Skip updating signed PowerShell profiles - #171
Open
Lili离 (Uarz) wants to merge 2 commits into
Open
Conversation
Installing coreutils injects a managed section into the user's PowerShell profile. If that profile is Authenticode-signed (e.g. under an AllSigned execution policy), rewriting the file invalidates the signature and the profile no longer loads, breaking the user's shell. Detect signed profiles with Get-AuthenticodeSignature before writing: when a signature is present (Status != NotSigned), skip the injection for that profile and emit a warning instead of silently corrupting it. Fixes microsoft#161
Leonard Hecker (lhecker)
approved these changes
Aug 31, 2026
Comment on lines
-89
to
-91
| $profile = Get-Item -LiteralPath $Path -Force -ErrorAction Ignore | ||
| if ($profile) { | ||
| $Path = $profile.ResolvedTarget |
There was a problem hiding this comment.
This PR now piggy-backs a change where I do this early (down in the Add function), which allows me to clean up the Update-PowerShellProfile logic. The new Update-PowerShellProfile is much easier to read (no if/elseif).
Leonard Hecker (lhecker)
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #161.
When coreutils installs/refreshes, it injects a managed section into the user's PowerShell profile (
src/pwsh-install.ps1→Update-PowerShellProfile). If that profile is Authenticode-signed (e.g. the user runs under anAllSigned/RemoteSigned-with-signing setup), rewriting the file invalidates the signature, so PowerShell refuses to load the profile and the user's shell breaks.As discussed in #161 (with Leonard Hecker (@lhecker)), the safe fix is to detect signed profiles and abort the injection rather than silently corrupt them.
Change
In
Update-PowerShellProfile, before any read/strip/write, check the existing profile withGet-AuthenticodeSignature. If a signature is present (Status -ne 'NotSigned'), skip the file and emit aWrite-Warningexplaining why coreutils commands won't be available in that profile.This applies uniformly to install / refresh / uninstall, so we never touch (and therefore never break) a signed profile. Untrusted / hash-mismatched signatures are also skipped, since modifying them only makes things worse; the user can re-sign manually after removing the section.
Validation
pwsh -NoProfileparse check of the edited script: 0 syntax errors.Get-AuthenticodeSignature→NotSigned): not skipped (normal install/refresh proceeds) — regression guard passes.CodeSigningCert, signed viaSet-AuthenticodeSignature→Status = UnknownError, i.e.!= NotSigned): skipped with the warning, signature preserved.Behavior is unchanged for the overwhelming common case (unsigned profiles); only signed profiles are now protected.