{"record":{"id":"411f8940e8ded021","repo":"stablyai/orca","slug":"powershell-did-not-return-signature-json","errorCode":null,"errorMessage":"PowerShell did not return signature JSON.","messagePattern":"PowerShell did not return signature JSON\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/scripts/verify-windows-inner-signature.mjs","lineNumber":66,"sourceCode":"    .map(normalizeSignerSubject)\n    .filter(Boolean)\n}\n\nexport function parseExpectedThumbprints(value = process.env.ORCA_WINDOWS_EXPECTED_THUMBPRINTS) {\n  if (typeof value !== 'string' || value.trim() === '') {\n    return []\n  }\n\n  return value\n    .split(/[\\r\\n,;]+/u)\n    .map(normalizeThumbprint)\n    .filter(Boolean)\n}\n\nexport function parseSignatureJson(stdout) {\n  const trimmed = typeof stdout === 'string' ? stdout.trim() : ''\n  if (trimmed === '') {\n    throw new Error('PowerShell did not return signature JSON.')\n  }\n\n  try {\n    return JSON.parse(trimmed)\n  } catch (error) {\n    throw new Error(`PowerShell returned malformed signature JSON: ${error.message}`)\n  }\n}\n\nexport function classifySignature(signature, options = {}) {\n  const expectedSigners = options.expectedSigners ?? parseExpectedSigners()\n  const expectedThumbprints = options.expectedThumbprints ?? parseExpectedThumbprints()\n  const status = typeof signature?.status === 'string' ? signature.status : ''\n  const signerSubject = normalizeSignerSubject(signature?.signerSubject)\n  const signerThumbprint = normalizeThumbprint(signature?.signerThumbprint)\n  const subjectAllowed = expectedSigners.includes(signerSubject)\n  const thumbprintAllowed =\n    expectedThumbprints.length > 0 &&","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/config/scripts/verify-windows-inner-signature.mjs#L48-L84","documentation":"Thrown by parseSignatureJson() in verify-windows-inner-signature.mjs when the PowerShell Get-AuthenticodeSignature script produces empty stdout. The function trims stdout and throws if the result is an empty string. This indicates PowerShell ran without error but returned no JSON — the signature query produced no output at all.","triggerScenarios":"getPowerShellSignatureJson() returns result.stdout that is empty or whitespace-only after trim, while status is 0 and stderr is empty. Caused by: the PowerShell script's ConvertTo-Json producing no output when the signature object is null; the ORCA_WINDOWS_INNER_EXECUTABLE env var pointing to a path the script cannot read; PowerShell $ErrorActionPreference='Stop' silently swallowing output.","commonSituations":"Running the signature verifier on a path that is not a valid PE file (Get-AuthenticodeSignature returns a null signature); PowerShell Core (pwsh) not handling the script correctly on a given Windows build; the env var not propagating to the child process; a PowerShell version where ConvertTo-Json on null returns empty string.","solutions":["Manually run the POWERSHELL_SIGNATURE_SCRIPT with the same ORCA_WINDOWS_INNER_EXECUTABLE env var to see what Get-AuthenticodeSignature returns.","Confirm the executable path is a valid Windows PE (.exe) file — Get-AuthenticodeSignature on a non-PE file can return an unusable signature object.","Check that pwsh (PowerShell 7+) is installed and on PATH — the script spawns 'pwsh', not 'powershell'.","Verify the env var is reaching the child process (getPowerShellSignatureJson sets ORCA_WINDOWS_INNER_EXECUTABLE explicitly)."],"exampleFix":"// before: empty stdout on null signature\n$signature = Get-AuthenticodeSignature -FilePath $env:ORCA_WINDOWS_INNER_EXECUTABLE\n[pscustomobject]@{ status = $signature.Status.ToString() } | ConvertTo-Json\n\n// after: handle null signature explicitly\n$signature = Get-AuthenticodeSignature -FilePath $env:ORCA_WINDOWS_INNER_EXECUTABLE\nif ($null -eq $signature) { Write-Output '{}'; exit 0 }\n[pscustomobject]@{ status = $signature.Status.ToString() } | ConvertTo-Json","handlingStrategy":"try-catch","validationCode":"function preflightPwsh() {\n  const probe = spawnSync('pwsh', ['-NoLogo', '-NoProfile', '-Command', 'echo ok'], {\n    encoding: 'utf8'\n  })\n  if (probe.status !== 0 || probe.stdout.trim() !== 'ok') {\n    throw new Error('pwsh is not available or not functional on this system')\n  }\n}","typeGuard":"function isNonEmptyStdout(stdout) {\n  return typeof stdout === 'string' && stdout.trim().length > 0\n}","tryCatchPattern":"try {\n  const stdout = getPowerShellSignatureJson(executablePath)\n  if (!isNonEmptyStdout(stdout)) {\n    throw new Error('PowerShell returned empty stdout — check if the exe is a valid PE file')\n  }\n  return parseSignatureJson(stdout)\n} catch (err) {\n  if (err.message === 'PowerShell did not return signature JSON.') {\n    // Likely Get-AuthenticodeSignature returned null — file may not be a valid PE\n    console.error('Signature query returned nothing. Is the path a valid Windows executable?')\n  }\n  throw err\n}","preventionTips":["Verify the target is a valid Windows PE (.exe) before running the verifier.","Ensure pwsh (PowerShell 7+) is installed and on PATH.","Add a preflight check that pwsh responds before invoking the signature script."],"tags":["windows","powershell","authenticode","code-signing","signature"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}