$true)]
723722
[string]$FilePath,
724723
[Parameter(Mandatory=$true)]
725-
[string]$ExpectedThumbprint
724+
[string[]]$ExpectedThumbprint
726725
)
727-
726+
728727
$signature = Get-AuthenticodeSignature $FilePath
729-
728+
730729
if ($signature.Status -ne "Valid") {
731730
throw "Signature status is not valid. Status: $($signature.Status)"
732731
}
733-
734-
if ($signature.SignerCertificate.Thumbprint.Contains($ExpectedThumbprint) -ne $true) {
735-
throw "Signature thumbprint do not match expected"
732+
733+
foreach ($thumbprint in $ExpectedThumbprint) {
734+
if ($signature.SignerCertificate.Thumbprint.Contains($thumbprint)) {
735+
Write-Output "Signature for $FilePath is valid"
736+
$signatureMatched = $true
737+
return
738+
}
736739
}
737740

738-
Write-Output "Signature for $FilePath is valid"
741+
if ($signatureMatched) {
742+
Write-Output "Signature for $FilePath is valid"
743+
}
744+
else {
745+
throw "Signature thumbprint do not match expected."
746+
}
739747
}

‎images/win/scripts/ImageHelpers/VisualStudioHelpers.ps1‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,8 @@ Function Install-VisualStudio {
2828
[Parameter(Mandatory)] [String] $Edition,
2929
[Parameter(Mandatory)] [String] $Channel,
3030
[Parameter(Mandatory)] [String[]] $RequiredComponents,
31-
[String] $ExtraArgs = ""
31+
[String] $ExtraArgs = "",
32+
[Parameter(Mandatory)] [String] $SignatureThumbprint
3233
)
3334

3435
$bootstrapperUrl = "https://aka.ms/vs/${Version}/${Channel}/vs_${Edition}.exe"
@@ -40,6 +41,9 @@ Function Install-VisualStudio {
4041
$BootstrapperName = [IO.Path]::GetFileName($BootstrapperUrl)
4142
$bootstrapperFilePath = Start-DownloadWithRetry -Url $BootstrapperUrl -Name $BootstrapperName
4243

44+
# Verify that the bootstrapper is signed by Microsoft
45+
Test-FileSignature -FilePath $bootstrapperFilePath -ExpectedThumbprint $SignatureThumbprint
46+
4347
try {
4448
Write-Host "Enable short name support on Windows needed for Xamarin Android AOT, defaults appear to have been changed in Azure VMs"
4549
$shortNameEnableProcess = Start-Process -FilePath fsutil.exe -ArgumentList ('8dot3name', 'set', '0') -Wait -PassThru
@@ -124,4 +128,4 @@ function Get-VisualStudioComponents {
124128
(Get-VisualStudioInstance).Packages | Where-Object type -in 'Component', 'Workload' |
125129
Sort-Object Id, Version | Select-Object @{n = 'Package'; e = {$_.Id}}, Version |
126130
Where-Object { $_.Package -notmatch "[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}" }
127-
}
131+
}

‎images/win/scripts/Installers/Install-AWS.ps1‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@ Choco-Install -PackageName awscli
1010
# Install Session Manager Plugin for the AWS CLI
1111
$sessionManagerName = "SessionManagerPluginSetup.exe"
1212
$sessionManagerUrl = "https://s3.amazonaws.com/session-manager-downloads/plugin/latest/windows/$sessionManagerName"
13-
Install-Binary -Url $sessionManagerUrl -Name $sessionManagerName -ArgumentList ("/silent", "/install")
13+
$sessionManagerSignatureThumbprint = "FF457E5732E98A9F156E657F8CC7C4432507C3BB"
14+
Install-Binary -Url $sessionManagerUrl -Name $sessionManagerName -ArgumentList ("/silent", "/install") -ExpectedSignature $sessionManagerSignatureThumbprint
1415
$env:Path = $env:Path + ";$env:ProgramFiles\Amazon\SessionManagerPlugin\bin"
1516

1617
# Install AWS SAM CLI

‎images/win/scripts/Installers/Install-AzureCli.ps1‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,8 @@ ${env:AZURE_CONFIG_DIR} = $azureCliConfigPath
1313

1414
#temporary pin 2.52.0 version
1515
$azCliUrl = 'https://azcliprod.blob.core.windows.net/msi/azure-cli-2.52.0-x64.msi'
16-
Install-Binary -Url $azCliUrl -Name 'azure-cli.msi'
16+
$azCliSignatureThumbprint = "72105B6D5F370B62FD5C82F1512F7AD7DEE5F2C0"
17+
Install-Binary -Url $azCliUrl -Name 'azure-cli.msi' -ExpectedSignature $azCliSignatureThumbprint
1718

1819
$azureCliExtensionPath = Join-Path $Env:CommonProgramFiles 'AzureCliExtensionDirectory'
1920
$null = New-Item -ItemType 'Directory' -Path $azureCliExtensionPath

‎images/win/scripts/Installers/Install-AzureCosmosDbEmulator.ps1‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@
55

66
$InstallerName = "AzureCosmosDBEmulator.msi"
77
$InstallerUrl = "https://aka.ms/cosmosdb-emulator"
8+
$SignatureThumbprint = "F372C27F6E052A6BE8BAB3112B465C692196CD6F"
89

9-
Install-Binary -Url $InstallerUrl -Name $InstallerName
10+
Install-Binary -Url $InstallerUrl -Name $InstallerName -ExpectedSignature $SignatureThumbprint
1011

11-
Invoke-PesterTests -TestFile "Tools" -TestName "Azure Cosmos DB Emulator"
12+
Invoke-PesterTests -TestFile "Tools" -TestName "Azure Cosmos DB Emulator"

‎images/win/scripts/Installers/Install-BizTalkBuildComponent.ps1‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,11 +73,16 @@ Write-Host "Unzip $setupZipFile to $setupPath..."
7373
Extract-7Zip -Path $setupZipFile -DestinationPath $setupPath
7474
Remove-Item $setupZipFile
7575

76+
# Verify signature
77+
$BuildComponentSignatureThumbprint = "8740DF4ACB749640AD318E4BE842F72EC651AD80"
78+
Test-FileSignature -FilePath "$setupPath\Bootstrap.msi" -ExpectedThumbprint $BuildComponentSignatureThumbprint
79+
Test-FileSignature -FilePath "$setupPath\BuildComponentSetup.msi" -ExpectedThumbprint $BuildComponentSignatureThumbprint
80+
7681
# Install
7782
Install-Msi -MsiPath "$setupPath\Bootstrap.msi" -LogPath "$setupPath\bootstrap.log"
7883
Install-Msi -MsiPath "$setupPath\BuildComponentSetup.msi" -LogPath "$setupPath\buildComponentSetup.log"
7984

8085
Remove-Item $setupPath -Recurse -Force
8186

8287
# Test
83-
Invoke-PesterTests -TestFile "BizTalk" -TestName "BizTalk Build Component Setup"
88+
Invoke-PesterTests -TestFile "BizTalk" -TestName "BizTalk Build Component Setup"

‎images/win/scripts/Installers/Install-Choco.ps1‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,11 @@ if ($userPath) {
1717
$env:Path = $systemPath
1818
}
1919

20-
# Run the installer
21-
Invoke-Expression ((new-object net.webclient).DownloadString('https://chocolatey.org/install.ps1'))
20+
# Verify and run choco installer
21+
$signatureThumbprint = "83AC7D88C66CB8680BCE802E0F0F5C179722764B"
22+
$InstallScriptPath = Start-DownloadWithRetry -Url 'https://chocolatey.org/install.ps1'
23+
Test-FileSignature -FilePath $InstallScriptPath -ExpectedThumbprint $signatureThumbprint
24+
Invoke-Expression $InstallScriptPath
2225

2326
# Turn off confirmation
2427
choco feature enable -n allowGlobalConfirmation

‎images/win/scripts/Installers/Install-Chrome.ps1‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,10 @@
44
################################################################################
55

66
# Download and install latest Chrome browser
7+
$ChromeSignatureThumbprint = "2673EA6CC23BEFFDA49AC715B121544098A1284C"
78
$ChromeInstallerFile = "googlechromestandaloneenterprise64.msi"
89
$ChromeInstallerUrl = "https://dl.google.com/tag/s/dl/chrome/install/${ChromeInstallerFile}"
9-
Install-Binary -Url $ChromeInstallerUrl -Name $ChromeInstallerFile -ArgumentList @()
10+
Install-Binary -Url $ChromeInstallerUrl -Name $ChromeInstallerFile -ArgumentList @() -ExpectedSignature $ChromeSignatureThumbprint
1011

1112
# Prepare firewall rules
1213
Write-Host "Adding the firewall rule for Google update blocking..."
@@ -84,4 +85,4 @@ $PathValue = Get-ItemPropertyValue -Path $regEnvKey -Name 'Path'
8485
$PathValue += ";$ChromeDriverPath\"
8586
Set-ItemProperty -Path $regEnvKey -Name 'Path' -Value $PathValue
8687

87-
Invoke-PesterTests -TestFile "Browsers" -TestName "Chrome"
88+
Invoke-PesterTests -TestFile "Browsers" -TestName "Chrome"

‎images/win/scripts/Installers/Install-CloudFoundryCli.ps1‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,8 @@ Extract-7Zip -Path $CloudFoundryArchPath -DestinationPath $CloudFoundryCliPath
2020
# Add cf to path
2121
Add-MachinePathItem $CloudFoundryCliPath
2222

23-
Invoke-PesterTests -TestFile "CLI.Tools" -TestName "CloudFoundry CLI"
23+
# Validate cf signature
24+
$CloudFoundrySignatureThumbprint = "4C69EDD13930ED01B83DD1D17B09C434DC1F2177"
25+
Test-FileSignature -FilePath "$CloudFoundryCliPath\cf.exe" -ExpectedThumbprint $CloudFoundrySignatureThumbprint
26+
27+
Invoke-PesterTests -TestFile "CLI.Tools" -TestName "CloudFoundry CLI"

0 commit comments

Comments
 (0)