windowsExecutableCodeSignatureVerifier fails in PowerShell Constrained Language Mode

[jeremyspiegel]

• Electron-Builder Version: 23.0.3

• Node Version: 16.14.0

• Electron Version: 18.1.0
• Electron Type (current, beta, nightly): current

• electron-updater version: 5.0.1

• Target: nsis

windowsExecutableCodeSignatureVerifier.ts is failing for some users with this error:

Cannot execute Get-AuthenticodeSignature, stderr: Cannot invoke method. Method invocation is supported only on core types in this language mode. At line:1 char:175 + ... ch-Object { [Convert]::ToBase64String([System.Text.Encoding]::UTF8.Ge ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) [], RuntimeException + FullyQualifiedErrorId : MethodInvocationNotSupportedInConstrainedLanguage . Failing signature validation due to unknown stderr.

I believe this is due to PowerShell Constrained Language Mode: https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/

[burgil]

Hey, How do I reproduce this error do you know maybe?

[jeremyspiegel]

Sorry I was wrong about it being the Get-AuthenticodeSignature part, it's actually the [Convert]::ToBase64String and [System.Text.Encoding]::UTF8.GetBytes that the result is piped into that's failing.

To reproduce, set a system environment variable __PSLockDownPolicy=4 (make sure to select OK in the Environment Variables window):

Then open a new PowerShell window and test [System.Text.Encoding]::UTF8.GetBytes or [Convert]::ToBase64String:

[burgil]

Not sure if that helps:

And also did you know powershell is being maintained and updated by the minute? check it out:
https://github.com/PowerShell/PowerShell

You can also download the newest version there and it's supposed to be awesome, I was too afraid to get it to avoid compatibility issues..

I did not how ever set the env variables I was too lazy sorry let me know if you want me to lol

[jeremyspiegel]

@burgil I think that electron-updater should still be able to work even when PowerShell is configured this way, and regardless of what version of PowerShell is installed.

[burgil]

I just realized that the problem is coming from electron-updater, I think you are right yes it should work regardless of Powershell version, I just let you know you can update it, but yeah now I know that the problem is in other people computers, your users, I misread that part, perhaps one of the contributors here knows something, good luck with that

If you are looking for a quick hack, check if that environment variable is set, and delete it during the update process using some hook there, and as soon as it finished updating check if it was removed and restore it in that case.. (you can like store it in a file if it was removed)

Or you can like make a simply check that checks if that environement variable is there and if so it puts a message box saying your pc configuration is preventing the updater from running, please remove this, or do this
Could be a great start to debug it too, I will start from there and evolve to the first option..

But of course if anybody here can actually fix it yeah.. that will be the ultimate solution. I'm just a random guy here :)

[jeremyspiegel]

The environment variable is a way to set PowerShell in that mode for debugging purposes, but there are other ways to set it that can't be circumvented (like AppLocker or Group Policy Software Restriction settings).

[jeremyspiegel]

I've added a PR to address this: #7230