René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"macOS pwsh binary for v7.4.4 is not code signed","articleBody":"### Prerequisites\n\n- [X] Write a descriptive title.\n- [X] Make sure you are able to repro it on the [latest released version](https://github.com/PowerShell/PowerShell/releases)\n- [X] Search the existing issues.\n- [X] Refer to the [FAQ](https://github.com/PowerShell/PowerShell/blob/master/docs/FAQ.md).\n- [X] Refer to [Differences between Windows PowerShell 5.1 and PowerShell](https://learn.microsoft.com/powershell/scripting/whats-new/differences-from-windows-powershell).\n\n### Steps to reproduce\n\nThe `pwsh` binary for version 7.4.4, located at `/usr/local/microsoft/powershell/7/pwsh` (symlinked to `/usr/local/bin/pwsh`) is not code signed, and was in previous releases, most recently 7.4.2. \r\n\r\nThis constitutes a security issue as there is no way to confirm `pwsh` has not been modified without a valid Microsoft application signature attached.\n\n### Expected behavior\n\n```console\nRunning `codesign -dvv` on the 7.4.4 binary shows a proper certificate chain with Microsoft's signing authority and team identifier, like is displayed with the 7.4.2 release:\r\n\r\n\r\n➜  Payload codesign -dvv usr/local/microsoft/powershell/7/pwsh\r\nExecutable=/private/tmp/powershell-7.4.2-osx-arm64.pkg/powershell-7.4.2.pkg/Payload/usr/local/microsoft/powershell/7/pwsh\r\nIdentifier=apphost-55554944334c276ec52934338e28e21fac52c69a\r\nFormat=Mach-O thin (arm64)\r\nCodeDirectory v=20400 size=1044 flags=0x0(none) hashes=26+2 location=embedded\r\nSignature size=9013\r\nAuthority=Developer ID Application: Microsoft Corporation (UBF8T346G9)\r\nAuthority=Developer ID Certification Authority\r\nAuthority=Apple Root CA\r\nTimestamp=Apr 9, 2024 at 6:11:26 PM\r\nInfo.plist=not bound\r\nTeamIdentifier=UBF8T346G9\r\nSealed Resources=none\r\nInternal requirements count=1 size=208\r\n```\n```\n\n\n### Actual behavior\n\n```console\nRunning `codesign -dvv` on the 7.4.4 binary shows an ad hoc signature with no way to validate integrity and confirm it is a genuine Microsoft release:\r\n\r\n\r\n➜  Payload codesign -dvv usr/local/microsoft/powershell/7/pwsh\r\nExecutable=/private/tmp/powershell-7.4.4-osx-arm64.pkg/powershell-7.4.4.pkg/Payload/usr/local/microsoft/powershell/7/pwsh\r\nIdentifier=apphost-55554944ebbb141c7c103d9ebac3a924d1f83baa\r\nFormat=Mach-O thin (arm64)\r\nCodeDirectory v=20400 size=1033 flags=0x2(adhoc) hashes=26+2 location=embedded\r\nSignature=adhoc\r\nInfo.plist=not bound\r\nTeamIdentifier=not set\r\nSealed Resources=none\r\nInternal requirements count=0 size=12\r\n```\n```\n\n\n### Error details\n\n_No response_\n\n### Environment data\n\n```powershell\nName                           Value\r\n----                           -----\r\nPSVersion                      7.4.4\r\nPSEdition                      Core\r\nGitCommitId                    7.4.4\r\nOS                             Darwin 23.1.0 Darwin Kernel Version 23.1.0: Mon Oct  9 21:26:29 PDT 2023; root:xnu-10002.41.9~6/RELEASE_ARM64_VM…\r\nPlatform                       Unix\r\nPSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}\r\nPSRemotingProtocolVersion      2.3\r\nSerializationVersion           1.1.0.1\r\nWSManStackVersion              3.0\r\n```\n```\n\n\n### Visuals\n\n_No response_","author":{"url":"https://github.com/NoahRJ","@type":"Person","name":"NoahRJ"},"datePublished":"2024-07-25T14:51:38.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":5},"url":"https://github.com/24088/PowerShell/issues/24088"}