From 5aa0a9f13bed1c32cd1c8841cfa40ff6560af0a5 Mon Sep 17 00:00:00 2001
From: Timotheus Bachinger <timotheus.bachinger@checkmk.com>
Date: Wed, 30 Sep 2026 09:48:20 +0200
Subject: [PATCH] Forward Artifact Signing correlation ID for PowerShell
 scripts

## Summary
- Pass `--artifact-signing-correlation-id` (or the metadata `CorrelationId`)
  through the portable-core Artifact Signing provider, so the `:sign`
  request carries `x-correlation-id` / `x-ms-correlation-id` for PowerShell
  scripts (and MSIX/AppX) as it already does for PE, CAB and MSI.
- Stop rejecting the correlation ID in native-shaped portable signing;
  signature-algorithm, api-version and authority overrides are still
  rejected there.

Callers use the correlation ID to attribute signing requests in the
Artifact Signing diagnostics. Previously, signing a `.ps1` with it set
failed with "does not yet support correlation ID".

## Verification
- New test `mode_portable_artifact_signing_forwards_correlation_id_for_scripts`:
  `psign-server --expect-correlation-id` rejects the request without the
  header; fails before the change, passes after.
- `bash scripts/linux-portable-validation.sh`
- Signed a PE, an MSI and a `.ps1` against a real Artifact Signing account
  from Linux: `Get-AuthenticodeSignature` reports `Valid` on Windows, and
  the service diagnostics show the correlation ID on all requests.
---
 crates/psign-portable-core/src/lib.rs |  8 ++++-
 src/portable_sign.rs                  |  6 ++--
 tests/cli_pe_digest.rs                | 42 +++++++++++++++++++++++++++
 3 files changed, 52 insertions(+), 4 deletions(-)

diff --git a/crates/psign-portable-core/src/lib.rs b/crates/psign-portable-core/src/lib.rs
index 85ab31f..50ef2eb 100644
--- a/crates/psign-portable-core/src/lib.rs
+++ b/crates/psign-portable-core/src/lib.rs
@@ -351,6 +351,8 @@ pub struct PortableSignRequest {
     pub artifact_signing_federated_token_file: Option<String>,
     #[serde(default)]
     pub artifact_signing_exclude_credentials: Vec<String>,
+    #[serde(default)]
+    pub artifact_signing_correlation_id: Option<String>,
 }
 
 impl Default for PortableSignRequest {
@@ -392,6 +394,7 @@ impl Default for PortableSignRequest {
             artifact_signing_client_secret: None,
             artifact_signing_federated_token_file: None,
             artifact_signing_exclude_credentials: Vec::new(),
+            artifact_signing_correlation_id: None,
         }
     }
 }
@@ -1195,6 +1198,7 @@ struct ArtifactSigningProvider {
     endpoint: String,
     account_name: String,
     profile_name: String,
+    correlation_id: Option<String>,
     auth: psign_codesigning_rest::CodesigningAuth,
     chain: Vec<x509_cert::Certificate>,
 }
@@ -1391,7 +1395,7 @@ impl SigningProvider {
                     digest: digest.to_vec(),
                     signature_algorithm: artifact_signature_algorithm(digest_algorithm).to_string(),
                     api_version: psign_codesigning_rest::DEFAULT_API_VERSION.to_string(),
-                    correlation_id: None,
+                    correlation_id: provider.correlation_id.clone(),
                     authority: None,
                     auth: provider.auth.clone(),
                     endpoint_base_url: Some(provider.endpoint.clone()),
@@ -1509,6 +1513,7 @@ fn load_artifact_signing_provider(request: &PortableSignRequest) -> Result<Signi
             endpoint: endpoint.trim_end_matches('/').to_string(),
             account_name,
             profile_name,
+            correlation_id: text_opt(request.artifact_signing_correlation_id.as_deref()),
             auth,
             chain,
         },
@@ -4382,6 +4387,7 @@ mod tests {
             artifact_signing_client_secret: None,
             artifact_signing_federated_token_file: None,
             artifact_signing_exclude_credentials: Vec::new(),
+            artifact_signing_correlation_id: None,
         }
     }
 }
diff --git a/src/portable_sign.rs b/src/portable_sign.rs
index 348d144..89df675 100644
--- a/src/portable_sign.rs
+++ b/src/portable_sign.rs
@@ -1067,13 +1067,12 @@ fn run_portable_sign_portable_core_artifact_signing(
     let correlation_id = text_opt(args.artifact_signing_correlation_id.as_deref())
         .map(ToOwned::to_owned)
         .or_else(|| metadata.as_ref().and_then(|m| m.CorrelationId.clone()));
-    if correlation_id.is_some()
-        || text_present(&args.artifact_signing_signature_algorithm)
+    if text_present(&args.artifact_signing_signature_algorithm)
         || text_present(&args.artifact_signing_api_version)
         || text_present(&args.artifact_signing_authority)
     {
         return Err(anyhow!(
-            "native-shaped portable {target_kind} Artifact Signing does not yet support correlation ID, signature-algorithm, api-version, or authority overrides"
+            "native-shaped portable {target_kind} Artifact Signing does not yet support signature-algorithm, api-version, or authority overrides"
         ));
     }
 
@@ -1117,6 +1116,7 @@ fn run_portable_sign_portable_core_artifact_signing(
         )
         .map(ToOwned::to_owned),
         artifact_signing_exclude_credentials: std::mem::take(&mut exclude_credentials),
+        artifact_signing_correlation_id: correlation_id,
         ..Default::default()
     };
     let response = psign_portable_core::portable_sign(request).with_context(|| {
diff --git a/tests/cli_pe_digest.rs b/tests/cli_pe_digest.rs
index 2f53bd2..0e4006e 100644
--- a/tests/cli_pe_digest.rs
+++ b/tests/cli_pe_digest.rs
@@ -6122,6 +6122,48 @@ fn mode_portable_artifact_signing_signs_and_timestamps_psd1() {
     assert!(signed.contains("# SIG # Begin signature block"));
 }
 
+#[cfg(all(feature = "timestamp-server", feature = "artifact-signing-rest"))]
+#[test]
+fn mode_portable_artifact_signing_forwards_correlation_id_for_scripts() {
+    let dir = tempfile::tempdir().unwrap();
+    let script_path = dir.path().join("sample.artifact-correlation.psd1");
+    std::fs::copy(
+        Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/unsigned-sample.psd1"),
+        &script_path,
+    )
+    .expect("copy unsigned psd1");
+
+    let (mut guard, endpoint) = spawn_psign_artifact_signing_server_with_args(
+        2,
+        &["--expect-correlation-id", "build-42_suffix"],
+    );
+    let mut cmd = Command::cargo_bin("psign-tool").unwrap();
+    cmd.arg("--mode")
+        .arg("portable")
+        .arg("sign")
+        .arg("--digest")
+        .arg("sha256")
+        .arg("--artifact-signing-account-name")
+        .arg("acct")
+        .arg("--artifact-signing-profile-name")
+        .arg("prof")
+        .arg("--artifact-signing-correlation-id")
+        .arg("build-42_suffix")
+        .arg("--artifact-signing-access-token")
+        .arg("test-token")
+        .arg("--artifact-signing-endpoint")
+        .arg(&endpoint)
+        .arg(&script_path);
+    cmd.assert()
+        .success()
+        .stdout(predicate::str::contains("Signed:"));
+    let status = guard.0.wait().expect("Artifact Signing server exit");
+    assert!(
+        status.success(),
+        "Artifact Signing server failed with {status}"
+    );
+}
+
 #[cfg(all(feature = "timestamp-server", feature = "artifact-signing-rest"))]
 #[test]
 fn mode_portable_artifact_signing_signs_flat_msix() {