{"record":{"id":"6f9387799d07bb7b","repo":"stablyai/orca","slug":"windows-inner-executable-signature-verification-re","errorCode":null,"errorMessage":"Windows inner executable signature verification requires Windows.","messagePattern":"Windows inner executable signature verification requires Windows\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/scripts/verify-windows-inner-signature.mjs","lineNumber":181,"sourceCode":"    throw new Error(\n      `PowerShell signature check failed with exit code ${result.status ?? '<unknown>'}.`\n    )\n  }\n\n  return result.stdout\n}\n\nexport function verifyWindowsInnerSignature({\n  executablePath,\n  platform = process.platform,\n  spawnSyncImpl = spawnSync,\n  expectedSigners = parseExpectedSigners(),\n  expectedThumbprints = parseExpectedThumbprints()\n}) {\n  validateExecutablePath(executablePath)\n\n  if (platform !== 'win32') {\n    throw new Error('Windows inner executable signature verification requires Windows.')\n  }\n\n  const signature = parseSignatureJson(getPowerShellSignatureJson(executablePath, spawnSyncImpl))\n  const classification = classifySignature(signature, { expectedSigners, expectedThumbprints })\n  if (!classification.ok) {\n    throw new Error(`${classification.message}\\n${formatSignatureSummary(signature)}`)\n  }\n\n  return signature\n}\n\nexport function main(argv = process.argv.slice(2)) {\n  try {\n    const signature = verifyWindowsInnerSignature({ executablePath: argv[0] })\n    console.log('Verified Windows inner executable signature.')\n    console.log(formatSignatureSummary(signature))\n  } catch (error) {\n    console.error(error.message)","sourceCodeStart":163,"sourceCodeEnd":199,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/config/scripts/verify-windows-inner-signature.mjs#L163-L199","documentation":"Thrown by verifyWindowsInnerSignature() when the platform argument (defaulting to process.platform) is not 'win32'. Get-AuthenticodeSignature is a Windows-only cmdlet, so the entire verification is gated on running on Windows. This prevents cryptic PowerShell errors on macOS/Linux CI runners.","triggerScenarios":"verifyWindowsInnerSignature({ platform }) is called with platform !== 'win32', or the default process.platform is 'darwin'/'linux'. Caused by: running the verifier on a non-Windows CI runner; calling the function in a cross-platform test without mocking platform.","commonSituations":"A CI pipeline that runs all verification scripts on a Linux/macOS runner without gating the Windows-only ones; a test that calls verifyWindowsInnerSignature without setting platform: 'win32' in the options; a developer running the script locally on macOS.","solutions":["Run this verifier only on a Windows runner (windows-latest in GitHub Actions, etc.).","Gate the invocation in CI with a platform check before calling the script.","In tests, pass platform: 'win32' and a mock spawnSyncImpl to avoid the guard."],"exampleFix":"// before: runs on all platforms\n- run: node config/scripts/verify-windows-inner-signature.mjs dist/Orca.exe\n\n// after: Windows-only job\nruns-on: windows-latest\n- run: node config/scripts/verify-windows-inner-signature.mjs dist/Orca.exe","handlingStrategy":"validation","validationCode":"function assertWindowsPlatform(platform = process.platform) {\n  if (platform !== 'win32') {\n    throw new Error(\n      `Signature verification requires Windows. Current platform: ${platform}`\n    )\n  }\n}","typeGuard":"function isWindowsPlatform(platform) {\n  return platform === 'win32'\n}","tryCatchPattern":null,"preventionTips":["Gate the verifier invocation in CI with `if: runner.os == 'Windows'`.","In cross-platform tests, pass platform: 'win32' with a mock spawnSyncImpl.","Document that this script is Windows-only at the top of the file."],"tags":["windows","platform-guard","ci","signature"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}