[PowerApps-TestEngine - Feature]: Authenticode Certificate Validation

[Grant-Archibald-MS]

Is your feature request related to a problem? Please describe.

Provide a means of ensuring that MEF plugins for the Power Apps Test Engine are verified and only load plugins from trusted provides

Describe the solution you'd like

When loading MEF plugins:

• Verify that the certificate and the certificate chain is valid
• Validate that the root certificate provider is from a known allow list of providers

Describe alternatives you've considered

No response

Additional context?

No response

[Grant-Archibald-MS]

Consider the following code as a starting point for validation

using System.Security.Cryptography.X509Certificates;

var cert = X509Certificate.CreateFromSignedFile(@"C:\Users\grarchib\AppData\Local\Microsoft\PowerAppsCLI\Microsoft.PowerApps.CLI.1.31.6\tools\bolt.module.cli.dll"); var cert2 = new X509Certificate2(cert.GetRawCertData()); Console.WriteLine(cert2.Issuer.ToString()); cert2.Verify();

X509Chain chain = new X509Chain(); chain.ChainPolicy.RevocationMode = X509RevocationMode.Online; chain.Build(cert2);

Console.WriteLine("Chain Information"); Console.WriteLine($"Chain revocation flag: {chain.ChainPolicy.RevocationFlag}"); Console.WriteLine($"Chain revocation mode: {chain.ChainPolicy.RevocationMode}"); Console.WriteLine($"Chain verification flag: {chain.ChainPolicy.VerificationFlags}"); Console.WriteLine($"Chain verification time: {chain.ChainPolicy.VerificationTime}"); Console.WriteLine($"Chain status length: {chain.ChainStatus.Length}"); Console.WriteLine($"Chain application policy count: {chain.ChainPolicy.ApplicationPolicy.Count}"); Console.WriteLine($"Chain certificate policy count: {chain.ChainPolicy.CertificatePolicy.Count}{Environment.NewLine}");

// Output chain element information. Console.WriteLine("Chain Element Information"); Console.WriteLine($"Number of chain elements: {chain.ChainElements.Count}");

foreach ( var elem in chain.ChainElements ) { Console.WriteLine($"{elem.Certificate.IssuerName.Name}"); Console.WriteLine($"{elem.Certificate.Thumbprint}"); }