1param([Parameter(Mandatory = $true)][string]$Path)23$ErrorActionPreference = "Stop"4if ([string]::IsNullOrWhiteSpace($env:WINDOWS_CERTIFICATE_BASE64)) {5 Write-Host "WINDOWS_CERTIFICATE_BASE64 is empty; leaving $Path unsigned"6 exit 07}8if ([string]::IsNullOrWhiteSpace($env:WINDOWS_CERTIFICATE_PASSWORD)) {9 throw "WINDOWS_CERTIFICATE_PASSWORD is required when a signing certificate is provided"10}1112$certificate = Join-Path $env:RUNNER_TEMP "atlas-release.pfx"13$signTool = Get-ChildItem "${env:ProgramFiles(x86)}\Windows Kits\10\bin\*\x64\signtool.exe" |14 Sort-Object FullName -Descending |15 Select-Object -First 116if ($null -eq $signTool) {17 throw "signtool.exe was not found in the Windows 10 SDK"18}19[IO.File]::WriteAllBytes($certificate, [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE_BASE64))20try {21 & $signTool.FullName sign /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 /f $certificate /p $env:WINDOWS_CERTIFICATE_PASSWORD $Path22 if ($LASTEXITCODE -ne 0) { throw "signtool failed with exit code $LASTEXITCODE" }23 & $signTool.FullName verify /pa /v $Path24 if ($LASTEXITCODE -ne 0) { throw "signature verification failed with exit code $LASTEXITCODE" }25} finally {26 Remove-Item -Force -ErrorAction SilentlyContinue $certificate27}