stablyai/orca · error

PowerShell signature check failed with exit code

Error message

PowerShell signature check failed with exit code ${result.status ?? '<unknown>'}.

What it means

Thrown by getPowerShellSignatureJson() when the PowerShell child process exits with a non-zero status (and no spawn error, no stderr). This means PowerShell itself ran but the script failed — typically because $ErrorActionPreference='Stop' turned a cmdlet error into a non-zero exit.

Solutions

1. Run the PowerShell script manually with the same env var to see the full error — $ErrorActionPreference='Stop' may hide detail in non-interactive mode.
2. Check if Orca.exe is locked by another process (running Orca, an installer, or the updater).
3. Verify read permissions on the executable path.
4. Temporarily set $ErrorActionPreference='Continue' in the script to capture the error detail.

Example fix

// before: error detail lost under Stop preference
$ErrorActionPreference = 'Stop'

// after: capture detail in non-interactive mode
$ErrorActionPreference = 'Continue'
try {
  $signature = Get-AuthenticodeSignature -FilePath $env:ORCA_WINDOWS_INNER_EXECUTABLE
} catch {
  Write-Error $_; exit 1
}

function assertFileReadable(executablePath) {
  const result = spawnSync('pwsh', ['-NoProfile', '-Command',
    `Test-Path '${executablePath}' -PathType Leaf`], { encoding: 'utf8' })
  if (result.stdout.trim() !== 'True') {
    throw new Error('Executable is not readable by PowerShell — check locks/permissions')
  }
}

try {
  const stdout = getPowerShellSignatureJson(executablePath)
} catch (err) {
  if (err.message.includes('exit code')) {
    // Re-run with $ErrorActionPreference='Continue' to capture the error detail
    const diag = spawnSync('pwsh', ['-NoProfile', '-Command',
      `try { Get-AuthenticodeSignature '${executablePath}' } catch { $_.Exception.Message }`],
      { encoding: 'utf8' })
    console.error('PowerShell error detail:', diag.stdout)
  }
  throw err
}

When it happens

Trigger: spawnSync('pwsh', [...]) returns result.status !== 0 with no result.error and empty stderr. Caused by: Get-AuthenticodeSignature throwing (e.g. file locked, access denied); the executable path being inaccessible; a terminating error in the script that exits before writing stderr.

Common situations: The Orca.exe file is locked by a running process preventing Get-AuthenticodeSignature from reading it; insufficient permissions on the file; the file being in use by the installer or updater; a PowerShell terminating error that exits with a code but no stderr output.

Related errors

• PowerShell did not return signature JSON.
• PowerShell returned malformed signature JSON
• PowerShell wrote to stderr while checking signature:\n
• \n
• No PATH changes were made.

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/2e8d6378431cc594. Report an issue: GitHub.

Appendix: source

Thrown at config/scripts/verify-windows-inner-signature.mjs:163

    {
      encoding: 'utf8',
      env: {
        ...process.env,
        ORCA_WINDOWS_INNER_EXECUTABLE: executablePath
      }
    }
  )

  if (result.error) {
    throw result.error
  }

  if (result.stderr?.trim()) {
    throw new Error(`PowerShell wrote to stderr while checking signature:\n${result.stderr.trim()}`)
  }

  if (result.status !== 0) {
    throw new Error(
      `PowerShell signature check failed with exit code ${result.status ?? '<unknown>'}.`
    )
  }

  return result.stdout
}

export function verifyWindowsInnerSignature({
  executablePath,
  platform = process.platform,
  spawnSyncImpl = spawnSync,
  expectedSigners = parseExpectedSigners(),
  expectedThumbprints = parseExpectedThumbprints()
}) {
  validateExecutablePath(executablePath)

  if (platform !== 'win32') {
    throw new Error('Windows inner executable signature verification requires Windows.')

View on GitHub (pinned to 1136503c6a)