From d2d3e90c960979dd9380668d6c4d012e62e3684f Mon Sep 17 00:00:00 2001
From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Date: Thu, 2 Jul 2026 12:11:58 -0700
Subject: [PATCH] Fix Windows inner signature PowerShell path (#7136)

Co-authored-by: Neil <neil@stably.ai>
---
 config/scripts/verify-windows-inner-signature.mjs  | 14 ++++++++++----
 .../verify-windows-inner-signature.test.mjs        | 11 +++++++++--
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/config/scripts/verify-windows-inner-signature.mjs b/config/scripts/verify-windows-inner-signature.mjs
index 0f3520c1dee..e0c5e303dbc 100644
--- a/config/scripts/verify-windows-inner-signature.mjs
+++ b/config/scripts/verify-windows-inner-signature.mjs
@@ -7,7 +7,7 @@ export const DEFAULT_EXPECTED_SIGNER =
 
 const POWERSHELL_SIGNATURE_SCRIPT = String.raw`
 $ErrorActionPreference = 'Stop'
-$signature = Get-AuthenticodeSignature -FilePath $args[0]
+$signature = Get-AuthenticodeSignature -FilePath $env:ORCA_WINDOWS_INNER_EXECUTABLE
 $certificate = $signature.SignerCertificate
 [pscustomobject]@{
   status = $signature.Status.ToString()
@@ -130,6 +130,7 @@ export function validateExecutablePath(executablePath) {
 }
 
 export function getPowerShellSignatureJson(executablePath, spawnSyncImpl = spawnSync) {
+  // Why: pwsh -Command does not reliably expose trailing process args to string commands.
   const result = spawnSyncImpl(
     'pwsh',
     [
@@ -139,10 +140,15 @@ export function getPowerShellSignatureJson(executablePath, spawnSyncImpl = spawn
       '-ExecutionPolicy',
       'Bypass',
       '-Command',
-      POWERSHELL_SIGNATURE_SCRIPT,
-      executablePath
+      POWERSHELL_SIGNATURE_SCRIPT
     ],
-    { encoding: 'utf8' }
+    {
+      encoding: 'utf8',
+      env: {
+        ...process.env,
+        ORCA_WINDOWS_INNER_EXECUTABLE: executablePath
+      }
+    }
   )
 
   if (result.error) {
diff --git a/config/scripts/verify-windows-inner-signature.test.mjs b/config/scripts/verify-windows-inner-signature.test.mjs
index aa0e1e7ae12..d833fb64774 100644
--- a/config/scripts/verify-windows-inner-signature.test.mjs
+++ b/config/scripts/verify-windows-inner-signature.test.mjs
@@ -172,8 +172,15 @@ describe('verify-windows-inner-signature', () => {
     )
     expect(calls[0].command).toBe('pwsh')
     expect(calls[0].args).toContain('-Command')
-    expect(calls[0].args.at(-1)).toBe('C:\\Path With Spaces\\Orca.exe')
-    expect(calls[0].options).toEqual({ encoding: 'utf8' })
+    expect(calls[0].args.at(-1)).not.toBe('C:\\Path With Spaces\\Orca.exe')
+    expect(calls[0].options).toEqual(
+      expect.objectContaining({
+        encoding: 'utf8',
+        env: expect.objectContaining({
+          ORCA_WINDOWS_INNER_EXECUTABLE: 'C:\\Path With Spaces\\Orca.exe'
+        })
+      })
+    )
 
     expect(() =>
       getPowerShellSignatureJson('Orca.exe', () => ({ status: 0, stdout: '{}', stderr: 'warning' }))