{"record":{"id":"f473bfb78a3df4b8","repo":"stablyai/orca","slug":"classification-message-n-formatsignaturesummar","errorCode":null,"errorMessage":"${classification.message}\\n${formatSignatureSummary(signature)}","messagePattern":"\\$\\{classification\\.message\\}\\\\n\\$\\{formatSignatureSummary\\(signature\\)\\}","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"config/scripts/verify-windows-inner-signature.mjs","lineNumber":187,"sourceCode":"}\n\nexport function verifyWindowsInnerSignature({\n  executablePath,\n  platform = process.platform,\n  spawnSyncImpl = spawnSync,\n  expectedSigners = parseExpectedSigners(),\n  expectedThumbprints = parseExpectedThumbprints()\n}) {\n  validateExecutablePath(executablePath)\n\n  if (platform !== 'win32') {\n    throw new Error('Windows inner executable signature verification requires Windows.')\n  }\n\n  const signature = parseSignatureJson(getPowerShellSignatureJson(executablePath, spawnSyncImpl))\n  const classification = classifySignature(signature, { expectedSigners, expectedThumbprints })\n  if (!classification.ok) {\n    throw new Error(`${classification.message}\\n${formatSignatureSummary(signature)}`)\n  }\n\n  return signature\n}\n\nexport function main(argv = process.argv.slice(2)) {\n  try {\n    const signature = verifyWindowsInnerSignature({ executablePath: argv[0] })\n    console.log('Verified Windows inner executable signature.')\n    console.log(formatSignatureSummary(signature))\n  } catch (error) {\n    console.error(error.message)\n    process.exitCode = 1\n  }\n}\n\nif (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {\n  main()","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/config/scripts/verify-windows-inner-signature.mjs#L169-L205","documentation":"Thrown by verifyWindowsInnerSignature() when classifySignature() returns ok: false — the signature is either not 'Valid' status, or the signer subject/thumbprint does not match the expected values. The message is the classification.reason concatenated with a formatted signature summary (status, subject, issuer, thumbprint, validity dates).","triggerScenarios":"classifySignature returns ok:false for one of two reasons: (1) signature.status !== 'Valid' (e.g. 'HashMismatch', 'NotSigned', 'UnknownError'), or (2) status is Valid but the signer is not in expectedSigners and not in expectedThumbprints. Expected signers default to SignPath Foundation; configurable via ORCA_WINDOWS_EXPECTED_SIGNERS and ORCA_WINDOWS_EXPECTED_THUMBPRINTS env vars.","commonSituations":"A build signed with a different/expired certificate; a test build that is unsigned; certificate renewal changing the signer subject; SignPath configuration pointing to a different project; ORCA_WINDOWS_EXPECTED_SIGNERS set incorrectly in CI; a tampered or corrupted exe producing HashMismatch.","solutions":["Read the signature summary in the error to see the actual status and signer — determine if it is a status issue (not Valid) or a signer mismatch.","If the signer changed intentionally (e.g. new certificate), update ORCA_WINDOWS_EXPECTED_SIGNERS or ORCA_WINDOWS_EXPECTED_THUMBPRINTS to include the new signer.","If status is NotSigned/HashMismatch, the build or signing pipeline is broken — fix the signing step before updating expected values.","If status is Valid but signer is unexpected, investigate whether an unauthorized certificate was used."],"exampleFix":"// before: expected signer not updated after cert renewal\nexport const DEFAULT_EXPECTED_SIGNER =\n  'CN=SignPath Foundation, O=SignPath Foundation, L=Lewes, S=Delaware, C=US'\n\n// after: add new cert via env var in CI without changing the default\nenv:\n  ORCA_WINDOWS_EXPECTED_SIGNERS: |\n    CN=SignPath Foundation, O=SignPath Foundation, L=Lewes, S=Delaware, C=US;\n    CN=New Cert Authority, O=New CA, C=US","handlingStrategy":"validation","validationCode":"function validateSignatureBeforeClassification(signature, expectedSigners, expectedThumbprints) {\n  if (signature.status !== 'Valid') {\n    throw new Error(`Signature status is ${signature.status}, not Valid`)\n  }\n  const subject = normalizeSignerSubject(signature.signerSubject)\n  const thumbprint = normalizeThumbprint(signature.signerThumbprint)\n  const subjectOk = expectedSigners.includes(subject)\n  const thumbprintOk = expectedThumbprints.length > 0 && expectedThumbprints.includes(thumbprint)\n  if (!subjectOk && !thumbprintOk) {\n    throw new Error(`Signer not in allowlist: ${subject}`)\n  }\n}","typeGuard":"function isValidSignedSignature(signature) {\n  return signature !== null && typeof signature === 'object' &&\n    signature.status === 'Valid' &&\n    typeof signature.signerSubject === 'string'\n}","tryCatchPattern":"try {\n  const signature = verifyWindowsInnerSignature({ executablePath })\n} catch (err) {\n  if (err.message.includes('signature status is')) {\n    // Status problem — the build is unsigned or tampered; fix the signing pipeline\n    console.error('BUILD INTEGRITY FAILURE:', err.message)\n  } else if (err.message.includes('Unexpected') && err.message.includes('signer')) {\n    // Signer mismatch — if cert was renewed, update ORCA_WINDOWS_EXPECTED_SIGNERS\n    console.error('CERTIFICATE MISMATCH — verify the new cert is authorized:', err.message)\n  }\n  throw err\n}","preventionTips":["When renewing certificates, update ORCA_WINDOWS_EXPECTED_SIGNERS in the same release.","Add a test that classifies a known-good signature against the expected list.","Fail the build (not just warn) on any signature classification failure in release CI.","Monitor certificate NotAfter dates and alert before expiry."],"tags":["windows","authenticode","code-signing","certificate","security","signature"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}