stablyai/orca · critical

${classification.message}\n${formatSignatureSummary(signatur

Error message

${classification.message}\n${formatSignatureSummary(signature)}

What it means

Thrown by verifyWindowsInnerSignature() when classifySignature() returns ok: false — the signature is either not 'Valid' status, or the signer subject/thumbprint does not match the expected values. The message is the classification.reason concatenated with a formatted signature summary (status, subject, issuer, thumbprint, validity dates).

Source

Thrown at config/scripts/verify-windows-inner-signature.mjs:187

}

export function verifyWindowsInnerSignature({
  executablePath,
  platform = process.platform,
  spawnSyncImpl = spawnSync,
  expectedSigners = parseExpectedSigners(),
  expectedThumbprints = parseExpectedThumbprints()
}) {
  validateExecutablePath(executablePath)

  if (platform !== 'win32') {
    throw new Error('Windows inner executable signature verification requires Windows.')
  }

  const signature = parseSignatureJson(getPowerShellSignatureJson(executablePath, spawnSyncImpl))
  const classification = classifySignature(signature, { expectedSigners, expectedThumbprints })
  if (!classification.ok) {
    throw new Error(`${classification.message}\n${formatSignatureSummary(signature)}`)
  }

  return signature
}

export function main(argv = process.argv.slice(2)) {
  try {
    const signature = verifyWindowsInnerSignature({ executablePath: argv[0] })
    console.log('Verified Windows inner executable signature.')
    console.log(formatSignatureSummary(signature))
  } catch (error) {
    console.error(error.message)
    process.exitCode = 1
  }
}

if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
  main()

View on GitHub (pinned to 1136503c6a)

Solutions

1. Read the signature summary in the error to see the actual status and signer — determine if it is a status issue (not Valid) or a signer mismatch.
2. If the signer changed intentionally (e.g. new certificate), update ORCA_WINDOWS_EXPECTED_SIGNERS or ORCA_WINDOWS_EXPECTED_THUMBPRINTS to include the new signer.
3. If status is NotSigned/HashMismatch, the build or signing pipeline is broken — fix the signing step before updating expected values.
4. If status is Valid but signer is unexpected, investigate whether an unauthorized certificate was used.

Example fix

// before: expected signer not updated after cert renewal
export const DEFAULT_EXPECTED_SIGNER =
  'CN=SignPath Foundation, O=SignPath Foundation, L=Lewes, S=Delaware, C=US'

// after: add new cert via env var in CI without changing the default
env:
  ORCA_WINDOWS_EXPECTED_SIGNERS: |
    CN=SignPath Foundation, O=SignPath Foundation, L=Lewes, S=Delaware, C=US;
    CN=New Cert Authority, O=New CA, C=US

function validateSignatureBeforeClassification(signature, expectedSigners, expectedThumbprints) {
  if (signature.status !== 'Valid') {
    throw new Error(`Signature status is ${signature.status}, not Valid`)
  }
  const subject = normalizeSignerSubject(signature.signerSubject)
  const thumbprint = normalizeThumbprint(signature.signerThumbprint)
  const subjectOk = expectedSigners.includes(subject)
  const thumbprintOk = expectedThumbprints.length > 0 && expectedThumbprints.includes(thumbprint)
  if (!subjectOk && !thumbprintOk) {
    throw new Error(`Signer not in allowlist: ${subject}`)
  }
}

function isValidSignedSignature(signature) {
  return signature !== null && typeof signature === 'object' &&
    signature.status === 'Valid' &&
    typeof signature.signerSubject === 'string'
}

try {
  const signature = verifyWindowsInnerSignature({ executablePath })
} catch (err) {
  if (err.message.includes('signature status is')) {
    // Status problem — the build is unsigned or tampered; fix the signing pipeline
    console.error('BUILD INTEGRITY FAILURE:', err.message)
  } else if (err.message.includes('Unexpected') && err.message.includes('signer')) {
    // Signer mismatch — if cert was renewed, update ORCA_WINDOWS_EXPECTED_SIGNERS
    console.error('CERTIFICATE MISMATCH — verify the new cert is authorized:', err.message)
  }
  throw err
}

When it happens

Trigger: classifySignature returns ok:false for one of two reasons: (1) signature.status !== 'Valid' (e.g. 'HashMismatch', 'NotSigned', 'UnknownError'), or (2) status is Valid but the signer is not in expectedSigners and not in expectedThumbprints. Expected signers default to SignPath Foundation; configurable via ORCA_WINDOWS_EXPECTED_SIGNERS and ORCA_WINDOWS_EXPECTED_THUMBPRINTS env vars.

Common situations: A build signed with a different/expired certificate; a test build that is unsigned; certificate renewal changing the signer subject; SignPath configuration pointing to a different project; ORCA_WINDOWS_EXPECTED_SIGNERS set incorrectly in CI; a tampered or corrupted exe producing HashMismatch.

Related errors

• PowerShell did not return signature JSON.
• PowerShell returned malformed signature JSON: ${error.messag
• PowerShell wrote to stderr while checking signature:\n${resu
• PowerShell signature check failed with exit code ${result.st
• Refusing to place the disposable validation root inside the

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/f473bfb78a3df4b8. Report an issue: GitHub.