Feature Request: Add signature checks to build.ps1

[harrison314]

Due to the environment of increased security requirements and recent incidents in npm world, it would be advisable to add check the signatures of nuget.exe and nuget Cake (or Cake.exe) to build.ps1.

The signature of nuget.exe can be checked using the powershell command Get-AuthenticodeSignature and nuget package Cake using nuget verify.

Full example of build.ps1 is on my gist https://gist.github.com/harrison314/4fc43f9e75016d6964fcdee3cde553fe.

Example snippet for check nuget.exe:

# Try download NuGet.exe if not exists
if (!(Test-Path $NUGET_EXE)) {
    Write-Verbose -Message "Downloading NuGet.exe..."
    try {
        $wc = GetProxyEnabledWebClient
        $wc.DownloadFile($NUGET_URL, $NUGET_EXE)
    } catch {
        Throw "Could not download NuGet.exe."
    }

    $nugetSignature = Get-AuthenticodeSignature -FilePath $NUGET_EXE
    if ($nugetSignature.Status -ne "Valid") {
        Throw "Signature validation failed for NuGet.exe."
    }
}

Example snippet for check nuget.exe with explicit signature thumbprint:

$NUGET_EXE_SIGN_THUMBPRINTS = @("9DC17888B5CFAD98B3CB35C1994E96227F061675", "...another thumbprint...")

# Try download NuGet.exe if not exists
if (!(Test-Path $NUGET_EXE)) {
    Write-Verbose -Message "Downloading NuGet.exe..."
    try {
        $wc = GetProxyEnabledWebClient
        $wc.DownloadFile($NUGET_URL, $NUGET_EXE)
    } catch {
        Throw "Could not download NuGet.exe."
    }

    $nugetSignature = Get-AuthenticodeSignature -FilePath $NUGET_EXE
    if ($nugetSignature.Status -ne "Valid" && $NUGET_EXE_SIGN_THUMBPRINTS.Contains($nugetSignature.SignerCertificate.Thumbprint)) {
        Throw "Signature validation failed for NuGet.exe."
    }
}

Example snippet for check Cake nuget:

Write-Verbose -Message "Restoring tools from NuGet..."
$NuGetOutput = Invoke-Expression "&`"$NUGET_EXE`" install -ExcludeVersion -OutputDirectory `"$TOOLS_DIR`""

if ($LASTEXITCODE -ne 0) {
    Throw "An error occurred while restoring NuGet tools."
}
else
{
    $md5Hash | Out-File $PACKAGES_CONFIG_MD5 -Encoding "ASCII"
}
Write-Verbose -Message ($NuGetOutput | out-string)

$cakePackage = Join-Path $TOOLS_DIR "Cake/Cake.nupkg"
$NuGetOutput = Invoke-Expression "&`"$NUGET_EXE`" verify Signatures `"$cakePackage`""
if ($LASTEXITCODE -ne 0) {
    Throw "Cake nuget is not signed."
}
Write-Verbose -Message ($NuGetOutput | out-string)