Prevent unsigned Windows app releases (#6806)

* Verify Windows app executable signing * Isolate Windows signing verifier tests * Handle direct Windows installer extraction --------- Co-authored-by: Neil <neil@stably.ai>
2026-09-22 00:02:31 +00:00 · 2026-07-02 10:54:19 -07:00
parent dbf80864fe
commit 85cec26773
4 changed files with 503 additions and 0 deletions
@@ -1062,6 +1062,51 @@ jobs:
          }
          $signature.SignerCertificate | Format-List Subject,Issuer,NotBefore,NotAfter,Thumbprint

+      - name: Verify signed Windows inner executable
+        if: matrix.platform == 'win'
+        shell: pwsh
+        env:
+          ORCA_WINDOWS_EXPECTED_SIGNERS: CN=SignPath Foundation, O=SignPath Foundation, L=Lewes, S=Delaware, C=US;CN=SignPath Foundation, O=SignPath Foundation, L=Lewes, ST=Delaware, C=US
+        run: |
+          # Why: SignPath must recursively sign nested PE files in the dashboard
+          # artifact configuration; this gate keeps unsigned app payloads out of releases.
+          $installer = Join-Path -Path (Get-Location) -ChildPath 'dist/orca-windows-setup.exe'
+          $setupExtractDir = Join-Path -Path $env:RUNNER_TEMP -ChildPath 'orca-signed-setup'
+          $appExtractDir = Join-Path -Path $env:RUNNER_TEMP -ChildPath 'orca-signed-app'
+
+          Remove-Item -LiteralPath $setupExtractDir, $appExtractDir -Recurse -Force -ErrorAction SilentlyContinue
+          New-Item -ItemType Directory -Path $setupExtractDir, $appExtractDir -Force | Out-Null
+
+          & 7z x -y "-o$setupExtractDir" $installer
+          if ($LASTEXITCODE -ne 0) {
+            throw "Failed to extract signed Windows installer with 7z. Exit code: $LASTEXITCODE"
+          }
+
+          # Why: 7-Zip can expose electron-builder NSIS payloads either as an
+          # app-root tree directly or as a nested app-*.7z archive.
+          $innerExecutables = @(Get-ChildItem -LiteralPath $setupExtractDir -File -Filter 'Orca.exe')
+          if ($innerExecutables.Count -eq 0) {
+            $appArchives = @(Get-ChildItem -LiteralPath $setupExtractDir -Recurse -File -Filter 'app-*.7z')
+            if ($appArchives.Count -ne 1) {
+              $matches = ($appArchives | ForEach-Object { $_.FullName }) -join [Environment]::NewLine
+              throw "Expected app-root Orca.exe or exactly one app-*.7z payload in signed Windows installer; found $($appArchives.Count) app archive(s).$([Environment]::NewLine)$matches"
+            }
+
+            & 7z x -y "-o$appExtractDir" $($appArchives[0].FullName)
+            if ($LASTEXITCODE -ne 0) {
+              throw "Failed to extract signed Windows app payload with 7z. Exit code: $LASTEXITCODE"
+            }
+
+            $innerExecutables = @(Get-ChildItem -LiteralPath $appExtractDir -File -Filter 'Orca.exe')
+          }
+
+          if ($innerExecutables.Count -ne 1) {
+            $matches = ($innerExecutables | ForEach-Object { $_.FullName }) -join [Environment]::NewLine
+            throw "Expected exactly one app-root Orca.exe in signed Windows app payload; found $($innerExecutables.Count).$([Environment]::NewLine)$matches"
+          }
+
+          node config/scripts/verify-windows-inner-signature.mjs $($innerExecutables[0].FullName)
+
      - name: Publish signed Windows release artifacts
        if: matrix.platform == 'win'
        uses: nick-fields/retry@v4