search

dataplat / dbatools

🚀 SQL Server automation and instance migrations have never been safer, faster or freer
https://dbatools.io
MIT License
2.42k stars 792 forks source link

Cert issues - delay in publishing new module versions #9040

Open jpomfret opened 1 year ago

jpomfret commented 1 year ago

Verified issue does not already exist?

No, I did not search

What error did you receive?

We signed the 2.0.5 module with the new SSL.com certificate and since that is a change in cert we now get the following error when the module is installed\updated on a machine with an older\existing dbatools version:

Install-Package: Authenticode issuer 'CN=dbatools, O=dbatools, L=Vienna, S=Virginia, C=US' of the new module 'dbatools' with version
'2.0.5' from root certificate authority 'CN=SSL.com Root Certification Authority RSA, O=SSL Corporation, L=Houston,
S=Texas, C=US' is not matching with the authenticode issuer 'CN=dbatools, O=dbatools, L=Vienna, S=Virginia, C=US' of
the previously-installed module 'dbatools' with version '2.0.2' from root certificate authority 'CN=DigiCert Assured ID
Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US'. If you still want to install or update, use -SkipPublisherCheck
parameter.

Steps to Reproduce

Install-Module dbatools -Force -AllowClobber

(using AllowClobber because Install-Package: The following commands are already available on this system:'Get-DbatoolsLibraryPath'. This module 'dbatools.library' may override the existing commands. If you still want to install this module 'dbatools.library', use -AllowClobber parameter.)

Please confirm that you are running the most recent version of dbatools

N/A

Other details or mentions

No response

What PowerShell host was used when producing this error

PowerShell Core (pwsh.exe)

PowerShell Host Version

N/A

SQL Server Edition and Build number

N/A

.NET Framework Version

N/A

wsmelton commented 1 year ago

This is a by design feature in PowerShell with package management. When you change the signed certificate issuer just like Pester had because the version shipped with Windows was signed by a different issuer to the one from the first shipped community version.

Right off I would advise not shipping this release as just a minor version. We need to draw attention that a major change has taken affect. If we are not willing to release a v3.0.0 (because this is a major change) then at least release it as 2.1.0 to show users there is a big change in the module.

Outside of that though it will have to be evangelized that users will have to use the -SkipPublisherCheck parameter for Install-Module if they are using the older version of PowerShellGet. New version of PowerShellGet (v3 renamed to PSResourceGet) does not have this issue because they disabled the publisher check by default (user has to explicitly pass -PublisherCheck), ref PowerShell/PSResourceGet#630. (This is being shipped with PowerShell 7.4)