From e577906f22eca26d3824caef9d8d8a4fcc8b2a12 Mon Sep 17 00:00:00 2001 From: Trent Blackburn Date: Thu, 27 Aug 2026 22:09:12 -0400 Subject: [PATCH] docs: Name the timestamp protocol Set-AuthenticodeSignature actually uses build.properties.ps1 called Sign.TimestampServer an RFC 3161 timestamp server, and the README row carried that wording. It is not. Signed a file with Set-AuthenticodeSignature -TimestampServer against the configured default and read the resulting PKCS#7 back out. The signature carries a PKCS#9 counter-signature (1.2.840.113549.1.9.6) and contains no RFC 3161 token attribute (1.3.6.1.4.1.311.3.3.1) at all. Identical result on PowerShell 7 and Windows PowerShell 5.1. That is signtool's /t, not /tr. Nothing is broken, which is why this could sit unnoticed: timestamp.digicert.com answers both protocols, so signatures verify either way. It matters when a consumer picks a different provider, because several publish separate endpoints for the two protocols and an RFC 3161 only endpoint will not answer this request. Someone reading "RFC 3161" would configure exactly the wrong one. The wording predates the signing documentation added in #190, which faithfully copied it. Raised by the independent review of that pull request as a low confidence flag, and worth the check for the same reason as #193: an inline comment in this settings block describing behavior the code does not have. Closes #196 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01U1Jhu7fgTRJq7LK5MuKteE --- PowerShellBuild/build.properties.ps1 | 13 ++++++++++++- README.md | 2 +- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/PowerShellBuild/build.properties.ps1 b/PowerShellBuild/build.properties.ps1 index acd53cf..f8d4d6b 100644 --- a/PowerShellBuild/build.properties.ps1 +++ b/PowerShellBuild/build.properties.ps1 @@ -207,7 +207,18 @@ $moduleVersion = (Import-PowerShellDataFile -Path $env:BHPSModuleManifest).Modul # rather than a check layered on afterwards. SkipCertificateValidation = $false - # RFC 3161 timestamp server URI embedded in Authenticode signatures. + # Timestamp server URI embedded in Authenticode signatures, so a signature + # stays valid after the signing certificate expires. + # + # This is passed to Set-AuthenticodeSignature -TimestampServer, which uses the + # legacy Authenticode timestamp protocol -- the timestamp lands in the signature + # as a PKCS#9 counter-signature (1.2.840.113549.1.9.6), not as an RFC 3161 token + # (1.3.6.1.4.1.311.3.3.1). That is signtool's /t rather than /tr. Verified on both + # PowerShell 7 and Windows PowerShell 5.1; see psake/PowerShellBuild#196. + # + # It matters when choosing a different provider: several publish separate + # endpoints for the two protocols, and an RFC 3161 only endpoint will not answer + # this request. The default below serves both. TimestampServer = 'http://timestamp.digicert.com' # Authenticode hash algorithm. Valid values: SHA256, SHA384, SHA512, SHA1. diff --git a/README.md b/README.md index a66b930..3dfbf51 100644 --- a/README.md +++ b/README.md @@ -139,7 +139,7 @@ match your environment. | $PSBPreference.Sign.PfxFilePassword | `$null` | Password for the PFX/P12 file as a `SecureString`. Used by the `PfxFile` certificate source. | | $PSBPreference.Sign.Certificate | `$null` | A pre-resolved `X509Certificate2` object to sign with. When set, `CertificateSource` is ignored, which suits Azure Key Vault, an HSM, or another custom provider. | | $PSBPreference.Sign.SkipCertificateValidation | `$false` | Relax certificate validity checking. Skips every check for `EnvVar` and `PfxFile`, private key included. See [Code signing](#code-signing). | -| $PSBPreference.Sign.TimestampServer | `http://timestamp.digicert.com` | RFC 3161 timestamp server URI embedded in the signature so that it stays valid after the certificate expires. | +| $PSBPreference.Sign.TimestampServer | `http://timestamp.digicert.com` | Timestamp server URI embedded in the signature so it stays valid after the certificate expires. Legacy Authenticode protocol, not RFC 3161. | | $PSBPreference.Sign.HashAlgorithm | `SHA256` | Authenticode hash algorithm. Valid values are `SHA256`, `SHA384`, `SHA512`, and `SHA1`. `SHA1` is deprecated. | | $PSBPreference.Sign.FilesToSign | `@('*.psd1', '*.psm1', '*.ps1')` | Glob patterns of file names to sign, searched recursively under the module output directory. | | $PSBPreference.Sign.Catalog.Enabled | `$false` | Enable/disable creation and signing of a Windows catalog (`.cat`) file. Also requires `$PSBPreference.Sign.Enabled` to be `$true`. |