{"record":{"id":"6d1f0db3fdbc9f4b","repo":"stablyai/orca","slug":"powershell-wrote-to-stderr-while-checking-signatur","errorCode":null,"errorMessage":"PowerShell wrote to stderr while checking signature:\\n${result.stderr.trim()}","messagePattern":"PowerShell wrote to stderr while checking signature:\\\\n(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/scripts/verify-windows-inner-signature.mjs","lineNumber":159,"sourceCode":"      'Bypass',\n      '-Command',\n      POWERSHELL_SIGNATURE_SCRIPT\n    ],\n    {\n      encoding: 'utf8',\n      env: {\n        ...process.env,\n        ORCA_WINDOWS_INNER_EXECUTABLE: executablePath\n      }\n    }\n  )\n\n  if (result.error) {\n    throw result.error\n  }\n\n  if (result.stderr?.trim()) {\n    throw new Error(`PowerShell wrote to stderr while checking signature:\\n${result.stderr.trim()}`)\n  }\n\n  if (result.status !== 0) {\n    throw new Error(\n      `PowerShell signature check failed with exit code ${result.status ?? '<unknown>'}.`\n    )\n  }\n\n  return result.stdout\n}\n\nexport function verifyWindowsInnerSignature({\n  executablePath,\n  platform = process.platform,\n  spawnSyncImpl = spawnSync,\n  expectedSigners = parseExpectedSigners(),\n  expectedThumbprints = parseExpectedThumbprints()\n}) {","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/config/scripts/verify-windows-inner-signature.mjs#L141-L177","documentation":"Thrown by getPowerShellSignatureJson() when the PowerShell child process exits cleanly (status 0, no spawn error) but wrote content to stderr. The script treats any stderr output as a failure signal, since Get-AuthenticodeSignature with $ErrorActionPreference='Stop' should produce no stderr on success.","triggerScenarios":"spawnSync('pwsh', [...]) returns with result.stderr containing non-whitespace text. Caused by: PowerShell writing warnings or verbose messages to stderr; a certificate chain validation warning; a PowerShell module loading error; antivirus or EDR intercepting the signature check.","commonSituations":"Windows Defender or EDR flagging the signature query; PowerShell $VerbosePreference or $WarningPreference leaking to stderr; a certificate trust warning (e.g. untrusted root) written as a warning; a PowerShell version difference in error stream behavior.","solutions":["Read the stderr content in the error message to identify the specific warning or error PowerShell emitted.","If the stderr content is a benign warning (e.g. certificate chain noise), consider whether the script should tolerate specific warning patterns.","Set $WarningPreference='SilentlyContinue' and $VerbosePreference='SilentlyContinue' in the PowerShell script to suppress non-error stream output.","If an EDR/antivirus is interfering, add an exclusion for the verifier process or the Orca.exe path."],"exampleFix":"// before: warnings leak to stderr and fail the check\n$ErrorActionPreference = 'Stop'\n$signature = Get-AuthenticodeSignature -FilePath $env:ORCA_WINDOWS_INNER_EXECUTABLE\n\n// after: suppress non-error streams\n$ErrorActionPreference = 'Stop'\n$WarningPreference = 'SilentlyContinue'\n$VerbosePreference = 'SilentlyContinue'\n$signature = Get-AuthenticodeSignature -FilePath $env:ORCA_WINDOWS_INNER_EXECUTABLE","handlingStrategy":"try-catch","validationCode":"function preflightStderrClean(executablePath) {\n  const result = spawnSync('pwsh', ['-NoProfile', '-Command',\n    '$WarningPreference=\"SilentlyContinue\"; Write-Output ok'], { encoding: 'utf8' })\n  if (result.stderr?.trim()) {\n    console.warn('PowerShell environment produces stderr warnings; verifier may fail.')\n  }\n}","typeGuard":"function hasCleanStderr(result) {\n  return !result.stderr || result.stderr.trim() === ''\n}","tryCatchPattern":"try {\n  const stdout = getPowerShellSignatureJson(executablePath)\n} catch (err) {\n  if (err.message.includes('wrote to stderr')) {\n    // Retry with suppressed warning stream, or inspect stderr for benign warnings\n    console.error('PowerShell stderr:', err.message)\n  }\n  throw err\n}","preventionTips":["Set $WarningPreference='SilentlyContinue' and $VerbosePreference='SilentlyContinue' in the script.","Ensure no PowerShell profile or module auto-load writes to stderr.","Check for EDR/antivirus interference on the CI runner."],"tags":["windows","powershell","stderr","authenticode","signature"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}