Repository: microsoft/terminal (language: cpp)

Issue:
WindowsTerminal.exe and OpenConsole.exe aren't signed
### Windows Terminal version (or Windows build number)

Windows Terminal version 1.6.10571.0

### Other Software

_No response_

### Steps to reproduce

Open Sysinternal Process Explorer, enable the "Verified Signer" column and see "(No signature was present in the subject)".

### Expected Behavior

I would expect programs from Microsoft to be signed by Microsoft. All other programs from Microsoft installed on my machine are signed.

### Actual Behavior

I saw "(No signature was present in the subject)" in Sysinternal Process Explorer's "Verified Signer" column for both WindowsTerminal.exe and OpenConsole.exe




Discussion / hints:
Here's a screenshot from Process Explorer:
![image](https://user-images.githubusercontent.com/28929018/113076761-0cdd8000-91d0-11eb-81e5-a7728494efa5.png)



So, Terminal is distributed in a signed _container_, the `msixbundle`/individual `msix` archives. Packaged applications are signed as a single unit, and the signature is recorded as part of the app platform's package manager database. :smile:

You can verify the signature on the build artifacts on our Releases page.

@DHowett So is it a bug in Process Explorer?
I believe so.
Hmmm, let's have Mark Russinovich's take on it? ;)
![image](https://user-images.githubusercontent.com/189190/113183236-68802b80-9219-11eb-8d19-5de177ae0b9c.png)

:smile:
Aren't you referring to an authority as well, in the form of an online article? :D
Sorry if I'm being annoying, hopefully we're just having fun.
In general, there are some things about packaged processes (or packaged applications in general) that don't play nicely with the established systems. I know that's not _great_... but this seems to be the case for every store-deployed signed app on my machine today. There's a signature file at the root of the package that attests to its contents, and a "block map" that is also signed that attests they haven't been tampered with!

![image](https://user-images.githubusercontent.com/189190/113184097-666a9c80-921a-11eb-8c06-9a5f03418818.png)
(Properties dialog -- since I can't actually get Process Explorer to display **anything** for Verified Signer ☹️; Anyway, no Digital Signatures page!)

However, this guy is here:

![image](https://user-images.githubusercontent.com/189190/113184167-797d6c80-921a-11eb-9b19-9ef29557894c.png)

Indeed, all in good fun!
I can't say I fully understand what a packaged process means, but it seems like you're aware of what the problem is and where it lies, so I'll trust you :)
Thanks for your time.
SO! A packaged process is one that has an "identity" and was downloaded from the store or installed from a signed `appx` or `msix` file. If you go to Process Explorer and enable the "Package Name" field, you can see the identity for each process.

That identity is used to control access to resources in a more fine-grained way than your user ID/user account ACL. It's part of the store's sandboxing system.
Hi @DHowett, I understand everything you wrote here.

However, `windowsterminalshellext.dll` also not signed, and the it is being blocked on my machine because of the missing digital signature. 

When I'm casually browsing my file system using File Explorer I'm being prompted by an alert that `ddlhost.exe` wasn't able to access `windowsterminalshellext.dll` because it's content cannot be verified, and it's being blocked to prevent any malicious things.

Is this something I need to open an issue for? 
@b-dasass two questions:

* How did you install the Terminal? (from the store, from the Releases page, from `winget`, `choco`, `scoop`, etc)
* What program is displaying the alert about the missing signature?
I suspect that the "security" software you're using doesn't respect package signatures and will throw a warning for _any_ packaged shell extension. :/
The executables themselves are in-fact _not_ signed.  Microsoft's own App Locker will allow Terminal to install because it is signed, but not run because the executables are not signed.  In order for App Locker to allow execution, you would need to either allow the path or file hashes, because there is no Publisher information on the executables.

Proof: https://i.imgur.com/4sembm5.png


Thanks! I'm asking the AppLocker team.
I feel like you may have closed this too hastily. Sysinternals Process Explorer is standard admin software for troubleshooting issues like this. If their software says your exe is unsigned, and you admit it's unsigned, but insist that the de-facto software is wrong because it's not checking the **special way you chose to sign it**, you're pretty clearly in the wrong here. Just sign the exe so AAL/AWL can work properly. Either that, or get Mark Russinovich/SysInternals to add checking for your signature type. You also insist that the "Package Name" field will show the proper information, but that is clearly not displayed.

<img width="1152" alt="image" src="https://user-images.githubusercontent.com/4333916/211877078-30cacc11-e1e6-4fe8-8f58-f92355051e35.png">

Sorry if this all sounds a bit angry, but I just had to spend a very non-zero amount of time checking that my system wasn't infected because my windows terminal was un-signed. Please just sign your exe and save everyone some headaches and hair-pulling.
Packaged executables _are_ signed, along with other files as [required](https://learn.microsoft.com/windows/msix/package/signing-package-overview) for deployment, but file signatures are stored in the package catalog, AppxMetadata\CodeIntegrity.cat (except for Windows system packages). Executables may also have embedded signatures, but those are not required when packaged, even for a verified publisher UAC elevation prompt.

Process Explorer currently only displays the package name (package full name*, not display name) for UWP processes, not _all_ packaged processes, and does not use the package catalog. We will fix both issues in Process Explorer. Thanks!

In the meantime, try the following workaround with [Sigcheck](https://www.sysinternals.com/downloads/sigcheck) from PowerShell:

```
$ (ps WindowsTerminal).Path
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.15.3466.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe

$ cd "C:\Program Files\WindowsApps\Microsoft.WindowsTerminalPreview_1.16.3464.0_x64__8wekyb3d8bbwe\"

$ sigcheck.exe -f .\AppxMetadata\CodeIntegrity.cat .\WindowsTerminal.exe

Sigcheck v2.90 - File version and signature viewer
Copyright (C) 2004-2022 Mark Russinovich
Sysinternals - www.sysinternals.com

C:\Program Files\WindowsApps\Microsoft.WindowsTerminalPreview_1.16.3464.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe:
        Verified:       Signed
        Signing date:   10:03 2022-12-13
        Publisher:      Microsoft Corporation
        Company:        Microsoft Corporation
        Description:    WindowsTerminal.exe
        Product:        Windows Terminal
        Prod version:   1.16.221212004-preview
        File version:   1.16.2212.12004
        MachineType:    64-bit
```

\* Example package full name: Microsoft.SysinternalsSuite_2022.11.2.0_x64__8wekyb3d8bbwe

Fix patch:
diff --git a/build/config/ESRPSigning_Terminal.json b/build/config/ESRPSigning_Terminal.json
new file mode 100644
index 00000000000..715848a42c4
--- /dev/null
+++ b/build/config/ESRPSigning_Terminal.json
@@ -0,0 +1,117 @@
+{
+    "Version": "1.0.0",
+    "UseMinimatch": false,
+    "SignBatches": [
+        {
+            "MatchedPath": [
+                // Namespaced DLLs
+                "Microsoft.Terminal.*.dll",
+                "Microsoft.Terminal.*.winmd",
+
+                // ConPTY and DefTerm
+                "OpenConsole.exe",
+                "OpenConsoleProxy.dll",
+
+                // VCRT Forwarders
+                "*_app.dll",
+
+                // Legacy DLLs with old names
+                "TerminalApp.dll",
+                "TerminalApp.winmd",
+                "TerminalConnection.dll",
+                "TerminalThemeHelpers.dll",
+                "WindowsTerminalShellExt.dll",
+
+                // The rest
+                "TerminalAzBridge.exe",
+                "wt.exe",
+                "WindowsTerminal.exe",
+                "elevate-shim.exe"
+            ],
+            "SigningInfo": {
+                "Operations": [
+                    {
+                        "KeyCode": "CP-230012",
+                        "OperationSetCode": "SigntoolSign",
+                        "Parameters": [
+                            {
+                                "parameterName": "OpusName",
+                                "parameterValue": "Microsoft"
+                            },
+                            {
+                                "parameterName": "OpusInfo",
+                                "parameterValue": "http://www.microsoft.com"
+                            },
+                            {
+                                "parameterName": "FileDigest",
+                                "parameterValue": "/fd \"SHA256\""
+                            },
+                            {
+                                "parameterName": "PageHash",
+                                "parameterValue": "/NPH"
+                            },
+                            {
+                                "parameterName": "TimeStamp",
+                                "parameterValue": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
+                            }
+                        ],
+                        "ToolName": "sign",
+                        "ToolVersion": "1.0"
+                    },
+                    {
+                        "KeyCode": "CP-230012",
+                        "OperationSetCode": "SigntoolVerify",
+                        "Parameters": [],
+                        "ToolName": "sign",
+                        "ToolVersion": "1.0"
+                    }
+                ]
+            }
+        },
+        {
+            // THIRD PARTY SOFTWARE
+            "MatchedPath": [
+                "cpprest*.dll"
+            ],
+            "SigningInfo": {
+                "Operations": [
+                    {
+                        "KeyCode": "CP-231522",
+                        "OperationSetCode": "SigntoolSign",
+                        "Parameters": [
+                            {
+                                "parameterName": "OpusName",
+                                "parameterValue": "Microsoft"
+                            },
+                            {
+                                "parameterName": "OpusInfo",
+                                "parameterValue": "http://www.microsoft.com"
+                            },
+                            {
+                                "parameterName": "FileDigest",
+                                "parameterValue": "/fd \"SHA256\""
+                            },
+                            {
+                                "parameterName": "PageHash",
+                                "parameterValue": "/NPH"
+                            },
+                            {
+                                "parameterName": "TimeStamp",
+                                "parameterValue": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
+                            }
+                        ],
+                        "ToolName": "sign",
+                        "ToolVersion": "1.0"
+                    },
+                    {
+                        "KeyCode": "CP-231522",
+                        "OperationSetCode": "SigntoolVerify",
+                        "Parameters": [],
+                        "ToolName": "sign",
+                        "ToolVersion": "1.0"
+                    }
+                ]
+            }
+        }
+    ]
+}
diff --git a/build/pipelines/release.yml b/build/pipelines/release.yml
index 053dc03a738..2f3c6992c5e 100644
--- a/build/pipelines/release.yml
+++ b/build/pipelines/release.yml
@@ -63,6 +63,7 @@ parameters:
       - Win11
 
 variables:
+  MakeAppxPath: 'C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x86\MakeAppx.exe'
   TerminalInternalPackageVersion: "0.0.7"
   # If we are building a branch called "release-*", change the NuGet suffix
   # to "preview". If we don't do that, XES will set the suffix to "release1"
@@ -270,6 +271,28 @@ jobs:
       displayName: 'Generate SBOM manifest'
       inputs:
        BuildDropPath: '$(System.ArtifactsDirectory)/appx'
+
+    - pwsh: |-
+        $Package = (Get-ChildItem "$(Build.ArtifactStagingDirectory)/appx" -Recurse -Filter "Cascadia*.msix" | Select -First 1)
+        $PackageFilename = $Package.FullName
+        Write-Host "##vso[task.setvariable variable=WindowsTerminalPackagePath]${PackageFilename}"
+        & "$(MakeAppxPath)" unpack /p $PackageFilename /d "$(Build.SourcesDirectory)\UnpackedTerminalPackage"
+      displayName: Unpack the new Terminal package for signing
+
+    - task: EsrpCodeSigning@1
+      displayName: Submit Terminal's binaries for signing
+      inputs:
+        ConnectedServiceName: 9d6d2960-0793-4d59-943e-78dcb434840a
+        FolderPath: '$(Build.SourcesDirectory)\UnpackedTerminalPackage'
+        signType: batchSigning
+        batchSignPolicyFile: '$(Build.SourcesDirectory)\build\config\ESRPSigning_Terminal.json'
+
+    - pwsh: |-
+        $PackageFilename = "$(WindowsTerminalPackagePath)"
+        Remove-Item "$(Build.SourcesDirectory)\UnpackedTerminalPackage\CodeSignSummary*"
+        & "$(MakeAppxPath)" pack /h SHA256 /o /p $PackageFilename /d "$(Build.SourcesDirectory)\UnpackedTerminalPackage"
+      displayName: Re-pack the new Terminal package after signing
+
     - task: PublishBuildArtifacts@1
       displayName: Publish Artifact (appx)
       inputs:


Test patch: