From 899bd7b553b1a17d0dddf614986e7190f046915d Mon Sep 17 00:00:00 2001
From: Uarz <149165079+Uarz@users.noreply.github.com>
Date: Thu, 27 Aug 2026 02:46:32 +0800
Subject: [PATCH] Skip signed PowerShell profiles instead of breaking them

Installing coreutils injects a managed section into the user's
PowerShell profile. If that profile is Authenticode-signed (e.g. under
an AllSigned execution policy), rewriting the file invalidates the
signature and the profile no longer loads, breaking the user's shell.

Detect signed profiles with Get-AuthenticodeSignature before writing:
when a signature is present (Status != NotSigned), skip the injection
for that profile and emit a warning instead of silently corrupting it.

Fixes #161
---
 src/pwsh-install.ps1 | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/pwsh-install.ps1 b/src/pwsh-install.ps1
index aa04834..3ae5025 100644
--- a/src/pwsh-install.ps1
+++ b/src/pwsh-install.ps1
@@ -91,6 +91,18 @@ function Update-PowerShellProfile([string]$Path, [bool] $Install, [bool] $UseBom
         $Path = $profile.ResolvedTarget
     }
 
+    # A signed PowerShell profile cannot be modified without invalidating its
+    # Authenticode signature, which breaks profile loading under signed
+    # execution policies (AllSigned/etc.). Detect such profiles and skip them
+    # instead of silently breaking them. See microsoft/coreutils#161.
+    if (Test-Path -LiteralPath $Path) {
+        $signature = Get-AuthenticodeSignature -LiteralPath $Path -ErrorAction Ignore
+        if ($null -ne $signature -and $signature.Status -ne 'NotSigned') {
+            Write-Warning "Skipping signed PowerShell profile '$Path': modifying it would break its Authenticode signature. coreutils commands will not be available in this profile."
+            return
+        }
+    }
+
     # Get-Content uses .NET's StreamReader, so it auto-detects UTF-8/UTF-16 with BOM.
     $text = Get-Content -LiteralPath $Path -Raw -ErrorAction Ignore
     if (!$text) {