Raised during the independent review of #194.
tests/Get-PSBuildCertificate.tests.ps1 guards the store-backed tests with:
On Windows PowerShell 5.1 $IsWindows does not exist, so it evaluates to $null, -not $null is $true, and the tests skip — on Windows.
Why it matters
The guard excludes more than its own comment claims. The comment justifies it by saying the certificate provider that backs -CodeSigningCert exists only on Windows, which is about platform, not edition. The effect is that the Store and Thumbprint paths — including the SkipCertificateValidation fallback added in #194 — are never exercised in CI on Windows PowerShell 5.1, the engine where store-based code signing is most common.
The product code gets this right; Get-PSBuildCertificate.ps1 uses the correct shape:
# $IsWindows does not exist on Windows PowerShell 5.1 (Desktop edition), where it is $null
# and the platform is always Windows; only treat the platform as non-Windows when $IsWindows
# is explicitly $false (PowerShell 7+ on Linux/macOS).
if ($null -ne $IsWindows -and -not $IsWindows) {So the tests use the inverted-by-accident form of a pattern the module itself documents twelve lines away.
Suggested fix
-Skip:($null -ne $IsWindows -and -not $IsWindows)
This is not confined to the tests #194 added — it is the existing convention throughout the file, so the whole file wants the same correction and this should be done in one pass rather than per-test.
Before changing it
The reviewer ran the #194 fallback end to end under powershell.exe 5.1 against a real expired self-signed code-signing certificate and it behaved as designed, so the product works there. What is unverified is whether the mocked tests pass on 5.1 — Mock -ModuleName PowerShellBuild -CommandName Get-ChildItem with the -CodeSigningCert dynamic parameter may behave differently on the older engine. Un-skipping them could surface real failures in the tests rather than in the code.
Do this as its own change so that if the 5.1 legs do fail, the diagnosis is not tangled up with an unrelated feature.
Raised during the independent review of #194.
tests/Get-PSBuildCertificate.tests.ps1guards the store-backed tests with:On Windows PowerShell 5.1
$IsWindowsdoes not exist, so it evaluates to$null,-not $nullis$true, and the tests skip — on Windows.Why it matters
The guard excludes more than its own comment claims. The comment justifies it by saying the certificate provider that backs
-CodeSigningCertexists only on Windows, which is about platform, not edition. The effect is that theStoreandThumbprintpaths — including theSkipCertificateValidationfallback added in #194 — are never exercised in CI on Windows PowerShell 5.1, the engine where store-based code signing is most common.The product code gets this right;
Get-PSBuildCertificate.ps1uses the correct shape:So the tests use the inverted-by-accident form of a pattern the module itself documents twelve lines away.
Suggested fix
This is not confined to the tests #194 added — it is the existing convention throughout the file, so the whole file wants the same correction and this should be done in one pass rather than per-test.
Before changing it
The reviewer ran the #194 fallback end to end under
powershell.exe5.1 against a real expired self-signed code-signing certificate and it behaved as designed, so the product works there. What is unverified is whether the mocked tests pass on 5.1 —Mock -ModuleName PowerShellBuild -CommandName Get-ChildItemwith the-CodeSigningCertdynamic parameter may behave differently on the older engine. Un-skipping them could surface real failures in the tests rather than in the code.Do this as its own change so that if the 5.1 legs do fail, the diagnosis is not tangled up with an unrelated feature.