@rightkit/release 0.2.55 → 0.2.56

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.55",
+  "version": "0.2.56",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release-cli-contract.test.mjs

@@ -4,6 +4,7 @@ import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import vm from "node:vm";
 import test from "node:test";
 
 const root = path.dirname(fileURLToPath(import.meta.url));
@@ -70,6 +71,36 @@ test("Windows upload trust verification uses signtool instead of PowerShell modu
   assert.match(signingSource, /\["verify", "\/pa", "\/v", file\]/);
 });
 
+test("Windows signer verification accepts CRLF subjects and retains identity checks", () => {
+  const source = readFileSync(signWindows, "utf8");
+  const functionSource = source.slice(source.indexOf("function assertVerification"), source.indexOf("\nfunction fileEvidence"));
+  const assertVerification = vm.runInNewContext(`(${functionSource})`, {
+    fail(message) { throw new Error(message); },
+  });
+  const valid = "Successfully verified\r\n\tIssued to: Damned Ventures LLC  \r\nTimestamp: present\r\n";
+  assert.equal(JSON.stringify(assertVerification("fixture.exe", valid)), JSON.stringify({
+    authenticode: "Valid",
+    subject: "CN=Damned Ventures LLC",
+    timestampPresent: true,
+  }));
+  assert.throws(
+    () => assertVerification("fixture.exe", valid.replace("Damned Ventures LLC", "Other Company")),
+    /subject must be Damned Ventures LLC/,
+  );
+  assert.throws(
+    () => assertVerification("fixture.exe", valid.replace("Damned Ventures LLC", "damned ventures llc")),
+    /subject must be Damned Ventures LLC/,
+  );
+  assert.throws(
+    () => assertVerification("fixture.exe", valid.replace("Timestamp: present", "")),
+    /timestamp is missing/,
+  );
+  assert.throws(
+    () => assertVerification("fixture.exe", valid.replace("Successfully verified", "Verification failed")),
+    /did not report Valid/,
+  );
+});
+
 test("upload uses only the pinned pnpm runner", () => {
   const source = readFileSync(upload, "utf8");
   assert.match(source, /spawnSync\("pnpm", \["dlx", "wrangler@4"/);

package/right-suite-contract.test.mjs

@@ -464,11 +464,11 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.1",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.55",
+    "@rightkit/release": "0.2.56",
   });
   assert.deepEqual(versions.legacyNpm, {
     "@rightkit/legal-ui": ["0.1.0"],
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55"],
   });
   assert.ok(
     new Set([versions.npm["@rightkit/release"], ...versions.legacyNpm["@rightkit/release"]]).has("0.2.42"),

package/rightkit-versions.json

@@ -18,11 +18,11 @@
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.1",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.55"
+    "@rightkit/release": "0.2.56"
   },
   "legacyNpm": {
     "@rightkit/legal-ui": ["0.1.0"],
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54"]
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55"]
   },
   "cargo": {
     "rightkit-license": "0.1.2",

package/sign-windows.mjs

@@ -151,7 +151,7 @@ function run(cmd, runArgs) {
 
 function assertVerification(file, output) {
   if (!/successfully verified/i.test(output)) fail(`Authenticode verification did not report Valid for ${file}`);
-  if (!/^Issued to:\s*Damned Ventures LLC\s*$/im.test(output)) fail(`Authenticode subject must be Damned Ventures LLC for ${file}`);
+  if (!/^[ \t]*Issued to:[ \t]*Damned Ventures LLC[ \t]*$/m.test(output)) fail(`Authenticode subject must be Damned Ventures LLC for ${file}`);
   if (!/(?:timestamp|time stamped|timestamped)/i.test(output)) fail(`Authenticode timestamp is missing for ${file}`);
   return { authenticode: "Valid", subject: "CN=Damned Ventures LLC", timestampPresent: true };
 }