Unsigned scripts in Windows PowerShell
Platform Notice: Cloud Only - This article only applies to Atlassian products on the cloud platform.
Summary
A Windows-based runner has failed to run one or more steps due to an unsigned PowerShell (.ps1) script
Diagnosis
A Windows-based runner has failed to run one or more steps due to an unsigned PowerShell (.ps1) script, resulting in an error similar to the following:
1
2
3
4
5
6
7
8
9
.\start.ps1 : File C:\Users\Administrator\atlassian-bitbucket-pipelines-runner\bin\start.ps1 cannot be loaded. The file
C:\Users\Administrator\atlassian-bitbucket-pipelines-runner\bin\start.ps1 is not digitally signed. You cannot run this script on the
current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at
https:/go.microsoft.com/fwlink/?LinkID=135170.
At line:1 char:1
+ .\start.ps1 -accountUuid '{924bbdf1-ea18-2c70-4655-2bb23075ddbf}' -re ...
+ ~~~~~~~~~~~
+ CategoryInfo : SecurityError: (:) [], PSSecurityException
+ FullyQualifiedErrorId : UnauthorizedAccessCause
The Windows runner generates PowerShell scripts for cloning the repository and running the script for each step in the pipeline. These scripts are generated when the pipeline is run, preventing them from being digitally signed.
To allow the Windows runners to run unsigned PowerShell scripts, set the PowerShell execution policy of the CurrentUser to either:
RemoteSigned(recommended)unrestrictedbypass
The RemoteSigned execution policy allows local unsigned (uncertified) scripts to run on the device. This includes any potentially malicious unsigned scripts. Before changing the execution policy, review the execution policies and consider their security implications at Microsoft Docs — PowerShell execution policies.
Solution
To check the execution policy for the CurrentUser:
Open Windows PowerShell from the Windows Start menu.
Run the following command, which will return the execution policy for the
CurrentUser:1Get-ExecutionPolicy -Scope CurrentUser
To change the execution policy for CurrentUser to RemoteSigned:
In Windows PowerShell, run the following command:
1Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUserVerify that the change was successful by running
Get-ExecutionPolicyand confirm that theCurrentUserhas theRemoteSignedexecution policy.1Get-ExecutionPolicy -Scope CurrentUser
For information on Microsoft PowerShell execution policies, visit Microsoft Docs — PowerShell: about Execution Policies.
Was this helpful?