Sign of the Times - PowerShell and Authenticode - Jordan Borean
This lecture explains PowerShell Authenticode signing and how it is used to verify scripts. It begins with a live demo that creates a short-lived certificate, signs a script with and ...without a timestamp, copies it to a Windows host, and then checks the signature status.The speaker describes the basic structure of an Authenticode signature and shows that it answers three questions: what was signed, who signed it, and when it was signed. The transcript walks through the signature block, how the hash is calculated, and how changes to the script content cause a hash mismatch.
Several examples show what does and does not break a signature. Changing a comment, a line ending, or the file content invalidates the signature, while renaming the file, changing the modification time, or adding the Mark of the Web does not. The speaker also notes that adding extra whitespace to the end of the signature block can make the file appear unsigned.
The lecture then moves to certificate requirements and trust. It explains code-signing EKU, certificate chains, root trust, and the difference between a valid signature and a trusted publisher in PowerShell. It also compares self-signed certificates, internal PKI, public certificate authorities, and Azure Artifact Signing.
The final section covers PowerShell execution policy and WDAC. The speaker shows how signed code can still fail if the publisher is not trusted, how trusted publishers can be imported, and how WDAC can enforce constrained language mode. The talk ends with a demonstration of signing in a GitHub Actions workflow using Azure and timestamping, followed by a comparison of signatures with and without timestamps after certificate expiry.
Chapters:
00:00:00 Sign of the Times PowerShell and Authenticode Jordan Borean
00:00:32 Welcome and Sponsor Thanks
00:01:37 Authenticode Basics
00:05:03 Decoding Signatures
00:07:02 What Signatures Prove
00:11:18 Breakage Scenarios
00:16:10 Certificate Requirements
00:18:40 Certificate Sources
00:23:20 Trust and Execution Policy
00:26:49 WDAC and Language Modes
00:31:32 Azure Artifact Signing
00:34:41 CI Signing Demo
00:36:36 Timestamp ExpiryShow More
Sign of the Times - PowerShell and Authenticode - Jordan Borean
This lecture explains PowerShell Authenticode signing and how it is ...
This lecture explains PowerShell Authenticode signing and how it is used to verify scripts. It begins with a live demo that creates a short-lived certificate, signs a script with and ...without a timestamp, copies it to a Windows host, and then checks the signature status.
The speaker describes the basic structure of an Authenticode signature and shows that it answers three questions: what was signed, who signed it, and when it was signed. The transcript walks through the signature block, how the hash is calculated, and how changes to the script content cause a hash mismatch.
Several examples show what does and does not break a signature. Changing a comment, a line ending, or the file content invalidates the signature, while renaming the file, changing the modification time, or adding the Mark of the Web does not. The speaker also notes that adding extra whitespace to the end of the signature block can make the file appear unsigned.
The lecture then moves to certificate requirements and trust. It explains code-signing EKU, certificate chains, root trust, and the difference between a valid signature and a trusted publisher in PowerShell. It also compares self-signed certificates, internal PKI, public certificate authorities, and Azure Artifact Signing.
The final section covers PowerShell execution policy and WDAC. The speaker shows how signed code can still fail if the publisher is not trusted, how trusted publishers can be imported, and how WDAC can enforce constrained language mode. The talk ends with a demonstration of signing in a GitHub Actions workflow using Azure and timestamping, followed by a comparison of signatures with and without timestamps after certificate expiry.
Chapters:
00:00:00 Sign of the Times PowerShell and Authenticode Jordan Borean
00:00:32 Welcome and Sponsor Thanks
00:01:37 Authenticode Basics
00:05:03 Decoding Signatures
00:07:02 What Signatures Prove
00:11:18 Breakage Scenarios
00:16:10 Certificate Requirements
00:18:40 Certificate Sources
00:23:20 Trust and Execution Policy
00:26:49 WDAC and Language Modes
00:31:32 Azure Artifact Signing
00:34:41 CI Signing Demo
00:36:36 Timestamp ExpiryShow More
The speaker describes the basic structure of an Authenticode signature and shows that it answers three questions: what was signed, who signed it, and when it was signed. The transcript walks through the signature block, how the hash is calculated, and how changes to the script content cause a hash mismatch.
Several examples show what does and does not break a signature. Changing a comment, a line ending, or the file content invalidates the signature, while renaming the file, changing the modification time, or adding the Mark of the Web does not. The speaker also notes that adding extra whitespace to the end of the signature block can make the file appear unsigned.
The lecture then moves to certificate requirements and trust. It explains code-signing EKU, certificate chains, root trust, and the difference between a valid signature and a trusted publisher in PowerShell. It also compares self-signed certificates, internal PKI, public certificate authorities, and Azure Artifact Signing.
The final section covers PowerShell execution policy and WDAC. The speaker shows how signed code can still fail if the publisher is not trusted, how trusted publishers can be imported, and how WDAC can enforce constrained language mode. The talk ends with a demonstration of signing in a GitHub Actions workflow using Azure and timestamping, followed by a comparison of signatures with and without timestamps after certificate expiry.
Chapters:
00:00:00 Sign of the Times PowerShell and Authenticode Jordan Borean
00:00:32 Welcome and Sponsor Thanks
00:01:37 Authenticode Basics
00:05:03 Decoding Signatures
00:07:02 What Signatures Prove
00:11:18 Breakage Scenarios
00:16:10 Certificate Requirements
00:18:40 Certificate Sources
00:23:20 Trust and Execution Policy
00:26:49 WDAC and Language Modes
00:31:32 Azure Artifact Signing
00:34:41 CI Signing Demo
00:36:36 Timestamp ExpiryShow More
Pester 6 is finally here - Jakub Jareš
This lecture presents Pester 6, the latest major version of the ...
This lecture presents Pester 6, the latest major version of the PowerShell testing framework, and explains that development took several years. It also mentions that several releases have already followed, ...with more fixes and features planned.
A major topic is the new assertion system. Instead of using a single `should` command with parameter sets, Pester 6 introduces separate assertion functions, making the system more extensible and easier to specialize for strings, collections, booleans, ranges, time values, and custom cases. The lecture also notes that there are new defaults intended to be safer.
Several assertion examples are demonstrated. For strings, the new options include trimming whitespace, case-sensitive comparison, and normalizing line endings. The lecturer also shows improved in-line diffs for longer text, and an assertion for checking equivalence between objects, which compares expected properties while ignoring extra data.
The lecture then covers hints and guidance in failing assertions. Pester 6 can detect common mistakes such as piping a hash table or list into an assertion that does not behave as expected, and it explains when pipeline unwrapping changes the result. It also shows improved mock verification output, listing invocations and indicating which ones matched the filter.
Another topic is test organization. A new `pester.before.container` file can provide shared setup and teardown for an entire test tree, including hierarchical behavior for nested folders. The lecture also shows running tests in parallel, using a configuration option to execute files concurrently and reduce total runtime.
The final part covers additional experimental and quality-of-life features: global mocks, shuffled test order to reveal hidden dependencies, running only untagged tests using `none`, safer handling of empty `foreach` test generation, and stricter configuration validation. The lecture ends with a short question-and-answer exchange and points viewers to the interactive tutorial and earlier introductory talks as starting points for learning Pester.
Chapters:
00:00:00 Pester 6 is finally here - Jakub Jareš
00:00:27 Pester 6 Launch
00:01:42 New Assertions Suite
00:07:55 String Comparison Upgrades
00:10:29 Deep Object Equivalence
00:14:14 Assertion Hints
00:17:24 Mocking Debug Views
00:20:33 Shared Test Setup
00:23:49 Parallel Test Runs
00:27:16 Global Mocks
00:32:18 Shuffle Exposes Flaky Tests
00:35:27 Untagged Tests
00:39:19 Safer Configuration
00:42:20 Where to StartShow More
A major topic is the new assertion system. Instead of using a single `should` command with parameter sets, Pester 6 introduces separate assertion functions, making the system more extensible and easier to specialize for strings, collections, booleans, ranges, time values, and custom cases. The lecture also notes that there are new defaults intended to be safer.
Several assertion examples are demonstrated. For strings, the new options include trimming whitespace, case-sensitive comparison, and normalizing line endings. The lecturer also shows improved in-line diffs for longer text, and an assertion for checking equivalence between objects, which compares expected properties while ignoring extra data.
The lecture then covers hints and guidance in failing assertions. Pester 6 can detect common mistakes such as piping a hash table or list into an assertion that does not behave as expected, and it explains when pipeline unwrapping changes the result. It also shows improved mock verification output, listing invocations and indicating which ones matched the filter.
Another topic is test organization. A new `pester.before.container` file can provide shared setup and teardown for an entire test tree, including hierarchical behavior for nested folders. The lecture also shows running tests in parallel, using a configuration option to execute files concurrently and reduce total runtime.
The final part covers additional experimental and quality-of-life features: global mocks, shuffled test order to reveal hidden dependencies, running only untagged tests using `none`, safer handling of empty `foreach` test generation, and stricter configuration validation. The lecture ends with a short question-and-answer exchange and points viewers to the interactive tutorial and earlier introductory talks as starting points for learning Pester.
Chapters:
00:00:00 Pester 6 is finally here - Jakub Jareš
00:00:27 Pester 6 Launch
00:01:42 New Assertions Suite
00:07:55 String Comparison Upgrades
00:10:29 Deep Object Equivalence
00:14:14 Assertion Hints
00:17:24 Mocking Debug Views
00:20:33 Shared Test Setup
00:23:49 Parallel Test Runs
00:27:16 Global Mocks
00:32:18 Shuffle Exposes Flaky Tests
00:35:27 Untagged Tests
00:39:19 Safer Configuration
00:42:20 Where to StartShow More
From Script to Action - Maik van der Gaag
In this lecture, the speaker discusses how organizations can move from ...
In this lecture, the speaker discusses how organizations can move from ad hoc PowerShell scripts to reusable GitHub Actions. The main problem described is script duplication across repositories, which leads ...to inconsistent fixes, unclear ownership, and maintenance issues.
The talk follows a sample script that checks repository standards, such as required files and required headings in a README. First, the script is shown as a plain, hard-coded file. It is then evolved into a parameterized script so it can be reused in different repositories and with different rules.
The next step is wrapping the script in a composite GitHub Action using an action YAML file. The speaker explains how script parameters map to action inputs, how outputs should be returned, and why actions should be simple, predictable, and safe to run multiple times.
The lecture also covers testing and release management. The speaker recommends static analysis, unit tests, and integration tests, followed by a versioned release flow with tags such as v1, v1.2.0, and v2.0.0. The goal is to allow consumers to receive updates without copying code into multiple repositories.
Finally, the speaker shows how a separate repository can reference the shared action from a workflow instead of copying the script. The closing message is to start small, define clear contracts, document usage, retire duplicate copies, and share standardized scripts through tested GitHub Actions.
Chapters:
00:00:00 From Script to Action Maik van der Gaag
00:00:25 From Scripts To Actions
00:01:29 Why Scripts Drift
00:07:21 Ownership And Maintenance
00:11:18 Building A Better Script
00:16:06 Hardening Script Inputs
00:23:17 Designing The Composite Action
00:27:59 Action Metadata And Outputs
00:32:25 Workflow Results In GitHub
00:34:01 Testing And Release Strategy
00:39:31 Safe Versioning And Tagging
00:45:15 Consuming The Shared Action
00:47:53 Make Sharing EasierShow More
The talk follows a sample script that checks repository standards, such as required files and required headings in a README. First, the script is shown as a plain, hard-coded file. It is then evolved into a parameterized script so it can be reused in different repositories and with different rules.
The next step is wrapping the script in a composite GitHub Action using an action YAML file. The speaker explains how script parameters map to action inputs, how outputs should be returned, and why actions should be simple, predictable, and safe to run multiple times.
The lecture also covers testing and release management. The speaker recommends static analysis, unit tests, and integration tests, followed by a versioned release flow with tags such as v1, v1.2.0, and v2.0.0. The goal is to allow consumers to receive updates without copying code into multiple repositories.
Finally, the speaker shows how a separate repository can reference the shared action from a workflow instead of copying the script. The closing message is to start small, define clear contracts, document usage, retire duplicate copies, and share standardized scripts through tested GitHub Actions.
Chapters:
00:00:00 From Script to Action Maik van der Gaag
00:00:25 From Scripts To Actions
00:01:29 Why Scripts Drift
00:07:21 Ownership And Maintenance
00:11:18 Building A Better Script
00:16:06 Hardening Script Inputs
00:23:17 Designing The Composite Action
00:27:59 Action Metadata And Outputs
00:32:25 Workflow Results In GitHub
00:34:01 Testing And Release Strategy
00:39:31 Safe Versioning And Tagging
00:45:15 Consuming The Shared Action
00:47:53 Make Sharing EasierShow More
Automate build testing & deployment of your Pwsh modules cross platform with Azure DevOps - M. Wragg
In this lecture, the speaker discusses build pipelines for PowerShell ...
In this lecture, the speaker discusses build pipelines for PowerShell and explains why they remain important even with AI-assisted coding. The session focuses on Azure DevOps, which the speaker uses ...for personal and work projects, and includes a live demonstration of setting up a pipeline for a new PowerShell module.
The speaker briefly introduces Azure DevOps as a platform for planning, coding, testing, and deploying software. He notes that it supports more than pipelines, including repositories and work tracking, and mentions that it can be used with GitHub or other version control systems. He also explains that public Azure DevOps projects are being retired, which affects open-source workflows and leads to discussion of alternatives such as GitHub Actions, GitLab, CircleCI, Bitbucket Pipelines, and AppVeyor.
A key part of the talk is the distinction between disposable and durable code. The speaker connects this to PowerShell one-liners and to AI-generated code, saying that fast prototyping is useful but can become risky if temporary code turns into long-lived production code. He argues that build pipelines provide guardrails and fast feedback loops, which are especially important as code generation becomes easier.
He then outlines the structure of his PowerShell build pipeline. It combines module files into a single PSM1 for publishing, runs PSScriptAnalyzer for code quality checks, executes Pester tests, generates Markdown documentation from PowerShell help, enforces changelog updates, and publishes releases to the PowerShell Gallery when appropriate. He emphasizes that deployment is fully automated and only happens after the code passes these checks.
In the demo, he shows a simple Minecraft-related module that calculates Nether coordinates from Overworld coordinates. He walks through the repository structure, tests, module manifest, and pipeline YAML, then runs the pipeline across Windows, Linux, and macOS. The pipeline uses cached dependencies to speed up builds, updates documentation and a wiki, creates build artifacts, and publishes the module when the changelog includes a deployment marker.
Chapters:
00:00:00 Automate build testing & deployment of your Pwsh modules cross platform with Azure DevOps - Mark Wragg
00:00:26 Build Pipelines for PowerShell
00:03:38 Why Build Pipelines Matter
00:07:52 Disposable vs Durable Code
00:12:30 Pipeline Guardrails for PowerShell
00:16:35 Demo: Minecraft Module Setup
00:24:39 Pipeline YAML Overview
00:28:19 Tests, Docs, and Deployment
00:35:14 Creating the Pipeline
00:37:20 Build Tasks in Action
00:41:20 Changelog-Gated Releases
00:46:09 Deployment and Caching
00:49:50 Gallery Release ResultsShow More
The speaker briefly introduces Azure DevOps as a platform for planning, coding, testing, and deploying software. He notes that it supports more than pipelines, including repositories and work tracking, and mentions that it can be used with GitHub or other version control systems. He also explains that public Azure DevOps projects are being retired, which affects open-source workflows and leads to discussion of alternatives such as GitHub Actions, GitLab, CircleCI, Bitbucket Pipelines, and AppVeyor.
A key part of the talk is the distinction between disposable and durable code. The speaker connects this to PowerShell one-liners and to AI-generated code, saying that fast prototyping is useful but can become risky if temporary code turns into long-lived production code. He argues that build pipelines provide guardrails and fast feedback loops, which are especially important as code generation becomes easier.
He then outlines the structure of his PowerShell build pipeline. It combines module files into a single PSM1 for publishing, runs PSScriptAnalyzer for code quality checks, executes Pester tests, generates Markdown documentation from PowerShell help, enforces changelog updates, and publishes releases to the PowerShell Gallery when appropriate. He emphasizes that deployment is fully automated and only happens after the code passes these checks.
In the demo, he shows a simple Minecraft-related module that calculates Nether coordinates from Overworld coordinates. He walks through the repository structure, tests, module manifest, and pipeline YAML, then runs the pipeline across Windows, Linux, and macOS. The pipeline uses cached dependencies to speed up builds, updates documentation and a wiki, creates build artifacts, and publishes the module when the changelog includes a deployment marker.
Chapters:
00:00:00 Automate build testing & deployment of your Pwsh modules cross platform with Azure DevOps - Mark Wragg
00:00:26 Build Pipelines for PowerShell
00:03:38 Why Build Pipelines Matter
00:07:52 Disposable vs Durable Code
00:12:30 Pipeline Guardrails for PowerShell
00:16:35 Demo: Minecraft Module Setup
00:24:39 Pipeline YAML Overview
00:28:19 Tests, Docs, and Deployment
00:35:14 Creating the Pipeline
00:37:20 Build Tasks in Action
00:41:20 Changelog-Gated Releases
00:46:09 Deployment and Caching
00:49:50 Gallery Release ResultsShow More
I've built what was missing in PSRemoting - Arnaud Charles
In this lecture, Arnaud Charles presents two PowerShell modules he ...
In this lecture, Arnaud Charles presents two PowerShell modules he built to make remote file editing and browsing easier in environments where he works mainly with Windows PowerShell and WinRM. ...He explains that the project began from a practical need to edit files on core servers without relying on GUI tools or adding extra dependencies.
He describes his background, his limited initial PowerShell experience, and how attending PSConf encouraged him to improve his skills and build something useful. He also explains the requirements that shaped the tools: no external dependencies, WinRM over HTTPS, and a simple keyboard-driven workflow suitable for a secure environment.
The first tool, PSByte, is presented as a Vim-like remote text editor. It uses a local buffer to synchronize a remote file to the workstation, allows editing in normal and insert modes, and can push changes back to the remote server. He shows how it supports basic commands such as deleting lines, inserting text, saving, and quitting.
The second tool, PSW, is described as a PowerShell WinRM emulated explorer. It provides a terminal-based interface for navigating remote folders and files, with actions such as creating, deleting, moving, renaming, duplicating, and editing files. It can also call PSByte directly for file editing.
He then demonstrates both tools in a lab environment, showing remote connection, file navigation, editing, and synchronization behavior. He explains that the tools are designed to keep local and remote content aligned, including updates based on file changes and timestamps.
The lecture ends with a short discussion of the source code, contribution notes, and possible future improvements, including support for SSH.
Chapters:
00:00:00 Ive built what was missing in PSRemoting Arnaud Charles
00:00:25 Origins of the Idea
00:04:37 Defining the Requirements
00:07:13 Birth of PsByte
00:12:47 Introducing PSW Explorer
00:14:45 Live Demo Begins
00:21:27 Explorer Actions and Editing
00:23:27 AI and Open Source
00:26:56 Questions and AnswersShow More
He describes his background, his limited initial PowerShell experience, and how attending PSConf encouraged him to improve his skills and build something useful. He also explains the requirements that shaped the tools: no external dependencies, WinRM over HTTPS, and a simple keyboard-driven workflow suitable for a secure environment.
The first tool, PSByte, is presented as a Vim-like remote text editor. It uses a local buffer to synchronize a remote file to the workstation, allows editing in normal and insert modes, and can push changes back to the remote server. He shows how it supports basic commands such as deleting lines, inserting text, saving, and quitting.
The second tool, PSW, is described as a PowerShell WinRM emulated explorer. It provides a terminal-based interface for navigating remote folders and files, with actions such as creating, deleting, moving, renaming, duplicating, and editing files. It can also call PSByte directly for file editing.
He then demonstrates both tools in a lab environment, showing remote connection, file navigation, editing, and synchronization behavior. He explains that the tools are designed to keep local and remote content aligned, including updates based on file changes and timestamps.
The lecture ends with a short discussion of the source code, contribution notes, and possible future improvements, including support for SSH.
Chapters:
00:00:00 Ive built what was missing in PSRemoting Arnaud Charles
00:00:25 Origins of the Idea
00:04:37 Defining the Requirements
00:07:13 Birth of PsByte
00:12:47 Introducing PSW Explorer
00:14:45 Live Demo Begins
00:21:27 Explorer Actions and Editing
00:23:27 AI and Open Source
00:26:56 Questions and AnswersShow More
Power in the Pipeline: Enhance Power Automate deployments - Leo Visser
In this lecture, the speaker introduces a PowerShell-based module for ...
In this lecture, the speaker introduces a PowerShell-based module for Power Platform and Power Automate deployments. The goal is to improve solutions by adding linting, testing, documentation, and changelog generation ...to a CI/CD workflow.
The talk explains common problems found in Power Automate flows, such as generic action names, missing descriptions, secrets in code, and unexpected premium connectors. The speaker describes building a pipeline that exports solutions, unpacks them, stores them in a Git repository, and validates changes through pull requests.
A large part of the lecture focuses on offline analysis of unpacked solution files. The module can inspect flows, actions, connectors, parameters, descriptions, and secure input/output settings without connecting directly to Power Platform. This makes it suitable for local use or for pipeline agents.
The speaker then shows how the module can generate automatic documentation. It can create architecture diagrams and flowcharts in a graph-based output format, including Mermaid. These diagrams show how flows, environmental variables, and connection references relate to each other.
Another topic is automated changelog creation. By comparing Git differences and sending them to the Copilot CLI in a pipeline, the speaker generates release notes that summarize added and changed items.
The lecture also covers external interaction mapping. A script can display which flows communicate with SharePoint, APIs, ERP systems, or the internet, helping teams understand what external systems their automations access.
Finally, the speaker mentions secret scanning with existing tools, notes additional planned checks such as hard-coded URLs, nested loops, paging, and error handling, and argues that Power Platform solutions should be treated with the same care as other business-critical code.
Chapters:
00:00:00 Power in the Pipeline Enhance Power Automate deployments Leo Visser
00:00:25 Platform Overview and Agenda
00:03:27 Power Automate Maintenance Issues
00:04:55 CI/CD for Power Platform
00:09:31 Linting Demo
00:13:54 Graph Output Design
00:16:02 Documentation Demo
00:20:23 AI Changelog Workflow
00:24:04 Supported Platform Resources
00:25:12 Secret Scanning Options
00:26:50 Future Improvements
00:27:45 Why Treat Low-Code Carefully
00:29:49 Questions and Final Demo
00:30:36 External Dependency MappingShow More
The talk explains common problems found in Power Automate flows, such as generic action names, missing descriptions, secrets in code, and unexpected premium connectors. The speaker describes building a pipeline that exports solutions, unpacks them, stores them in a Git repository, and validates changes through pull requests.
A large part of the lecture focuses on offline analysis of unpacked solution files. The module can inspect flows, actions, connectors, parameters, descriptions, and secure input/output settings without connecting directly to Power Platform. This makes it suitable for local use or for pipeline agents.
The speaker then shows how the module can generate automatic documentation. It can create architecture diagrams and flowcharts in a graph-based output format, including Mermaid. These diagrams show how flows, environmental variables, and connection references relate to each other.
Another topic is automated changelog creation. By comparing Git differences and sending them to the Copilot CLI in a pipeline, the speaker generates release notes that summarize added and changed items.
The lecture also covers external interaction mapping. A script can display which flows communicate with SharePoint, APIs, ERP systems, or the internet, helping teams understand what external systems their automations access.
Finally, the speaker mentions secret scanning with existing tools, notes additional planned checks such as hard-coded URLs, nested loops, paging, and error handling, and argues that Power Platform solutions should be treated with the same care as other business-critical code.
Chapters:
00:00:00 Power in the Pipeline Enhance Power Automate deployments Leo Visser
00:00:25 Platform Overview and Agenda
00:03:27 Power Automate Maintenance Issues
00:04:55 CI/CD for Power Platform
00:09:31 Linting Demo
00:13:54 Graph Output Design
00:16:02 Documentation Demo
00:20:23 AI Changelog Workflow
00:24:04 Supported Platform Resources
00:25:12 Secret Scanning Options
00:26:50 Future Improvements
00:27:45 Why Treat Low-Code Carefully
00:29:49 Questions and Final Demo
00:30:36 External Dependency MappingShow More