Add portable AKV signing for PowerShell scripts

.gitattributes

@@ -1,4 +1,5 @@
 # Fixture bytes are test inputs; do not let Git normalize line endings or encodings.
+tests/fixtures/msix-minimal/AppxManifest.xml -text
 tests/fixtures/*.js -text
 tests/fixtures/*.ps1 -text
 tests/fixtures/*.psd1 -text

.github/workflows/release.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: Release version to build/publish (for example 0.6.0)
+        description: Release version to build/publish (for example 0.6.1)
         required: true
         type: string
       publish_nuget:

Cargo.toml

@@ -30,7 +30,7 @@ repository = "https://github.com/Devolutions/psign"
 
 [package]
 name = "psign"
-version = "0.6.0"
+version = "0.6.1"
 edition = "2024"
 description = "Rust port of the Windows SDK signtool.exe (Authenticode sign/verify/timestamp) with portable digest helpers."
 license.workspace = true
@@ -46,9 +46,11 @@ default = [
 ]
 ## Azure Key Vault signing (`AuthenticatorDigestSign` callback + REST); enables Azure-shaped CLI flags on `sign`.
 azure-kv-sign = [
+    "dep:psign-portable-core",
     "dep:psign-azure-kv-rest",
     "dep:reqwest",
     "psign-digest-cli/azure-kv-sign-portable",
+    "psign-portable-core/azure-kv-sign",
 ]
 ## Azure Artifact Signing / Trusted Signing **data-plane** hash signing (REST LRO); experimental helper command `artifact-signing-submit`.
 artifact-signing-rest = [

PowerShell/Devolutions.Psign/Devolutions.Psign.psd1

@@ -1,6 +1,6 @@
 @{
     RootModule = 'Devolutions.Psign.psm1'
-    ModuleVersion = '0.6.0'
+    ModuleVersion = '0.6.1'
     GUID = 'e6e50e4b-bf25-4ed6-a343-49f904e79f8f'
     Author = 'Devolutions'
     CompanyName = 'Devolutions'

README.md

@@ -66,7 +66,7 @@ dotnet tool run psign-tool -- --help
 Create local dotnet tool packages from prebuilt release artifacts:
 
 ```powershell
-pwsh ./nuget/pack-psign-dotnet-tool.ps1 -Version 0.6.0 -ArtifactsRoot ./dist -OutputDir ./dist/nuget
+pwsh ./nuget/pack-psign-dotnet-tool.ps1 -Version 0.6.1 -ArtifactsRoot ./dist -OutputDir ./dist/nuget
 ```
 
 The package is built from native `psign-tool` artifacts for `win-x64`, `win-arm64`, `linux-x64`, `linux-arm64`, `osx-x64`, and `osx-arm64`, plus an `any` fallback package for unsupported runtimes.

crates/psign-authenticode-trust/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "psign-authenticode-trust"
-version = "0.6.0"
+version = "0.6.1"
 edition = "2024"
 description = "Portable Authenticode PKCS#7 trust verification (anchors, chain, EKU) using picky-rs"
 license.workspace = true

crates/psign-azure-kv-rest/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "psign-azure-kv-rest"
-version = "0.6.0"
+version = "0.6.1"
 edition = "2024"
 description = "Azure Key Vault certificate metadata + keys/sign REST (portable, blocking HTTP)"
 license.workspace = true

crates/psign-codesigning-rest/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "psign-codesigning-rest"
-version = "0.6.0"
+version = "0.6.1"
 edition = "2024"
 description = "Azure Code Signing data-plane CertificateProfileOperations Sign LRO (portable, blocking HTTP)"
 license.workspace = true

crates/psign-digest-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "psign-digest-cli"
-version = "0.6.0"
+version = "0.6.1"
 edition = "2024"
 description = "Linux/macOS-friendly CLI over portable Authenticode SIP digests (psign-sip-digest)"
 license.workspace = true

crates/psign-opc-sign/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "psign-opc-sign"
-version = "0.6.0"
+version = "0.6.1"
 edition = "2024"
 description = "Portable OPC, VSIX, and NuGet package signing primitives"
 license.workspace = true

crates/psign-portable-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "psign-portable-core"
-version = "0.6.0"
+version = "0.6.1"
 edition = "2024"
 description = "Reusable portable Authenticode signing and inspection APIs for psign"
 license.workspace = true

crates/psign-portable-core/src/lib.rs

@@ -311,6 +311,8 @@ pub struct PortableSignRequest {
     #[serde(default)]
     pub azure_key_vault_certificate: Option<String>,
     #[serde(default)]
+    pub azure_key_vault_certificate_version: Option<String>,
+    #[serde(default)]
     pub azure_key_vault_access_token: Option<String>,
     #[serde(default)]
     pub azure_key_vault_client_id: Option<String>,
@@ -320,6 +322,8 @@ pub struct PortableSignRequest {
     pub azure_key_vault_tenant_id: Option<String>,
     #[serde(default)]
     pub azure_key_vault_managed_identity: Option<bool>,
+    #[serde(default)]
+    pub azure_authority: Option<String>,
     // Azure Artifact Signing / Trusted Signing
     #[serde(default)]
     pub artifact_signing_endpoint: Option<String>,
@@ -367,11 +371,13 @@ impl Default for PortableSignRequest {
             timestamp_hash_algorithm: None,
             azure_key_vault_url: None,
             azure_key_vault_certificate: None,
+            azure_key_vault_certificate_version: None,
             azure_key_vault_access_token: None,
             azure_key_vault_client_id: None,
             azure_key_vault_client_secret: None,
             azure_key_vault_tenant_id: None,
             azure_key_vault_managed_identity: None,
+            azure_authority: None,
             artifact_signing_endpoint: None,
             artifact_signing_account_name: None,
             artifact_signing_profile_name: None,
@@ -1437,11 +1443,16 @@ fn load_azure_key_vault_signing_provider(request: &PortableSignRequest) -> Resul
         tenant_id: request.azure_key_vault_tenant_id.as_deref(),
         client_id: request.azure_key_vault_client_id.as_deref(),
         client_secret: request.azure_key_vault_client_secret.as_deref(),
-        authority: None,
+        authority: request.azure_authority.as_deref(),
     };
     let token = psign_azure_kv_rest::acquire_kv_access_token(&auth)?;
-    let key_vault_certificate =
-        psign_azure_kv_rest::fetch_kv_certificate(&http, &vault_url, &certificate, None, &token)?;
+    let key_vault_certificate = psign_azure_kv_rest::fetch_kv_certificate(
+        &http,
+        &vault_url,
+        &certificate,
+        request.azure_key_vault_certificate_version.as_deref(),
+        &token,
+    )?;
     let signer_cert_der = psign_azure_kv_rest::kv_decode_cer_b64(&key_vault_certificate.cer)?;
     let signer_cert =
         rdp::parse_certificate(&signer_cert_der).context("parse Key Vault signer certificate")?;
@@ -3889,11 +3900,13 @@ mod tests {
             timestamp_hash_algorithm: None,
             azure_key_vault_url: None,
             azure_key_vault_certificate: None,
+            azure_key_vault_certificate_version: None,
             azure_key_vault_access_token: None,
             azure_key_vault_client_id: None,
             azure_key_vault_client_secret: None,
             azure_key_vault_tenant_id: None,
             azure_key_vault_managed_identity: None,
+            azure_authority: None,
             artifact_signing_endpoint: None,
             artifact_signing_account_name: None,
             artifact_signing_profile_name: None,

crates/psign-portable-ffi/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "psign-portable-ffi"
-version = "0.6.0"
+version = "0.6.1"
 edition = "2024"
 description = "C ABI shared library for psign portable Authenticode operations"
 license.workspace = true

crates/psign-sip-digest/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "psign-sip-digest"
-version = "0.6.0"
+version = "0.6.1"
 edition = "2024"
 description = "Portable Authenticode SIP digest recomputation (PE, CAB, MSI, MSIX, scripts, …) without Win32"
 license.workspace = true