generated from MrSphay/codex-agent-repository-kit
91 lines
3.9 KiB
PowerShell
91 lines
3.9 KiB
PowerShell
[CmdletBinding(SupportsShouldProcess)]
|
|
param(
|
|
[string]$CertificatePath = ".\assets\certificates\MrSphay-LocalTrust-Root.cer",
|
|
[string]$PublisherCertificatePath = ".\assets\certificates\MrSphay-CodeSigning.cer",
|
|
[ValidateSet("CurrentUser", "LocalMachine")]
|
|
[string]$Scope = "CurrentUser"
|
|
)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
function Resolve-FullPath {
|
|
param([Parameter(Mandatory)][string]$Path)
|
|
|
|
$executionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath($Path)
|
|
}
|
|
|
|
function Test-IsAdministrator {
|
|
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
|
|
$principal = [Security.Principal.WindowsPrincipal]::new($identity)
|
|
$principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
|
|
}
|
|
|
|
$resolvedCertificatePath = Resolve-FullPath $CertificatePath
|
|
if (-not (Test-Path -LiteralPath $resolvedCertificatePath)) {
|
|
throw "Certificate file not found: $resolvedCertificatePath. Run scripts\New-MrTrustCertificate.ps1 first or provide -CertificatePath."
|
|
}
|
|
|
|
if ($Scope -eq "LocalMachine" -and -not (Test-IsAdministrator)) {
|
|
throw "LocalMachine installation requires an elevated PowerShell session. Use -Scope CurrentUser or run as Administrator."
|
|
}
|
|
|
|
$rootCertificate = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($resolvedCertificatePath)
|
|
if (-not $rootCertificate.Subject.StartsWith("CN=MrSphay", [System.StringComparison]::OrdinalIgnoreCase)) {
|
|
throw "Refusing to install an unexpected root certificate subject: $($rootCertificate.Subject)"
|
|
}
|
|
|
|
$resolvedPublisherCertificatePath = Resolve-FullPath $PublisherCertificatePath
|
|
$publisherCertificate = $null
|
|
if (Test-Path -LiteralPath $resolvedPublisherCertificatePath) {
|
|
$publisherCertificate = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($resolvedPublisherCertificatePath)
|
|
if (-not $publisherCertificate.Subject.StartsWith("CN=MrSphay", [System.StringComparison]::OrdinalIgnoreCase)) {
|
|
throw "Refusing to install an unexpected publisher certificate subject: $($publisherCertificate.Subject)"
|
|
}
|
|
}
|
|
|
|
$rootStore = "Cert:\$Scope\Root"
|
|
$publisherStore = "Cert:\$Scope\TrustedPublisher"
|
|
|
|
Write-Host "MrTrust will install this certificate as trusted for scope '$Scope':"
|
|
Write-Host " Root subject: $($rootCertificate.Subject)"
|
|
Write-Host " Root issuer: $($rootCertificate.Issuer)"
|
|
Write-Host " Root thumbprint: $($rootCertificate.Thumbprint)"
|
|
Write-Host " Root expires: $($rootCertificate.NotAfter.ToString('yyyy-MM-dd HH:mm:ss'))"
|
|
if ($publisherCertificate) {
|
|
Write-Host " Publisher subject: $($publisherCertificate.Subject)"
|
|
Write-Host " Publisher thumbprint: $($publisherCertificate.Thumbprint)"
|
|
}
|
|
else {
|
|
Write-Warning "Publisher certificate not found at $resolvedPublisherCertificatePath. Only the root certificate will be installed."
|
|
}
|
|
Write-Host ""
|
|
Write-Warning "Only continue if you trust MrSphay software signed with this certificate chain."
|
|
|
|
$answer = Read-Host "Type INSTALL to continue"
|
|
if ($answer -cne "INSTALL") {
|
|
Write-Host "Installation cancelled."
|
|
exit 1
|
|
}
|
|
|
|
$existingRoot = Get-ChildItem -Path $rootStore | Where-Object Thumbprint -eq $rootCertificate.Thumbprint
|
|
|
|
if (-not $existingRoot) {
|
|
if ($PSCmdlet.ShouldProcess($rootStore, "Install MrTrust root certificate")) {
|
|
Import-Certificate -FilePath $resolvedCertificatePath -CertStoreLocation $rootStore | Out-Null
|
|
}
|
|
}
|
|
|
|
if ($publisherCertificate) {
|
|
$existingPublisher = Get-ChildItem -Path $publisherStore | Where-Object Thumbprint -eq $publisherCertificate.Thumbprint
|
|
if (-not $existingPublisher) {
|
|
if ($PSCmdlet.ShouldProcess($publisherStore, "Install MrTrust trusted publisher certificate")) {
|
|
Import-Certificate -FilePath $resolvedPublisherCertificatePath -CertStoreLocation $publisherStore | Out-Null
|
|
}
|
|
}
|
|
}
|
|
|
|
Write-Host "MrTrust certificate installed."
|
|
Write-Host "Installed stores:"
|
|
Write-Host " $rootStore"
|
|
Write-Host " $publisherStore"
|