Skip to content

Fix Windows signer subject verification quoting #583

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AnthonyRonning merged 1 commit into from
Jun 25, 2026
Merged

Fix Windows signer subject verification quoting #583

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions scripts/ci/_common.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3631,11 +3631,16 @@ verify_windows_authenticode_signatures() {
ps_args+=("$(to_windows_path "${file}")")
done

# Keep the expected subject in the environment. Passing it as a positional
# argument through Git Bash into pwsh can split values that contain spaces.
# shellcheck disable=SC2016
pwsh -NoLogo -NoProfile -ExecutionPolicy Bypass -Command '
$ErrorActionPreference = "Stop"
$expectedSubject = $args[0]
foreach ($file in $args[1..($args.Count - 1)]) {
$expectedSubject = $env:MAPLE_WINDOWS_AUTHENTICODE_SUBJECT
if ([string]::IsNullOrWhiteSpace($expectedSubject)) {
throw "MAPLE_WINDOWS_AUTHENTICODE_SUBJECT is required to verify the Windows signer identity."
}
foreach ($file in $args) {
$signature = Get-AuthenticodeSignature -LiteralPath $file
if ($signature.Status -ne "Valid") {
throw "Authenticode signature is not valid for $file. Status=$($signature.Status) Message=$($signature.StatusMessage)"
Expand All @@ -3651,7 +3656,7 @@ verify_windows_authenticode_signatures() {
}
Write-Host ("verified-windows-authenticode {0} subject={1} issuer={2}" -f $file, $subject, $issuer)
}
' "${MAPLE_WINDOWS_AUTHENTICODE_SUBJECT}" "${ps_args[@]}"
' "${ps_args[@]}"
}

import_apple_developer_certificate() {
Expand Down
Loading