Feature Request: Code sign powershell module files
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 38/100
Research direction
Start by inspecting the release pipeline and the Sentry PowerShell module files with .ps1, .psm1, and .psd1 extensions. Determine how a Sentry-owned code-signing certificate would be provided securely to CI, then verify that released files carry valid signatures and work under WDAC or AllSigned policies.
Written by the indexing model from the issue text.
Description
Feature Request: Code Signing for WDAC Compatibility
Description
This request proposes the implementation of digital code signing for the Sentry PowerShell module files (.ps1, .psm1, .psd1).
Currently, in environments utilizing Windows Defender Application Control (WDAC) or strict PowerShell Execution Policies (such as AllSigned), the module is blocked from execution because the scripts are unsigned.
Motivation
In high-security enterprise environments, WDAC is used to restrict script execution to only trusted sources. By signing the PowerShell module, Sentry enables:
- Seamless Integration: Administrators can create "Publisher" rules to allow Sentry tools to run without manual overrides.
- Maintained Security Posture: Organizations do not have to lower their execution policy to
UnrestrictedorBypassto use the SDK. - Reduced Maintenance: Unlike "Hash" rules, which break every time the module is updated, "Publisher" rules remain valid across version updates.
Proposed Changes
- Integrate a code-signing step into the CI/CD release pipeline (e.g., via GitHub Actions).
- Apply a digital signature to all PowerShell script and manifest files using a Sentry-owned code-signing certificate.
Impact
This change will allow Sentry's PowerShell SDK to be deployed in regulated and locked-down Windows environments, broadening the reachable audience for Sentry's monitoring tools in the enterprise space.
Note: If this requires a specific certificate held by the Sentry team, this PR serves as a request for the maintainers to update the build workflow.
- Dominant language
- PowerShell
- Stars
- 16
- Forks
- 5
- Avg merge
- 11h 24m
- Merged PRs (30d)
- 5
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from getsentry/sentry-powershell
-
good first issue Improvement PowerShell
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
getsentry/sentry-powershell#136 · 1 comment ·
-
Improvement PowerShell
Difficulty 4/5 3-5 days Newbie friendliness 45/100
getsentry/sentry-powershell#128 · 2 comments ·
-
.NET Improvement
Difficulty 5/5 Over a week Newbie friendliness 25/100
getsentry/sentry-powershell#38 · 1 comment ·
All issues in getsentry/sentry-powershell
Similar issues
-
Help-Wanted Needs-Triage Package-Update
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
microsoft/winget-pkgs#440023 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
cactus-compute/needle#142 ·
-
area/cli bug needs-security-review security severity/medium spec-mismatch
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100