Skip to content

Commit

Permalink
(chocolatey#89) Remove cpack shims on package upgrades
Browse files Browse the repository at this point in the history
This commit updates the installation/upgrading of
the package to remove the cpack shim if they are
signed with the expected authenticode signature
thumbprint.

The thumbprint being checked against in the thumbprint
used in Chocolatey v0.12.1.

The code added makes it easy to extend it when needed
for removal of other shims as well.
  • Loading branch information
AdmiringWorm committed Mar 11, 2022
1 parent 1471a4a commit da5f4a4
Showing 1 changed file with 46 additions and 0 deletions.
46 changes: 46 additions & 0 deletions nuget/chocolatey/tools/chocolateysetup.psm1
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,41 @@ param (
}
}

function Remove-ShimWithAuthenticodeSignature {
param (
[string] $filePath
)
if (!(Test-Path $filePath)) {
return
}

$signature = Get-AuthenticodeSignature $filePath -ErrorAction SilentlyContinue

if (!$signature -or !$signature.SignerCertificate) {
Write-ChocolateyWarning "Shim found in $filePath, but was not signed. Ignoring removal..."
return
}

$possibleSignatures = @(
'RealDimensions Software, LLC'
'Chocolatey Software, Inc\.'
)

$possibleSignatures | % {
if ($signature.SignerCertificate.Subject -match $_) {
Write-Output "Removing shim $filePath"

if (Test-Path "$filePath.ignore") {
Remove-Item "$filePath.ignore"
}
}
}

if (Test-Path $filePath) {
Write-ChocolateyWarning "Shim found in $filePath, but did not match any known signatures. Ignoring shim removal..."
}
}

function Initialize-Chocolatey {
<#
.DESCRIPTION
Expand Down Expand Up @@ -331,6 +366,17 @@ param(
}
}
}

$shimsToRemove = @("cpack.exe")
Get-ChildItem -Path $to -Recurse -Include $shimsToRemove |
% {
try {
Remove-ShimWithAuthenticodeSignature -filePath $_
}
catch {
Write-ChocolateyWarning "Unable to remove `'$_`'. Please remove the file manually."
}
}
}
}

Expand Down

0 comments on commit da5f4a4

Please sign in to comment.