Forward Artifact Signing correlation ID for PowerShell scripts

crates/psign-portable-core/src/lib.rs

@@ -351,6 +351,8 @@ pub struct PortableSignRequest {
     pub artifact_signing_federated_token_file: Option<String>,
     #[serde(default)]
     pub artifact_signing_exclude_credentials: Vec<String>,
+    #[serde(default)]
+    pub artifact_signing_correlation_id: Option<String>,
 }
 
 impl Default for PortableSignRequest {
@@ -392,6 +394,7 @@ impl Default for PortableSignRequest {
             artifact_signing_client_secret: None,
             artifact_signing_federated_token_file: None,
             artifact_signing_exclude_credentials: Vec::new(),
+            artifact_signing_correlation_id: None,
         }
     }
 }
@@ -1195,6 +1198,7 @@ struct ArtifactSigningProvider {
     endpoint: String,
     account_name: String,
     profile_name: String,
+    correlation_id: Option<String>,
     auth: psign_codesigning_rest::CodesigningAuth,
     chain: Vec<x509_cert::Certificate>,
 }
@@ -1391,7 +1395,7 @@ impl SigningProvider {
                     digest: digest.to_vec(),
                     signature_algorithm: artifact_signature_algorithm(digest_algorithm).to_string(),
                     api_version: psign_codesigning_rest::DEFAULT_API_VERSION.to_string(),
-                    correlation_id: None,
+                    correlation_id: provider.correlation_id.clone(),
                     authority: None,
                     auth: provider.auth.clone(),
                     endpoint_base_url: Some(provider.endpoint.clone()),
@@ -1509,6 +1513,7 @@ fn load_artifact_signing_provider(request: &PortableSignRequest) -> Result<Signi
             endpoint: endpoint.trim_end_matches('/').to_string(),
             account_name,
             profile_name,
+            correlation_id: text_opt(request.artifact_signing_correlation_id.as_deref()),
             auth,
             chain,
         },
@@ -4382,6 +4387,7 @@ mod tests {
             artifact_signing_client_secret: None,
             artifact_signing_federated_token_file: None,
             artifact_signing_exclude_credentials: Vec::new(),
+            artifact_signing_correlation_id: None,
         }
     }
 }

src/portable_sign.rs

@@ -1067,13 +1067,12 @@ fn run_portable_sign_portable_core_artifact_signing(
     let correlation_id = text_opt(args.artifact_signing_correlation_id.as_deref())
         .map(ToOwned::to_owned)
         .or_else(|| metadata.as_ref().and_then(|m| m.CorrelationId.clone()));
-    if correlation_id.is_some()
-        || text_present(&args.artifact_signing_signature_algorithm)
+    if text_present(&args.artifact_signing_signature_algorithm)
         || text_present(&args.artifact_signing_api_version)
         || text_present(&args.artifact_signing_authority)
     {
         return Err(anyhow!(
-            "native-shaped portable {target_kind} Artifact Signing does not yet support correlation ID, signature-algorithm, api-version, or authority overrides"
+            "native-shaped portable {target_kind} Artifact Signing does not yet support signature-algorithm, api-version, or authority overrides"
         ));
     }
 
@@ -1117,6 +1116,7 @@ fn run_portable_sign_portable_core_artifact_signing(
         )
         .map(ToOwned::to_owned),
         artifact_signing_exclude_credentials: std::mem::take(&mut exclude_credentials),
+        artifact_signing_correlation_id: correlation_id,
         ..Default::default()
     };
     let response = psign_portable_core::portable_sign(request).with_context(|| {

tests/cli_pe_digest.rs

@@ -6122,6 +6122,48 @@ fn mode_portable_artifact_signing_signs_and_timestamps_psd1() {
     assert!(signed.contains("# SIG # Begin signature block"));
 }
 
+#[cfg(all(feature = "timestamp-server", feature = "artifact-signing-rest"))]
+#[test]
+fn mode_portable_artifact_signing_forwards_correlation_id_for_scripts() {
+    let dir = tempfile::tempdir().unwrap();
+    let script_path = dir.path().join("sample.artifact-correlation.psd1");
+    std::fs::copy(
+        Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/unsigned-sample.psd1"),
+        &script_path,
+    )
+    .expect("copy unsigned psd1");
+
+    let (mut guard, endpoint) = spawn_psign_artifact_signing_server_with_args(
+        2,
+        &["--expect-correlation-id", "build-42_suffix"],
+    );
+    let mut cmd = Command::cargo_bin("psign-tool").unwrap();
+    cmd.arg("--mode")
+        .arg("portable")
+        .arg("sign")
+        .arg("--digest")
+        .arg("sha256")
+        .arg("--artifact-signing-account-name")
+        .arg("acct")
+        .arg("--artifact-signing-profile-name")
+        .arg("prof")
+        .arg("--artifact-signing-correlation-id")
+        .arg("build-42_suffix")
+        .arg("--artifact-signing-access-token")
+        .arg("test-token")
+        .arg("--artifact-signing-endpoint")
+        .arg(&endpoint)
+        .arg(&script_path);
+    cmd.assert()
+        .success()
+        .stdout(predicate::str::contains("Signed:"));
+    let status = guard.0.wait().expect("Artifact Signing server exit");
+    assert!(
+        status.success(),
+        "Artifact Signing server failed with {status}"
+    );
+}
+
 #[cfg(all(feature = "timestamp-server", feature = "artifact-signing-rest"))]
 #[test]
 fn mode_portable_artifact_signing_signs_flat_msix() {