mirror of
https://github.com/stablyai/orca.git
synced 2026-10-17 08:03:14 +00:00
Jinwoo Hong
068c71bb27
SignPath cannot deep-sign inside NSIS installers, so unsigned inner PE files (Orca.exe, node-pty *.node, DLLs) ship with zero AV reputation and get quarantined by enterprise antivirus (issue #7785). Add a two-request flow to the Windows release leg: stage unsigned PE files from win-unpacked, sign them via the windows-inner-binaries-zip SignPath configuration, rebuild the NSIS installer from the signed tree, then continue into the existing installer signing request. Every step is fail-open (continue-on-error + outcome gating): any failure ships the original installer exactly like releases did before this chain existed. Add an evidence gate that extracts the shipped installer and verifies every staged binary is Valid + CN=SignPath Foundation, warn-only until ORCA_WINDOWS_INNER_SIGNATURE_REQUIRED is flipped to 'true'. Supersedes the Orca.exe-only gate from #7170 by covering .node and .dll files too. Rehearsed end to end with test-signing (run 28987534795) and release-signing (run 28988432001); disarm the rehearsal workflow's branch push trigger now that both rehearsals passed.