{"record":{"id":"2e8d6378431cc594","repo":"stablyai/orca","slug":"powershell-signature-check-failed-with-exit-code","errorCode":null,"errorMessage":"PowerShell signature check failed with exit code ${result.status ?? '<unknown>'}.","messagePattern":"PowerShell signature check failed with exit code (.+?)\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/scripts/verify-windows-inner-signature.mjs","lineNumber":163,"sourceCode":"    {\n      encoding: 'utf8',\n      env: {\n        ...process.env,\n        ORCA_WINDOWS_INNER_EXECUTABLE: executablePath\n      }\n    }\n  )\n\n  if (result.error) {\n    throw result.error\n  }\n\n  if (result.stderr?.trim()) {\n    throw new Error(`PowerShell wrote to stderr while checking signature:\\n${result.stderr.trim()}`)\n  }\n\n  if (result.status !== 0) {\n    throw new Error(\n      `PowerShell signature check failed with exit code ${result.status ?? '<unknown>'}.`\n    )\n  }\n\n  return result.stdout\n}\n\nexport function verifyWindowsInnerSignature({\n  executablePath,\n  platform = process.platform,\n  spawnSyncImpl = spawnSync,\n  expectedSigners = parseExpectedSigners(),\n  expectedThumbprints = parseExpectedThumbprints()\n}) {\n  validateExecutablePath(executablePath)\n\n  if (platform !== 'win32') {\n    throw new Error('Windows inner executable signature verification requires Windows.')","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/config/scripts/verify-windows-inner-signature.mjs#L145-L181","documentation":"Thrown by getPowerShellSignatureJson() when the PowerShell child process exits with a non-zero status (and no spawn error, no stderr). This means PowerShell itself ran but the script failed — typically because $ErrorActionPreference='Stop' turned a cmdlet error into a non-zero exit.","triggerScenarios":"spawnSync('pwsh', [...]) returns result.status !== 0 with no result.error and empty stderr. Caused by: Get-AuthenticodeSignature throwing (e.g. file locked, access denied); the executable path being inaccessible; a terminating error in the script that exits before writing stderr.","commonSituations":"The Orca.exe file is locked by a running process preventing Get-AuthenticodeSignature from reading it; insufficient permissions on the file; the file being in use by the installer or updater; a PowerShell terminating error that exits with a code but no stderr output.","solutions":["Run the PowerShell script manually with the same env var to see the full error — $ErrorActionPreference='Stop' may hide detail in non-interactive mode.","Check if Orca.exe is locked by another process (running Orca, an installer, or the updater).","Verify read permissions on the executable path.","Temporarily set $ErrorActionPreference='Continue' in the script to capture the error detail."],"exampleFix":"// before: error detail lost under Stop preference\n$ErrorActionPreference = 'Stop'\n\n// after: capture detail in non-interactive mode\n$ErrorActionPreference = 'Continue'\ntry {\n  $signature = Get-AuthenticodeSignature -FilePath $env:ORCA_WINDOWS_INNER_EXECUTABLE\n} catch {\n  Write-Error $_; exit 1\n}","handlingStrategy":"try-catch","validationCode":"function assertFileReadable(executablePath) {\n  const result = spawnSync('pwsh', ['-NoProfile', '-Command',\n    `Test-Path '${executablePath}' -PathType Leaf`], { encoding: 'utf8' })\n  if (result.stdout.trim() !== 'True') {\n    throw new Error('Executable is not readable by PowerShell — check locks/permissions')\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  const stdout = getPowerShellSignatureJson(executablePath)\n} catch (err) {\n  if (err.message.includes('exit code')) {\n    // Re-run with $ErrorActionPreference='Continue' to capture the error detail\n    const diag = spawnSync('pwsh', ['-NoProfile', '-Command',\n      `try { Get-AuthenticodeSignature '${executablePath}' } catch { $_.Exception.Message }`],\n      { encoding: 'utf8' })\n    console.error('PowerShell error detail:', diag.stdout)\n  }\n  throw err\n}","preventionTips":["Ensure Orca.exe is not locked by a running process during verification.","Run the verifier after the build completes and before any process opens the exe.","Use $ErrorActionPreference='Continue' with explicit try/catch to preserve error detail."],"tags":["windows","powershell","exit-code","authenticode","signature"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}