3 ms·

I'm definitely guilty of doing that the very few times I had to write a powershell script. But what's the alternative? What's the proper way of signing a scrip

I'm definitely guilty of doing that the very few times I had to write a powershell script. But what's the alternative? What's the proper way of signing a script, and how much work is it to do that?

hobs 9y ago
Just put your powershell file in an executable, its been around for ages. https://gallery.technet.microsoft.com/PS2EXE-Convert-PowerShell-9e4e07f1 https://gallery.technet.microsoft.com/PS2EXE-Convert-PowerSh... Read more on how to use it at https://redmondmag.com/articles/2017/01/27/convert-a-powershell-script-into-an-exe-file.aspx https://redmondmag.com/articles/2017/01/27/convert-a-powersh...
- userbinator 9y ago
  Over 18KB for a "Hello World" script (even a native EXE would be smaller)...? A "stub" batch file to execute it is a few dozen bytes at most. Then again, those using PS probably don't care about such things being small and efficient anyway.
  - hobs 9y ago
    I didn't downvote you, but consider that I answered the GP's question and solved a problem they are having, and you added some snark. There is plenty of talk in this space about trading off machine resources for programmer effectiveness, so while your gripe is technically accurate that ship has sailed long long ago.
- tveita 9y ago
  Then you'll have 3 files - the script, the exe, and a little bat file that reruns ps2exe for updates. :)
- henrikschroder 9y ago
  "Furthermore “script execution” have to be allowed (see cmdlet: set-execultionpolicy)." ...and we're back to square one. :-)
  - hobs 9y ago
    If it really needs that, https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/ https://blog.netspi.com/15-ways-to-bypass-the-powershell-exe...
Arnavion 9y ago
Well, in my experience the double-click-convenience of .bat files (due to their default cmd.exe association) is the reason people do this, not just the execution policy. To sign a script you run: Set-AuthenticodeSignature foo.ps1 $someCert and make sure that $someCert 's pubkey is available on every user's computer. The alternative is of course to get every user to run `Set-ExecutionPolicy Unrestricted` to solve the "problem" permanently.

I'm definitely guilty of doing that the very few times I had to write a powershell script. But what's the alternative? What's the proper way of signing a script, and how much work is it to do that?

hobs 9y ago

Just put your powershell file in an executable, its been around for ages. https://gallery.technet.microsoft.com/PS2EXE-Convert-PowerShell-9e4e07f1 https://gallery.technet.microsoft.com/PS2EXE-Convert-PowerSh... Read more on how to use it at https://redmondmag.com/articles/2017/01/27/convert-a-powershell-script-into-an-exe-file.aspx https://redmondmag.com/articles/2017/01/27/convert-a-powersh...

userbinator 9y ago
Over 18KB for a "Hello World" script (even a native EXE would be smaller)...? A "stub" batch file to execute it is a few dozen bytes at most. Then again, those using PS probably don't care about such things being small and efficient anyway.
- hobs 9y ago
  I didn't downvote you, but consider that I answered the GP's question and solved a problem they are having, and you added some snark. There is plenty of talk in this space about trading off machine resources for programmer effectiveness, so while your gripe is technically accurate that ship has sailed long long ago.
tveita 9y ago
Then you'll have 3 files - the script, the exe, and a little bat file that reruns ps2exe for updates. :)
henrikschroder 9y ago
"Furthermore “script execution” have to be allowed (see cmdlet: set-execultionpolicy)." ...and we're back to square one. :-)
- hobs 9y ago
  If it really needs that, https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/ https://blog.netspi.com/15-ways-to-bypass-the-powershell-exe...

Arnavion 9y ago

Well, in my experience the double-click-convenience of .bat files (due to their default cmd.exe association) is the reason people do this, not just the execution policy. To sign a script you run: Set-AuthenticodeSignature foo.ps1 $someCert and make sure that $someCert 's pubkey is available on every user's computer. The alternative is of course to get every user to run `Set-ExecutionPolicy Unrestricted` to solve the "problem" permanently.