stablyai/orca · error

PowerShell did not return signature JSON.

Error message

PowerShell did not return signature JSON.

What it means

Thrown by parseSignatureJson() in verify-windows-inner-signature.mjs when the PowerShell Get-AuthenticodeSignature script produces empty stdout. The function trims stdout and throws if the result is an empty string. This indicates PowerShell ran without error but returned no JSON — the signature query produced no output at all.

Source

Thrown at config/scripts/verify-windows-inner-signature.mjs:66

    .map(normalizeSignerSubject)
    .filter(Boolean)
}

export function parseExpectedThumbprints(value = process.env.ORCA_WINDOWS_EXPECTED_THUMBPRINTS) {
  if (typeof value !== 'string' || value.trim() === '') {
    return []
  }

  return value
    .split(/[\r\n,;]+/u)
    .map(normalizeThumbprint)
    .filter(Boolean)
}

export function parseSignatureJson(stdout) {
  const trimmed = typeof stdout === 'string' ? stdout.trim() : ''
  if (trimmed === '') {
    throw new Error('PowerShell did not return signature JSON.')
  }

  try {
    return JSON.parse(trimmed)
  } catch (error) {
    throw new Error(`PowerShell returned malformed signature JSON: ${error.message}`)
  }
}

export function classifySignature(signature, options = {}) {
  const expectedSigners = options.expectedSigners ?? parseExpectedSigners()
  const expectedThumbprints = options.expectedThumbprints ?? parseExpectedThumbprints()
  const status = typeof signature?.status === 'string' ? signature.status : ''
  const signerSubject = normalizeSignerSubject(signature?.signerSubject)
  const signerThumbprint = normalizeThumbprint(signature?.signerThumbprint)
  const subjectAllowed = expectedSigners.includes(signerSubject)
  const thumbprintAllowed =
    expectedThumbprints.length > 0 &&

View on GitHub (pinned to 1136503c6a)

Solutions

1. Manually run the POWERSHELL_SIGNATURE_SCRIPT with the same ORCA_WINDOWS_INNER_EXECUTABLE env var to see what Get-AuthenticodeSignature returns.
2. Confirm the executable path is a valid Windows PE (.exe) file — Get-AuthenticodeSignature on a non-PE file can return an unusable signature object.
3. Check that pwsh (PowerShell 7+) is installed and on PATH — the script spawns 'pwsh', not 'powershell'.
4. Verify the env var is reaching the child process (getPowerShellSignatureJson sets ORCA_WINDOWS_INNER_EXECUTABLE explicitly).

Example fix

// before: empty stdout on null signature
$signature = Get-AuthenticodeSignature -FilePath $env:ORCA_WINDOWS_INNER_EXECUTABLE
[pscustomobject]@{ status = $signature.Status.ToString() } | ConvertTo-Json

// after: handle null signature explicitly
$signature = Get-AuthenticodeSignature -FilePath $env:ORCA_WINDOWS_INNER_EXECUTABLE
if ($null -eq $signature) { Write-Output '{}'; exit 0 }
[pscustomobject]@{ status = $signature.Status.ToString() } | ConvertTo-Json

function preflightPwsh() {
  const probe = spawnSync('pwsh', ['-NoLogo', '-NoProfile', '-Command', 'echo ok'], {
    encoding: 'utf8'
  })
  if (probe.status !== 0 || probe.stdout.trim() !== 'ok') {
    throw new Error('pwsh is not available or not functional on this system')
  }
}

function isNonEmptyStdout(stdout) {
  return typeof stdout === 'string' && stdout.trim().length > 0
}

try {
  const stdout = getPowerShellSignatureJson(executablePath)
  if (!isNonEmptyStdout(stdout)) {
    throw new Error('PowerShell returned empty stdout — check if the exe is a valid PE file')
  }
  return parseSignatureJson(stdout)
} catch (err) {
  if (err.message === 'PowerShell did not return signature JSON.') {
    // Likely Get-AuthenticodeSignature returned null — file may not be a valid PE
    console.error('Signature query returned nothing. Is the path a valid Windows executable?')
  }
  throw err
}

When it happens

Trigger: getPowerShellSignatureJson() returns result.stdout that is empty or whitespace-only after trim, while status is 0 and stderr is empty. Caused by: the PowerShell script's ConvertTo-Json producing no output when the signature object is null; the ORCA_WINDOWS_INNER_EXECUTABLE env var pointing to a path the script cannot read; PowerShell $ErrorActionPreference='Stop' silently swallowing output.

Common situations: Running the signature verifier on a path that is not a valid PE file (Get-AuthenticodeSignature returns a null signature); PowerShell Core (pwsh) not handling the script correctly on a given Windows build; the env var not propagating to the child process; a PowerShell version where ConvertTo-Json on null returns empty string.

Related errors

• PowerShell returned malformed signature JSON: ${error.messag
• PowerShell wrote to stderr while checking signature:\n${resu
• PowerShell signature check failed with exit code ${result.st
• ${classification.message}\n${formatSignatureSummary(signatur
• ${result.stderr || 'PowerShell process enumeration failed'}

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/411f8940e8ded021. Report an issue: GitHub.