starred/orca
1
0
Fork 0
mirror of https://github.com/stablyai/orca.git synced 2026-10-17 00:03:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Temporarily bypass Windows inner signature gate

Browse Source
This commit is contained in:
Neil
2026-07-02 12:30:09 -07:00
parent 6bca68ae09
commit 9342fc3808
2 changed files with 3 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release-cut.yml
-45
View File
@@ -1067,51 +1067,6 @@ jobs:
}
$signature.SignerCertificate | Format-List Subject,Issuer,NotBefore,NotAfter,Thumbprint
- name: Verify signed Windows inner executable
if: matrix.platform == 'win'
shell: pwsh
env:
ORCA_WINDOWS_EXPECTED_SIGNERS: CN=SignPath Foundation, O=SignPath Foundation, L=Lewes, S=Delaware, C=US;CN=SignPath Foundation, O=SignPath Foundation, L=Lewes, ST=Delaware, C=US
run: |
# Why: SignPath must recursively sign nested PE files in the dashboard
# artifact configuration; this gate keeps unsigned app payloads out of releases.
$installer = Join-Path -Path (Get-Location) -ChildPath 'dist/orca-windows-setup.exe'
$setupExtractDir = Join-Path -Path $env:RUNNER_TEMP -ChildPath 'orca-signed-setup'
$appExtractDir = Join-Path -Path $env:RUNNER_TEMP -ChildPath 'orca-signed-app'
Remove-Item -LiteralPath $setupExtractDir, $appExtractDir -Recurse -Force -ErrorAction SilentlyContinue
New-Item -ItemType Directory -Path $setupExtractDir, $appExtractDir -Force | Out-Null
& 7z x -y "-o$setupExtractDir" $installer
if ($LASTEXITCODE -ne 0) {
throw "Failed to extract signed Windows installer with 7z. Exit code: $LASTEXITCODE"
}
# Why: 7-Zip can expose electron-builder NSIS payloads either as an
# app-root tree directly or as a nested app-*.7z archive.
$innerExecutables = @(Get-ChildItem -LiteralPath $setupExtractDir -File -Filter 'Orca.exe')
if ($innerExecutables.Count -eq 0) {
$appArchives = @(Get-ChildItem -LiteralPath $setupExtractDir -Recurse -File -Filter 'app-*.7z')
if ($appArchives.Count -ne 1) {
$matches = ($appArchives | ForEach-Object { $_.FullName }) -join [Environment]::NewLine
throw "Expected app-root Orca.exe or exactly one app-*.7z payload in signed Windows installer; found $($appArchives.Count) app archive(s).$([Environment]::NewLine)$matches"
}
& 7z x -y "-o$appExtractDir" $($appArchives[0].FullName)
if ($LASTEXITCODE -ne 0) {
throw "Failed to extract signed Windows app payload with 7z. Exit code: $LASTEXITCODE"
}
$innerExecutables = @(Get-ChildItem -LiteralPath $appExtractDir -File -Filter 'Orca.exe')
}
if ($innerExecutables.Count -ne 1) {
$matches = ($innerExecutables | ForEach-Object { $_.FullName }) -join [Environment]::NewLine
throw "Expected exactly one app-root Orca.exe in signed Windows app payload; found $($innerExecutables.Count).$([Environment]::NewLine)$matches"
}
node config/scripts/verify-windows-inner-signature.mjs $($innerExecutables[0].FullName)
- name: Publish signed Windows release artifacts
if: matrix.platform == 'win'
uses: nick-fields/retry@v4
config/scripts/package-electron-runtime-contract.test.mjs
+3 -33
View File
@@ -221,7 +221,7 @@ describe('Electron runtime package contract', () => {
expect(installRun).not.toMatch(/throw\s+\$_/)
})
it('verifies the SignPath-signed Windows inner executable before publishing', () => {
it('temporarily allows publishing Windows after verifying the signed installer only', () => {
const releaseWorkflow = readFileSync(
join(projectDir, '.github/workflows/release-cut.yml'),
'utf8'
@@ -234,38 +234,8 @@ describe('Electron runtime package contract', () => {
const publishIndex = stepNames.indexOf('Publish signed Windows release artifacts')
expect(outerVerifyIndex).toBeGreaterThan(-1)
expect(innerVerifyIndex).toBe(outerVerifyIndex + 1)
expect(innerVerifyIndex).toBeLessThan(publishIndex)
const innerVerifyStep = steps[innerVerifyIndex]
const innerVerifyRun = innerVerifyStep.run
expect(innerVerifyStep.if).toBe("matrix.platform == 'win'")
expect(innerVerifyStep.shell).toBe('pwsh')
expect(innerVerifyStep.env.ORCA_WINDOWS_EXPECTED_SIGNERS).toBe(
'CN=SignPath Foundation, O=SignPath Foundation, L=Lewes, S=Delaware, C=US;CN=SignPath Foundation, O=SignPath Foundation, L=Lewes, ST=Delaware, C=US'
)
expect(innerVerifyRun).toContain('& 7z x -y "-o$setupExtractDir" $installer')
expect(innerVerifyRun).toContain(
"$innerExecutables = @(Get-ChildItem -LiteralPath $setupExtractDir -File -Filter 'Orca.exe')"
)
expect(innerVerifyRun).toContain('if ($innerExecutables.Count -eq 0)')
expect(innerVerifyRun).toContain(
"$appArchives = @(Get-ChildItem -LiteralPath $setupExtractDir -Recurse -File -Filter 'app-*.7z')"
)
expect(innerVerifyRun).toContain('if ($appArchives.Count -ne 1)')
expect(innerVerifyRun).toContain('Expected app-root Orca.exe or exactly one app-*.7z')
expect(innerVerifyRun).toContain('& 7z x -y "-o$appExtractDir" $($appArchives[0].FullName)')
expect(innerVerifyRun).toContain(
"$innerExecutables = @(Get-ChildItem -LiteralPath $appExtractDir -File -Filter 'Orca.exe')"
)
expect(innerVerifyRun.indexOf("-Filter 'Orca.exe'")).toBeLessThan(
innerVerifyRun.indexOf("-Filter 'app-*.7z'")
)
expect(innerVerifyRun).toContain('if ($innerExecutables.Count -ne 1)')
expect(innerVerifyRun).toContain(
'node config/scripts/verify-windows-inner-signature.mjs $($innerExecutables[0].FullName)'
)
expect(innerVerifyIndex).toBe(-1)
expect(publishIndex).toBe(outerVerifyIndex + 1)
})
it('publishes both Linux release matrix entries', () => {