How do I sign a Power BI .pqx file when .pfx files are now no longer available

[SimonMartyn]

Preflight Checklist

• I have installed the latest version of Power Query SDK.
• I have checked existing resources, including the common issues and the release notes.
• I have searched for similar issues.

Power Query SDK

0.1.5

Regression From

No response

Platform

All

Architecture

i86

OS Version

No response

VSCode version

1.93

PQSdkTool Path

not relevant

Bug Description

The documentation says to use the MakePQX tool to pack the .mez to a .pqx file and then sign with the .pfx file from a code signing certificate.
But now code signing certificates comes on a memory stick and you can no longer extract the .pfx file.
If I can't sign the .pqx my clients will have to reduce the security setting in Power BI to enable the custom connector I've built

Steps to Reproduce

1. Download the MakePQX tool. 2 Execute the Pack command. 3. Try to get the .pfx file from the code signing certificate

Actual Experience

The documented way to extract a .pfx file no longer seems to work since code signing certificates changed in May 2023

Expected Experience

I expected a way to extract the .pfx file or a way to sign the .pqx file without the .pfx file

Additional Context

This was originally raised as a support call on Microsoft .com as part of my MAPS support. It was directed to the Power BI break and fix team who could not answer the question and instead gave me this link to raise it as an issue.

[NuxXDev]

@SimonMartyn Did you ever find a solution to this? I am having the same issue.

[SimonMartyn]

No, I'm afraid not.
In the end I abandoned the .pqx approach as Microsoft would not have included it as a part of the built-in connectors in Power BI.
My solution was to put all the code that was in the connector into a standard .pbix file which can be distributed to the users at my clients. It was easier to distribute a template .pbix than have users install an unsigned .pqx
Works for my requirements but probably not suitable in all cases.

[gmcchessney]

We are in a similar situation, but our certificate is hosted in Azure Key Vault. We don't have a physical device which contains the certificate. I did come across a solution for using a Hardware Token on the Microsoft Fabric Community site which may be helpful: https://community.fabric.microsoft.com/t5/Power-Query/How-to-sign-the-pqx-file-using-a-Hardware-Token-model-through/m-p/3831419/highlight/true#M126477

As I said, in our case the certificate is stored in Azure Key Vault and we don't have a physical token. I ended up using the Dotnet Sign CLI tool to sign our .pqx file. It works, but you have to trick the tool into thinking it's signing a .vsix file.

1. Rename *.pqx to *.vsix
2. Run Sign CLI to sign the *.vsix file, for example:

   sign code azure-key-vault `
     "$vsixPath" `
     --azure-key-vault-tenant-id "$(AzureKeyVaultTenantId)" `
     --azure-key-vault-client-id "$(AzureKeyVaultClientId)" `
     --azure-key-vault-client-secret "$(AzureKeyVaultClientSecret)" `
     --azure-key-vault-certificate "$(AzureKeyVaultCertificateName)" `
     --azure-key-vault-url "$(AzureKeyVaultUrl)"

3. Rename *.vsix back to *.pqx

This works because .vsix and .pqx are both OPC (Open Packaging Conventions) files and are signed in the same way.