Security

Invoke-sqmSignModule

Signs all PowerShell script files (.ps1, .psm1, .psd1) in a module directory using Authenticode (SHA-256). Designed to run before each release. Supports PFX files, certificate thumbprints, and auto-detection. Falls back to a secondary TSA on timestamp server failure.

Module: sqmSQLTool
dbatools: No
ShouldProcess: Yes (Medium)
Output: List<PSCustomObject>

Execution Flow

START Resolve ModulePath (param / PSScriptRoot) Cert source? PFX / Thumbprint / Auto PFX Load PFX Thumbprint Search in store Validate cert: CodeSign EKU · not expired · has private key throw error Get-ChildItem -Recurse (*.ps1 / *.psm1 / *.psd1) foreach file Signature valid && !Force? Yes → skip Status=Skipped No ShouldProcess? WhatIf WhatIf Set-AuthenticodeSignature SHA-256 (primary TSA) TSA failed? Yes → retry Fallback TSA (Sectigo) OK Summary log · results → clipboard DONE
Certificate resolution order: 1. -CertificatePath (PFX) → 2. -CertificateThumbprint (LocalMachine\My, then CurrentUser\My) → 3. Auto-detect (first valid, non-expired code signing cert in both stores). Files with a valid signature are skipped unless -Force.

Parameters

ParameterTypeRequiredDescription
-ModulePathStringOptionalRoot directory to sign recursively. Defaults to parent of $PSScriptRoot (auto-detect).
-CertificateThumbprintStringOptionalThumbprint of a certificate in LocalMachine\My or CurrentUser\My.
-CertificatePathStringOptionalPath to a .pfx file. Takes precedence over -CertificateThumbprint.
-CertificatePasswordSecureStringOptionalPassword for the PFX file.
-TimestampServerStringOptionalPrimary TSA URL. Default: http://timestamp.digicert.com. Fallback: http://timestamp.sectigo.com.
-IncludeExtensionsString[]OptionalFile extensions to sign. Default: @('.ps1', '.psm1', '.psd1').
-ForceSwitchOptionalRe-signs files that already carry a valid signature.

Return Value

Returns List<PSCustomObject> — one entry per file with: FilePath, FileName, Status (Signed / Skipped / Failed / WhatIf), PreviousStatus, Thumbprint, CertSubject, TimestampServer, ErrorMessage. Summary is also copied to the clipboard.

Examples

Example 1 — Auto-detect certificate

Invoke-sqmSignModule -ModulePath "C:\Dev\sqmSQLTool"

Example 2 — Sign with PFX file

$pwd = ConvertTo-SecureString "secret" -AsPlainText -Force
Invoke-sqmSignModule -ModulePath "C:\Dev\sqmSQLTool" -CertificatePath "C:\Certs\CodeSign.pfx" -CertificatePassword $pwd

Example 3 — WhatIf dry run

Invoke-sqmSignModule -ModulePath "C:\Dev\sqmSQLTool" -WhatIf

Example 4 — Force re-sign all files

Invoke-sqmSignModule -ModulePath "C:\Dev\sqmSQLTool" -CertificateThumbprint "AB12CD34EF56..." -Force