Repository: PowerShell/PowerShell
File: test/powershell/engine/Security/FileSignature.Tests.ps1 (PowerShell)

Code before:
                    $publisherStore.Add([System.Security.Cryptography.X509Certificates.X509Certificate2]::new($sanCert.RawData))
                } finally {
                    $publisherStore.Close()
                }

                $sanCA | Remove-Item
                $sanCA.Thumbprint, $sanCert.Thumbprint
            }
        } finally {
            $session | Remove-PSSession
        }

        $sanCARootThumbprint = $sanThumbprint[0]
        $sanCertThumbprint = $sanThumbprint[1]
        $sanCertificate = Get-Item -Path Cert:\CurrentUser\My\$sanCertThumbprint

        try {
            Set-Content -Path testdrive:\test.ps1 -Value 'Write-Output "Test SAN"' -Encoding UTF8NoBOM

            $scriptPath = Join-Path $TestDrive test.ps1
            $status = Set-AuthenticodeSignature -FilePath $scriptPath -Certificate $sanCertificate
            $status.Status | Should -Be 'Valid'

            $actual = Get-AuthenticodeSignature -FilePath $scriptPath
            $actual.SubjectAlternativeName | Should -Not -BeNullOrEmpty
            $actual.SubjectAlternativeName | Should -BeOfType [string[]]
            $actual.SubjectAlternativeName.Count | Should -Be 2
            $actual.SubjectAlternativeName | Should -Contain 'DNS Name=test.example.com'
            $actual.SubjectAlternativeName | Should -Contain 'DNS Name=*.example.com'
        } finally {
            Remove-Item -Path "Cert:\LocalMachine\Root\$sanCARootThumbprint" -Force -ErrorAction Ignore
            Remove-Item -Path "Cert:\LocalMachine\TrustedPublisher\$sanCertThumbprint" -Force -ErrorAction Ignore
            Remove-Item -Path "Cert:\CurrentUser\My\$sanCertThumbprint" -Force -ErrorAction Ignore
        }
    }

    It "Verifies SubjectAlternativeName is null when certificate has no SAN" {
        Set-Content -Path testdrive:\test.ps1 -Value 'Write-Output "Test No SAN"' -Encoding UTF8NoBOM

        $scriptPath = Join-Path $TestDrive test.ps1
        $status = Set-AuthenticodeSignature -FilePath $scriptPath -Certificate $certificate
        $status.Status | Should -Be 'Valid'

        $actual = Get-AuthenticodeSignature -FilePath $scriptPath
        $actual.SignerCertificate.Thumbprint | Should -Be $certificate.Thumbprint
        $actual.Status | Should -Be 'Valid'
        
        # Verify that SubjectAlternativeName property exists
        $actual.PSObject.Properties.Name | Should -Contain 'SubjectAlternativeName'
        
        # Verify the content is null when certificate has no SAN extension

Review comment (suggestion):
@copilot It should be `$actual.SubjectAlternativeName | Should -BeOfType [string]

Code after:
                    $publisherStore.Add([System.Security.Cryptography.X509Certificates.X509Certificate2]::new($sanCert.RawData))
                } finally {
                    $publisherStore.Close()
                }

                $sanCA | Remove-Item
                $sanCA.Thumbprint, $sanCert.Thumbprint
            }
        } finally {
            $session | Remove-PSSession
        }

        $sanCARootThumbprint = $sanThumbprint[0]
        $sanCertThumbprint = $sanThumbprint[1]
        $sanCertificate = Get-Item -Path Cert:\CurrentUser\My\$sanCertThumbprint

        try {
            Set-Content -Path testdrive:\test.ps1 -Value 'Write-Output "Test SAN"' -Encoding UTF8NoBOM

            $scriptPath = Join-Path $TestDrive test.ps1
            $status = Set-AuthenticodeSignature -FilePath $scriptPath -Certificate $sanCertificate
            $status.Status | Should -Be 'Valid'

            $actual = Get-AuthenticodeSignature -FilePath $scriptPath
            $actual.SubjectAlternativeName | Should -Not -BeNullOrEmpty
            ,$actual.SubjectAlternativeName | Should -BeOfType [string[]]
            $actual.SubjectAlternativeName.Count | Should -Be 2
            $actual.SubjectAlternativeName[0] | Should -BeExactly 'DNS Name=test.example.com'
            $actual.SubjectAlternativeName[1] | Should -BeExactly 'DNS Name=*.example.com'
        } finally {
            Remove-Item -Path "Cert:\LocalMachine\Root\$sanCARootThumbprint" -Force -ErrorAction Ignore
            Remove-Item -Path "Cert:\LocalMachine\TrustedPublisher\$sanCertThumbprint" -Force -ErrorAction Ignore
            Remove-Item -Path "Cert:\CurrentUser\My\$sanCertThumbprint" -Force -ErrorAction Ignore
        }
    }

    It "Verifies SubjectAlternativeName is null when certificate has no SAN" {
        Set-Content -Path testdrive:\test.ps1 -Value 'Write-Output "Test No SAN"' -Encoding UTF8NoBOM

        $scriptPath = Join-Path $TestDrive test.ps1
        $status = Set-AuthenticodeSignature -FilePath $scriptPath -Certificate $certificate
        $status.Status | Should -Be 'Valid'

        $actual = Get-AuthenticodeSignature -FilePath $scriptPath
        $actual.SignerCertificate.Thumbprint | Should -Be $certificate.Thumbprint
        $actual.Status | Should -Be 'Valid'
        
        # Verify that SubjectAlternativeName property exists
        $actual.PSObject.Properties.Name | Should -Contain 'SubjectAlternativeName'
        
        # Verify the content is null when certificate has no SAN extension