mirror of
https://github.com/stablyai/orca.git
synced 2026-10-16 16:03:26 +00:00
brennanb2025
2455ebdfd8
CI hardening prerequisite for issue #6487 (Windows Smart App Control). The release pipeline only signed+verified the outer NSIS installer; nothing asserted the inner extracted Orca.exe carried a valid Authenticode signature. SAC evaluates that inner executable, so an unsigned Orca.exe could still ship inside a signed installer. Adds a cross-platform parsing module + unit tests and a release-cut.yml gate that extracts the inner Orca.exe from the signed installer and fails the release if it is not validly signed by the expected identity. The actual recursive PE signing must be enabled server-side in SignPath's artifact configuration; documented in the new gate and the script header.