<xsharper>
    <versionInfo title="Sign-Cert" value="Sign XSH script with a given certificate" version="0.0.0.1" />
    <usage options="ifNoArguments default" />
    <param name="data" value="Script file" description="script.xsh" required="true" />
    <param name="certSubject" value="Certificate subject" required="true" />
    <param />
    <param value="Parameters:" />
    <param />
    <param switch="machine" count="none" value="Use machine certificate store" default="0" unspecified="1" />
    <reference name="System.Security" />
    <?h using System;
       using System.Text;
       using System.Security.Cryptography;
       using System.Security.Cryptography.Xml;
       using System.Security.Cryptography.X509Certificates;
       
       
   ?>
    <code><![CDATA[
       X509Store store = new X509Store("My", c.GetBool("machine")?StoreLocation.LocalMachine:StoreLocation.CurrentUser);
       try
       {
           store.Open(OpenFlags.OpenExistingOnly | OpenFlags.ReadOnly);
           X509Certificate2Collection coll=store.Certificates.Find(X509FindType.FindBySubjectName, c.GetStr("certSubject"), false);
           if (coll.Count==0)
           {
               c.Error.WriteLine("Certificate not found");
               return -2;
           }
           if (coll.Count!=1)
           {
               c.Error.WriteLine("Too many certificates found");
               return -2;
           }
           
           X509Certificate2 cert=coll[0];
           if (cert.PrivateKey==null)
           {
               c.Error.WriteLine("Certificate does not have a private key");
               return -2;
           }
           
           PrintInfo(cert);
           
           X509ChainPolicy pol = new X509ChainPolicy();
           pol.RevocationMode = X509RevocationMode.NoCheck;
           pol.VerificationFlags = X509VerificationFlags.IgnoreEndRevocationUnknown | X509VerificationFlags.IgnoreCertificateAuthorityRevocationUnknown | X509VerificationFlags.IgnoreRootRevocationUnknown;
           pol.ApplicationPolicy.Add(new Oid("1.3.6.1.5.5.7.3.3"));
               
           X509Chain chain = new X509Chain(true);
           chain.ChainPolicy = pol;
           if (!chain.Build(cert))
               c.Error.WriteLine("Warning: Certificate is not trusted for CodeSigning");
       

           string filename=(string)c["data"];
           XmlDocument doc = new XmlDocument();
           doc.PreserveWhitespace = true;
           doc.Load(filename);
               
           SignedXml signer=  new SignedXml(doc);
       
           var el=doc.GetElementsByTagName("Signature");
           if (el!=null && el.Count!=0 && el[0]!=null && el[0] is XmlElement)
               el[0].ParentNode.RemoveChild(el[0]);

           
           signer.KeyInfo = new KeyInfo();
           signer.KeyInfo.AddClause(new KeyInfoX509Data(cert,X509IncludeOption.ExcludeRoot));
           signer.SigningKey = cert.PrivateKey;
           signer.SignedInfo.CanonicalizationMethod = SignedXml.XmlDsigExcC14NWithCommentsTransformUrl;

           XmlDsigExcC14NWithCommentsTransform canMethod = (XmlDsigExcC14NWithCommentsTransform)signer.SignedInfo.CanonicalizationMethodObject;
           canMethod.InclusiveNamespacesPrefixList = "Sign";


           Reference orderRef = new Reference("");
           orderRef.AddTransform(new XmlDsigEnvelopedSignatureTransform());
           signer.AddReference(orderRef);
           
           signer.ComputeSignature();
           doc.DocumentElement.AppendChild(signer.GetXml());
           doc.Save(filename);
           c.Print("Script '${=Path.GetFullPath($data)}' has been signed & saved successfully");
           return 0;
       }
       finally {
           store.Close();
       }

   ]]>
    <sub id="PrintInfo">
        <param name="cert" required="true" />
        <print tr="trim multiline expand" outTo="^info">
            ==== Certificate info ===
            Subject:      ${=$cert.Subject}    
            Expiration:   ${=$cert.GetExpirationDateString()}
            Issuer:       ${=$cert.Subject}    
            Serial:       ${=$cert.SerialNumber}
            Thumbprint:   ${=$cert.Thumbprint}
           
        </print>
       
    </sub>
    </code>
</xsharper>