PowerShell signature check failed with exit code ${result.st

Error message

PowerShell signature check failed with exit code ${result.status ?? '<unknown>'}.

What it means

Thrown by getPowerShellSignatureJson() when the PowerShell child process exits with a non-zero status (and no spawn error, no stderr). This means PowerShell itself ran but the script failed — typically because $ErrorActionPreference='Stop' turned a cmdlet error into a non-zero exit.

Source

Thrown at config/scripts/verify-windows-inner-signature.mjs:163

    {
      encoding: 'utf8',
      env: {
        ...process.env,
        ORCA_WINDOWS_INNER_EXECUTABLE: executablePath
      }
    }
  )

  if (result.error) {
    throw result.error
  }

  if (result.stderr?.trim()) {
    throw new Error(`PowerShell wrote to stderr while checking signature:\n${result.stderr.trim()}`)
  }

  if (result.status !== 0) {
    throw new Error(
      `PowerShell signature check failed with exit code ${result.status ?? '<unknown>'}.`
    )
  }

  return result.stdout
}

export function verifyWindowsInnerSignature({
  executablePath,
  platform = process.platform,
  spawnSyncImpl = spawnSync,
  expectedSigners = parseExpectedSigners(),
  expectedThumbprints = parseExpectedThumbprints()
}) {
  validateExecutablePath(executablePath)

  if (platform !== 'win32') {
    throw new Error('Windows inner executable signature verification requires Windows.')

View on GitHub (pinned to 1136503c6a)

Solutions

Run the PowerShell script manually with the same env var to see the full error — $ErrorActionPreference='Stop' may hide detail in non-interactive mode.
Check if Orca.exe is locked by another process (running Orca, an installer, or the updater).
Verify read permissions on the executable path.
Temporarily set $ErrorActionPreference='Continue' in the script to capture the error detail.

Example fix

// before: error detail lost under Stop preference
$ErrorActionPreference = 'Stop'

// after: capture detail in non-interactive mode
$ErrorActionPreference = 'Continue'
try {
  $signature = Get-AuthenticodeSignature -FilePath $env:ORCA_WINDOWS_INNER_EXECUTABLE
} catch {
  Write-Error $_; exit 1
}

Defensive patterns

Strategy: try-catch

Validate before calling

function assertFileReadable(executablePath) {
  const result = spawnSync('pwsh', ['-NoProfile', '-Command',
    `Test-Path '${executablePath}' -PathType Leaf`], { encoding: 'utf8' })
  if (result.stdout.trim() !== 'True') {
    throw new Error('Executable is not readable by PowerShell — check locks/permissions')
  }
}

Try / catch

try {
  const stdout = getPowerShellSignatureJson(executablePath)
} catch (err) {
  if (err.message.includes('exit code')) {
    // Re-run with $ErrorActionPreference='Continue' to capture the error detail
    const diag = spawnSync('pwsh', ['-NoProfile', '-Command',
      `try { Get-AuthenticodeSignature '${executablePath}' } catch { $_.Exception.Message }`],
      { encoding: 'utf8' })
    console.error('PowerShell error detail:', diag.stdout)
  }
  throw err
}

Prevention

Ensure Orca.exe is not locked by a running process during verification.
Run the verifier after the build completes and before any process opens the exe.
Use $ErrorActionPreference='Continue' with explicit try/catch to preserve error detail.

When it happens

Trigger: spawnSync('pwsh', [...]) returns result.status !== 0 with no result.error and empty stderr. Caused by: Get-AuthenticodeSignature throwing (e.g. file locked, access denied); the executable path being inaccessible; a terminating error in the script that exits before writing stderr.

Common situations: The Orca.exe file is locked by a running process preventing Get-AuthenticodeSignature from reading it; insufficient permissions on the file; the file being in use by the installer or updater; a PowerShell terminating error that exits with a code but no stderr output.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/2e8d6378431cc594. Report an issue: GitHub.