Get-SqlDscCumulativeUpdate: New command proposal

Command proposal

Suggest adding a command that can return SQL Server Cumulative Update executables as System.IO.FileInfo objects.

Proposed parameters

Special considerations or limitations

By default the command should return all the available cumulative update executables. The parameters Latest and Version are mutually exclusive (by using parameter sets).

Parameter Version should be able to handle Microsoft’s NuGet package versioning format - version ranges

Language parameter might not work, because there is no way to know the language based on file information, it is possible to choose language on the Microsoft download site but all languages seems to download the same executable.

Parameters ProductName and Description should support wildcards (-like).

Download URL for KB5074901 - Cumulative Update 1 for SQL Server 2025:

https://download.microsoft.com/download/313ddc44-e6e1-47bc-b9b5-f9bf4d5f38f4/SQLServer2025-KB5074901-x64.exe

Get tile file information using:

(Get-Item -Path '<path>\SQLServer2025-KB5074901-x64.exe').VersionInfo | fl *

FileVersionRaw     : 17.0.4005.7
ProductVersionRaw  : 17.0.4005.7
Comments           : SQL
CompanyName        : Microsoft Corporation
FileBuildPart      : 4005
FileDescription    : Hotfix Pack
FileMajorPart      : 17
FileMinorPart      : 0
FileName           : <path>\SQLServer2025-KB5074901-x64.exe
FilePrivatePart    : 7
FileVersion        : 17.0.4005.7
InternalName       : boxstub_sql
IsDebug            : False
IsPatched          : False
IsPrivateBuild     : False
IsPreRelease       : False
IsSpecialBuild     : False
Language           : English (United States)
LegalCopyright     : Microsoft. All rights reserved.
LegalTrademarks    : Microsoft SQL Server is a registered trademark of Microsoft Corporation.
OriginalFilename   : boxstub_sql.exe
PrivateBuild       :
ProductBuildPart   : 4005
ProductMajorPart   : 17
ProductMinorPart   : 0
ProductName        : Microsoft SQL Server 2025
ProductPrivatePart : 7
ProductVersion     : 17.0.4005.7
SpecialBuild       :

We should also verify the digital signature by default (always after the command has filtered the result), if an invalid signature is detected a warning should be output and that executable should not be returned in the result.

$signature = Get-AuthenticodeSignature -FilePath '<path>\SQLServer2025-KB5074901-x64.exe'
# This must be true to return a result unless overridden by parameter
$signature.Status -eq 'Valid' -and $signature.SignerCertificate.Subject -like 'CN=Microsoft Corporation,*'

Optionally (and additionally) we can also look in the Enhanced Key Usage List

$signature.SignerCertificate.EnhancedKeyUsageList.ObjectId -contains '1.3.6.1.4.1.311.76.8.1' # Microsoft Publisher

Signature look like this (today):

EnhancedKeyUsageList : {Microsoft Publisher (1.3.6.1.4.1.311.76.8.1), Code Signing (1.3.6.1.5.5.7.3.3)}
DnsNameList          : {}
SendAsTrustedIssuer  : False
Archived             : False
Extensions           : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid,
                       System.Security.Cryptography.Oid, System.Security.Cryptography.Oid…}
FriendlyName         :
HasPrivateKey        : False
PrivateKey           :
IssuerName           : System.Security.Cryptography.X509Certificates.X500DistinguishedName
NotAfter             : 2026-06-17 20:21:35
NotBefore            : 2025-06-19 20:21:35
PublicKey            : System.Security.Cryptography.X509Certificates.PublicKey
RawData              : {48, 130, 6, 3…}
RawDataMemory        : System.ReadOnlyMemory<Byte>[1543]
SerialNumber         : 330000048498E212E078A3315D000000000484
SignatureAlgorithm   : System.Security.Cryptography.Oid
SubjectName          : System.Security.Cryptography.X509Certificates.X500DistinguishedName
Thumbprint           : F5877012FBD62FABCBDC8D8CEE9C9585BA30DF79
Version              : 3
Handle               : 2179748729392
Issuer               : CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject              : CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
SerialNumberBytes    : System.ReadOnlyMemory<Byte>[19]

No implementation files, tests, or existing entry points are named. Start by locating how PowerShell commands and their tests are organized in SqlServerDsc, then resolve the parameter-set, version-range, metadata-filtering, language, and signature-validation design. Done means the command returns the specified FileInfo results, excludes invalid signatures by default, and covers the requested behavior with tests.