stablyai/orca · error

Windows inner executable signature verification requires Win

Error message

Windows inner executable signature verification requires Windows.

What it means

Thrown by verifyWindowsInnerSignature() when the platform argument (defaulting to process.platform) is not 'win32'. Get-AuthenticodeSignature is a Windows-only cmdlet, so the entire verification is gated on running on Windows. This prevents cryptic PowerShell errors on macOS/Linux CI runners.

Source

Thrown at config/scripts/verify-windows-inner-signature.mjs:181

    throw new Error(
      `PowerShell signature check failed with exit code ${result.status ?? '<unknown>'}.`
    )
  }

  return result.stdout
}

export function verifyWindowsInnerSignature({
  executablePath,
  platform = process.platform,
  spawnSyncImpl = spawnSync,
  expectedSigners = parseExpectedSigners(),
  expectedThumbprints = parseExpectedThumbprints()
}) {
  validateExecutablePath(executablePath)

  if (platform !== 'win32') {
    throw new Error('Windows inner executable signature verification requires Windows.')
  }

  const signature = parseSignatureJson(getPowerShellSignatureJson(executablePath, spawnSyncImpl))
  const classification = classifySignature(signature, { expectedSigners, expectedThumbprints })
  if (!classification.ok) {
    throw new Error(`${classification.message}\n${formatSignatureSummary(signature)}`)
  }

  return signature
}

export function main(argv = process.argv.slice(2)) {
  try {
    const signature = verifyWindowsInnerSignature({ executablePath: argv[0] })
    console.log('Verified Windows inner executable signature.')
    console.log(formatSignatureSummary(signature))
  } catch (error) {
    console.error(error.message)

View on GitHub (pinned to 1136503c6a)

Solutions

1. Run this verifier only on a Windows runner (windows-latest in GitHub Actions, etc.).
2. Gate the invocation in CI with a platform check before calling the script.
3. In tests, pass platform: 'win32' and a mock spawnSyncImpl to avoid the guard.

Example fix

// before: runs on all platforms
- run: node config/scripts/verify-windows-inner-signature.mjs dist/Orca.exe

// after: Windows-only job
runs-on: windows-latest
- run: node config/scripts/verify-windows-inner-signature.mjs dist/Orca.exe

function assertWindowsPlatform(platform = process.platform) {
  if (platform !== 'win32') {
    throw new Error(
      `Signature verification requires Windows. Current platform: ${platform}`
    )
  }
}

function isWindowsPlatform(platform) {
  return platform === 'win32'
}

When it happens

Trigger: verifyWindowsInnerSignature({ platform }) is called with platform !== 'win32', or the default process.platform is 'darwin'/'linux'. Caused by: running the verifier on a non-Windows CI runner; calling the function in a cross-platform test without mocking platform.

Common situations: A CI pipeline that runs all verification scripts on a Linux/macOS runner without gating the Windows-only ones; a test that calls verifyWindowsInnerSignature without setting platform: 'win32' in the options; a developer running the script locally on macOS.

Related errors

• PowerShell did not return signature JSON.
• PowerShell returned malformed signature JSON: ${error.messag
• Usage: node config/scripts/verify-windows-inner-signature.mj
• Windows inner executable does not exist: ${executablePath}
• Windows inner executable path is not a file: ${executablePat

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/6f9387799d07bb7b. Report an issue: GitHub.