stablyai/orca · error

PowerShell wrote to stderr while checking signature:\n${resu

Error message

PowerShell wrote to stderr while checking signature:\n${result.stderr.trim()}

What it means

Thrown by getPowerShellSignatureJson() when the PowerShell child process exits cleanly (status 0, no spawn error) but wrote content to stderr. The script treats any stderr output as a failure signal, since Get-AuthenticodeSignature with $ErrorActionPreference='Stop' should produce no stderr on success.

Source

Thrown at config/scripts/verify-windows-inner-signature.mjs:159

      'Bypass',
      '-Command',
      POWERSHELL_SIGNATURE_SCRIPT
    ],
    {
      encoding: 'utf8',
      env: {
        ...process.env,
        ORCA_WINDOWS_INNER_EXECUTABLE: executablePath
      }
    }
  )

  if (result.error) {
    throw result.error
  }

  if (result.stderr?.trim()) {
    throw new Error(`PowerShell wrote to stderr while checking signature:\n${result.stderr.trim()}`)
  }

  if (result.status !== 0) {
    throw new Error(
      `PowerShell signature check failed with exit code ${result.status ?? '<unknown>'}.`
    )
  }

  return result.stdout
}

export function verifyWindowsInnerSignature({
  executablePath,
  platform = process.platform,
  spawnSyncImpl = spawnSync,
  expectedSigners = parseExpectedSigners(),
  expectedThumbprints = parseExpectedThumbprints()
}) {

View on GitHub (pinned to 1136503c6a)

Solutions

1. Read the stderr content in the error message to identify the specific warning or error PowerShell emitted.
2. If the stderr content is a benign warning (e.g. certificate chain noise), consider whether the script should tolerate specific warning patterns.
3. Set $WarningPreference='SilentlyContinue' and $VerbosePreference='SilentlyContinue' in the PowerShell script to suppress non-error stream output.
4. If an EDR/antivirus is interfering, add an exclusion for the verifier process or the Orca.exe path.

Example fix

// before: warnings leak to stderr and fail the check
$ErrorActionPreference = 'Stop'
$signature = Get-AuthenticodeSignature -FilePath $env:ORCA_WINDOWS_INNER_EXECUTABLE

// after: suppress non-error streams
$ErrorActionPreference = 'Stop'
$WarningPreference = 'SilentlyContinue'
$VerbosePreference = 'SilentlyContinue'
$signature = Get-AuthenticodeSignature -FilePath $env:ORCA_WINDOWS_INNER_EXECUTABLE

function preflightStderrClean(executablePath) {
  const result = spawnSync('pwsh', ['-NoProfile', '-Command',
    '$WarningPreference="SilentlyContinue"; Write-Output ok'], { encoding: 'utf8' })
  if (result.stderr?.trim()) {
    console.warn('PowerShell environment produces stderr warnings; verifier may fail.')
  }
}

function hasCleanStderr(result) {
  return !result.stderr || result.stderr.trim() === ''
}

try {
  const stdout = getPowerShellSignatureJson(executablePath)
} catch (err) {
  if (err.message.includes('wrote to stderr')) {
    // Retry with suppressed warning stream, or inspect stderr for benign warnings
    console.error('PowerShell stderr:', err.message)
  }
  throw err
}

When it happens

Trigger: spawnSync('pwsh', [...]) returns with result.stderr containing non-whitespace text. Caused by: PowerShell writing warnings or verbose messages to stderr; a certificate chain validation warning; a PowerShell module loading error; antivirus or EDR intercepting the signature check.

Common situations: Windows Defender or EDR flagging the signature query; PowerShell $VerbosePreference or $WarningPreference leaking to stderr; a certificate trust warning (e.g. untrusted root) written as a warning; a PowerShell version difference in error stream behavior.

Related errors

• PowerShell did not return signature JSON.
• PowerShell returned malformed signature JSON: ${error.messag
• PowerShell signature check failed with exit code ${result.st
• ${classification.message}\n${formatSignatureSummary(signatur
• ${result.stderr || 'PowerShell process enumeration failed'}

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/6d1f0db3fdbc9f4b. Report an issue: GitHub.