@rightkit/release 0.2.56 → 0.2.57

package/build-release.mjs

@@ -29,6 +29,17 @@ import { buildPathPrefix, collectPreflight, formatPreflight, preflightFailures }
 import { assertCleanSource } from "./source-gate.mjs";
 import { acquireHeavyWorkSlot, heavyCommandEnvironment, terminateProcessTree } from "./heavy-command.mjs";
 
+// Fingerprint of the pipeline code that can change the bytes we ship or the way
+// they are signed — deliberately NOT the package version, which moves for docs
+// and test-only edits and would force a cold Rust rebuild of every app each time.
+// These four files are the ones whose behaviour the cached target directory can
+// outlive.
+const PIPELINE_FINGERPRINT_SOURCES = ["release.mjs", "sign-windows.mjs", "tauri-bundle-marker.mjs", "nsis-payload.mjs"];
+const PIPELINE_FINGERPRINT = createHash("sha256")
+  .update(PIPELINE_FINGERPRINT_SOURCES.map((file) => `${file}:${createHash("sha256").update(readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), file))).digest("hex")}`).join("\n"))
+  .digest("hex")
+  .slice(0, 16);
+
 /** Assemble preflight inputs from the app's own files (mirrors release.mjs). */
 function buildPreflight({ config, configPath, appRoot, repoRoot, platform }) {
   let version;
@@ -124,8 +135,13 @@ try {
   const receiptRoot = path.resolve(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(appRoot, ".right-release", "receipts"));
   const signingIdentity = platform === "win" ? {
     contract: target.signingContract ?? "<missing>",
+    // Pipeline code participates in cache identity. Without it, a fix to the
+    // signing or packaging logic leaves the previous logic's target directory
+    // eligible for reuse — which is how outputs from a known-bad pipeline
+    // outlived the change that was supposed to retire them.
+    pipeline: PIPELINE_FINGERPRINT,
     configSha256: hashFile(configPath),
-    receiptInputs: ["raw-exe", "installer"].map((phase) => path.join(receiptRoot, `windows-${phase}.json`)),
+    receiptInputs: ["raw-exe", "installer", "embedding"].map((phase) => path.join(receiptRoot, `windows-${phase}.json`)),
   } : null;
   if (signingIdentity) inputHashes[".right-release/signing-identity.json"] = hashFileText(JSON.stringify(signingIdentity));
   const cargoLock = requiredInputs.find((file) => /Cargo\.lock$/i.test(file));

package/nsis-payload.mjs

@@ -0,0 +1,155 @@
+// Prove the installer actually ships the bytes we signed.
+//
+// Signing the raw EXE and signing the installer are two separate signatures.
+// Between them Tauri copies the EXE into the NSIS payload, and a single byte
+// changed anywhere in that hand-off invalidates the inner Authenticode signature
+// while leaving the outer installer signature perfectly valid. Every check that
+// stops at "the installer is signed" therefore passes on a broken build — which
+// is how invalid binaries shipped.
+//
+// So we open the finished installer, pull the embedded executable back out, and
+// require it to be byte-identical to the EXE we signed. No inference, no proxy.
+// 7-Zip reads the NSIS container format; if it is absent we fail closed rather
+// than record an unverified pass.
+
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+const SEVEN_ZIP_CANDIDATES = [
+  "C:\\Program Files\\7-Zip\\7z.exe",
+  "C:\\Program Files (x86)\\7-Zip\\7z.exe",
+  "/opt/homebrew/bin/7z",
+  "/usr/local/bin/7z",
+  "/usr/bin/7z",
+];
+
+export function resolveSevenZip({ env = process.env, exists = existsSync, which = commandPath } = {}) {
+  const explicit = env.RIGHT_RELEASE_SEVENZIP;
+  if (explicit) {
+    if (!exists(explicit)) throw new Error(`RIGHT_RELEASE_SEVENZIP does not exist: ${explicit}`);
+    return explicit;
+  }
+  for (const candidate of SEVEN_ZIP_CANDIDATES) {
+    if (exists(candidate)) return candidate;
+  }
+  for (const name of ["7z", "7za", "7zz"]) {
+    const found = which(name);
+    if (found) return found;
+  }
+  throw new Error(
+    "7-Zip is required to verify the NSIS installer payload but was not found; install 7-Zip (https://www.7-zip.org) or set RIGHT_RELEASE_SEVENZIP to its 7z executable",
+  );
+}
+
+/**
+ * Names of the files NSIS will install, parsed from 7-Zip's technical listing
+ * (`-slt`). The column-aligned default listing leaves the date blank for entries
+ * NSIS synthesises, which makes positional parsing quietly wrong; the key/value
+ * form has no such ambiguity. Directory entries are dropped.
+ *
+ * The first record describes the archive itself and is separated from the member
+ * records by a `----------` rule, so parsing starts after that rule.
+ */
+export function parseSevenZipListing(stdout) {
+  const lines = String(stdout).replace(/\r\n?/g, "\n").split("\n");
+  const start = lines.findIndex((line) => line.trim() === "----------");
+  if (start === -1) return [];
+  const entries = [];
+  let current = null;
+  for (const line of lines.slice(start + 1)) {
+    const match = line.match(/^([A-Za-z][A-Za-z0-9 ]*?)\s=\s?(.*)$/);
+    if (!match) continue;
+    const [, key, value] = match;
+    if (key === "Path") {
+      if (current) entries.push(current);
+      current = { name: value.replace(/\\/g, "/"), sizeBytes: null, folder: false };
+    } else if (!current) continue;
+    else if (key === "Size") current.sizeBytes = value.trim() === "" ? null : Number(value.trim());
+    else if (key === "Folder") current.folder = value.trim() === "+";
+    else if (key === "Attributes") current.folder = current.folder || value.includes("D");
+  }
+  if (current) entries.push(current);
+  return entries.filter((entry) => !entry.folder).map(({ name, sizeBytes }) => ({ name, sizeBytes }));
+}
+
+export function listNsisPayload(installer, { sevenZip = resolveSevenZip(), run = runSevenZip } = {}) {
+  const result = run(sevenZip, ["l", "-tnsis", "-slt", "--", path.resolve(installer)]);
+  if (result.status !== 0) {
+    throw new Error(`could not read the NSIS payload of ${installer}: ${(result.stderr || result.stdout || "").trim()}`);
+  }
+  return parseSevenZipListing(result.stdout);
+}
+
+/**
+ * Extract one payload entry to a temporary directory and return its bytes.
+ * The caller owns nothing: the temporary directory is always removed.
+ */
+export function extractNsisEntry(installer, entryName, { sevenZip = resolveSevenZip(), run = runSevenZip, tempRoot = os.tmpdir() } = {}) {
+  const resolvedInstaller = path.resolve(installer);
+  const base = path.posix.basename(String(entryName).replace(/\\/g, "/"));
+  if (!base || base === "." || base === "..") throw new Error(`invalid NSIS payload entry name: ${entryName}`);
+  const destination = path.join(tempRoot, `right-nsis-${process.pid}-${Math.random().toString(16).slice(2)}`);
+  mkdirSync(destination, { recursive: true });
+  try {
+    // `e` flattens the entry to the destination root, so the extracted path is
+    // known regardless of how deep the entry sits inside the payload.
+    const result = run(sevenZip, ["e", "-tnsis", "-y", `-o${destination}`, "--", resolvedInstaller, base]);
+    const extracted = path.join(destination, base);
+    if (result.status !== 0 || !existsSync(extracted)) {
+      throw new Error(
+        `could not extract ${base} from ${resolvedInstaller}: ${(result.stderr || result.stdout || "no such entry").trim()}`,
+      );
+    }
+    return { name: base, bytes: readFileSync(extracted) };
+  } finally {
+    rmSync(destination, { recursive: true, force: true });
+  }
+}
+
+/**
+ * The load-bearing check: the executable inside the installer must be the exact
+ * executable we signed. Returns a receipt; throws with the byte-level reason if
+ * the bytes drifted.
+ */
+export function verifyNsisEmbeddedBinary({
+  installer,
+  entryName,
+  expectedSha256,
+  sevenZip = resolveSevenZip(),
+  run = runSevenZip,
+  tempRoot = os.tmpdir(),
+}) {
+  if (!/^[0-9a-f]{64}$/i.test(String(expectedSha256 ?? ""))) {
+    throw new Error(`expected a sha256 digest for the signed ${entryName}, received ${JSON.stringify(expectedSha256)}`);
+  }
+  const { name, bytes } = extractNsisEntry(installer, entryName, { sevenZip, run, tempRoot });
+  const embeddedSha256 = createHash("sha256").update(bytes).digest("hex");
+  if (embeddedSha256.toLowerCase() !== String(expectedSha256).toLowerCase()) {
+    throw new Error(
+      `the installer does not embed the signed ${name}: signed sha256 ${expectedSha256}, embedded sha256 ${embeddedSha256}. `
+      + "Something rewrote the executable after it was signed, so its Authenticode signature is invalid inside the installer.",
+    );
+  }
+  return {
+    installer: path.resolve(installer),
+    entry: name,
+    sha256: embeddedSha256,
+    sizeBytes: bytes.length,
+    installerSha256: createHash("sha256").update(readFileSync(path.resolve(installer))).digest("hex"),
+  };
+}
+
+function runSevenZip(command, args) {
+  return spawnSync(command, args, { encoding: "utf8", windowsHide: true, maxBuffer: 32 * 1024 * 1024 });
+}
+
+function commandPath(name) {
+  const probe = process.platform === "win32" ? "where" : "which";
+  const result = spawnSync(probe, [name], { encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) return null;
+  const first = String(result.stdout).split(/\r?\n/).map((line) => line.trim()).find(Boolean);
+  return first && existsSync(first) ? first : null;
+}

package/nsis-payload.test.mjs

@@ -0,0 +1,139 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test, { after } from "node:test";
+import { listNsisPayload, parseSevenZipListing, resolveSevenZip, verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
+
+const workspace = mkdtempSync(path.join(tmpdir(), "rightkit-nsis-"));
+after(() => rmSync(workspace, { recursive: true, force: true }));
+
+// 7-Zip's technical listing: an archive record, a rule, then one record per member.
+// The blank `Attributes` and absent timestamps are what the column-aligned listing
+// gets wrong, so they are reproduced here deliberately.
+const LISTING = [
+  "Path = D:\\out\\App_1.2.3_x64-setup.exe",
+  "Type = Nsis",
+  "",
+  "----------",
+  "Path = $PLUGINSDIR\\System.dll",
+  "Size = 12288",
+  "Attributes = ",
+  "",
+  "Path = app with spaces.exe",
+  "Size = 13750736",
+  "Attributes = ",
+  "",
+  "Path = legal",
+  "Size = 0",
+  "Folder = +",
+  "Attributes = D",
+  "",
+  "Path = legal\\EULA.md",
+  "Size = 16723",
+  "Attributes = A",
+  "",
+].join("\n");
+
+test("parses 7-Zip technical listings, including blank dates and spaced names", () => {
+  const entries = parseSevenZipListing(LISTING);
+  assert.deepEqual(entries.map((entry) => entry.name), [
+    "$PLUGINSDIR/System.dll",
+    "app with spaces.exe",
+    "legal/EULA.md",
+  ]);
+  assert.equal(entries[1].sizeBytes, 13_750_736);
+});
+
+test("ignores the archive's own record above the rule", () => {
+  const entries = parseSevenZipListing(LISTING);
+  assert.equal(entries.some((entry) => entry.name.endsWith("setup.exe")), false);
+});
+
+test("listNsisPayload surfaces the 7-Zip failure instead of reporting an empty payload", () => {
+  assert.throws(
+    () => listNsisPayload("installer.exe", {
+      sevenZip: "7z",
+      run: () => ({ status: 2, stdout: "", stderr: "Cannot open the file as archive" }),
+    }),
+    /could not read the NSIS payload.*Cannot open the file as archive/s,
+  );
+});
+
+test("verifyNsisEmbeddedBinary accepts a payload whose bytes match the signed EXE", () => {
+  const installer = path.join(workspace, "setup.exe");
+  writeFileSync(installer, "installer-container");
+  const payload = Buffer.from("signed-executable-bytes");
+  const sha256 = createHash("sha256").update(payload).digest("hex");
+
+  const receipt = verifyNsisEmbeddedBinary({
+    installer,
+    entryName: "app.exe",
+    expectedSha256: sha256,
+    sevenZip: "7z",
+    run: (_command, args) => {
+      const destination = args.find((arg) => arg.startsWith("-o")).slice(2);
+      writeFileSync(path.join(destination, "app.exe"), payload);
+      return { status: 0, stdout: "Everything is Ok", stderr: "" };
+    },
+  });
+
+  assert.equal(receipt.sha256, sha256);
+  assert.equal(receipt.entry, "app.exe");
+  assert.equal(receipt.sizeBytes, payload.length);
+  assert.equal(receipt.installerSha256, createHash("sha256").update(readFileSync(installer)).digest("hex"));
+});
+
+test("verifyNsisEmbeddedBinary rejects a payload that drifted from the signed EXE", () => {
+  const installer = path.join(workspace, "setup-drifted.exe");
+  writeFileSync(installer, "installer-container");
+  assert.throws(
+    () => verifyNsisEmbeddedBinary({
+      installer,
+      entryName: "app.exe",
+      expectedSha256: createHash("sha256").update("signed-executable-bytes").digest("hex"),
+      sevenZip: "7z",
+      run: (_command, args) => {
+        const destination = args.find((arg) => arg.startsWith("-o")).slice(2);
+        writeFileSync(path.join(destination, "app.exe"), "rewritten-after-signing");
+        return { status: 0, stdout: "Everything is Ok", stderr: "" };
+      },
+    }),
+    /does not embed the signed app\.exe.*Authenticode signature is invalid/s,
+  );
+});
+
+test("verifyNsisEmbeddedBinary fails when the entry is absent rather than passing vacuously", () => {
+  const installer = path.join(workspace, "setup-missing.exe");
+  writeFileSync(installer, "installer-container");
+  assert.throws(
+    () => verifyNsisEmbeddedBinary({
+      installer,
+      entryName: "app.exe",
+      expectedSha256: "a".repeat(64),
+      sevenZip: "7z",
+      run: () => ({ status: 2, stdout: "", stderr: "No files to process" }),
+    }),
+    /could not extract app\.exe/,
+  );
+});
+
+test("verifyNsisEmbeddedBinary refuses a caller that has no digest to compare against", () => {
+  assert.throws(
+    () => verifyNsisEmbeddedBinary({ installer: "setup.exe", entryName: "app.exe", expectedSha256: undefined, sevenZip: "7z", run: () => ({ status: 0 }) }),
+    /expected a sha256 digest/,
+  );
+});
+
+test("resolveSevenZip names the fix when 7-Zip is absent", () => {
+  assert.throws(
+    () => resolveSevenZip({ env: {}, exists: () => false, which: () => null }),
+    /install 7-Zip.*RIGHT_RELEASE_SEVENZIP/s,
+  );
+});
+
+test("resolveSevenZip honours an explicit override and rejects a bad one", () => {
+  assert.equal(resolveSevenZip({ env: { RIGHT_RELEASE_SEVENZIP: "C:\\tools\\7z.exe" }, exists: () => true }), "C:\\tools\\7z.exe");
+  assert.throws(() => resolveSevenZip({ env: { RIGHT_RELEASE_SEVENZIP: "C:\\gone\\7z.exe" }, exists: () => false }), /does not exist/);
+});

package/package.json

@@ -1,31 +1,32 @@
-{
-  "name": "@rightkit/release",
-  "version": "0.2.56",
-  "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
-  "type": "module",
-  "bin": {
-    "right-release": "cli/right-release.mjs"
-  },
-  "files": [
-    "cli",
-    "*.mjs",
-    "*.json",
-    "*.sh",
-    "*.py"
-  ],
-  "sideEffects": false,
-  "publishConfig": {
-    "registry": "https://registry.npmjs.org/",
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/adrdsouza/claude.git",
-    "directory": "tools/rightkit/packages/release"
-  },
-  "scripts": {
-    "test": "node --test *.test.mjs",
-    "doctor:all": "node --test right-suite-contract.test.mjs",
-    "verify:standalone": "node standalone-clone-verify.mjs"
-  }
-}
+{
+  "name": "@rightkit/release",
+  "version": "0.2.57",
+  "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
+  "type": "module",
+  "bin": {
+    "right-release": "cli/right-release.mjs"
+  },
+  "files": [
+    "cli",
+    "*.mjs",
+    "*.json",
+    "*.sh",
+    "*.py"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "test": "node --test *.test.mjs",
+    "doctor:all": "node --test right-suite-contract.test.mjs",
+    "verify:standalone": "node standalone-clone-verify.mjs"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/adrdsouza/claude.git",
+    "directory": "tools/rightkit/packages/release"
+  },
+  "packageManager": "pnpm@11.18.0"
+}

package/release.mjs

@@ -10,6 +10,8 @@ import { assertQaBackdoorContract } from "./qa-contract.mjs";
 import { assertLegalReleaseContract } from "./legal-contract.mjs";
 import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
 import { collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
+import { patchTauriBundleType } from "./tauri-bundle-marker.mjs";
+import { verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
@@ -193,10 +195,19 @@ if (!opts.skipChecks) {
   for (const script of config.checks ?? []) await runPackageScript(config.packageManager, script, workdir);
 }
 
+let bundleMarkerReceipts = [];
 if (opts.platform === "win") {
   const rawFiles = target.sign.prePackageFiles.map((p) => path.resolve(root, p));
   await runCommand(target.prePackage, root);
   for (const file of rawFiles) await mustExist(file, `missing raw EXE signing artifact: ${file}`);
+  // The marker must reach its FINAL value before signing. Tauri rewrites it during
+  // bundling, and doing that to signed bytes invalidates Authenticode — the exact
+  // defect that shipped invalid binaries. Idempotent, so an app that still patches
+  // in its own prePackage script simply reports alreadyPatched here.
+  bundleMarkerReceipts = opts.dryRun ? [] : rawFiles.map((file) => patchTauriBundleType(file, { bundle: target.bundleMarker ?? "nsis" }));
+  for (const receipt of bundleMarkerReceipts) {
+    console.log(`right-release: bundle marker ${receipt.bundle} ${receipt.alreadyPatched ? "already applied" : "applied"} at offset ${receipt.offset} in ${path.basename(receipt.file)}`);
+  }
   await signWindows(rawFiles, "raw-exe", root);
 }
 
@@ -209,6 +220,10 @@ for (const rel of target.artifacts ?? []) {
 if (opts.platform === "win" && target.sign?.files?.length) {
   const files = target.sign.files.map((p) => path.resolve(root, p));
   for (const file of files) await mustExist(file, `missing signing artifact: ${file}`);
+  // Before the installer earns its own signature, prove it carries the bytes we
+  // signed. An installer-only signature on a mutated payload verifies perfectly
+  // and still installs a binary Windows rejects.
+  await verifyWindowsEmbedding({ root, target, files, markers: bundleMarkerReceipts });
   await signWindows(files, "installer", root);
   if (target.postSign) await runCommand(target.postSign, root);
   const updaterFiles = [...new Set((target.updater?.artifacts ?? []).map((artifact) => path.resolve(root, artifact.file)))];
@@ -406,6 +421,69 @@ async function signWindows(files, phase, root) {
   if (!opts.dryRun) verifyWindowsReceipt(receipt, files, phase);
 }
 
+function windowsReceiptPath(root, phase) {
+  return path.join(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts"), `windows-${phase}.json`);
+}
+
+/**
+ * Close the gap between "the raw EXE was signed" and "the installer ships that
+ * EXE". Three independent facts, each able to fail on its own:
+ *   1. the signed EXE on disk is byte-identical to what the signing receipt says
+ *      (catches an in-place rewrite during bundling),
+ *   2. it still verifies as Authenticode-valid (catches a mutation that somehow
+ *      preserved the hash we recorded), and
+ *   3. the executable extracted back out of the installer matches it byte for
+ *      byte (catches a bundler that patched its own copy and left ours alone).
+ * Only the third is proof the shipped artifact is correct; the first two name
+ * the cause when it is not.
+ */
+async function verifyWindowsEmbedding({ root, target, files, markers }) {
+  if (opts.dryRun) {
+    console.log("dry-run: verify installer embeds the signed raw EXE");
+    return;
+  }
+  const rawFile = path.resolve(root, target.sign.prePackageFiles[0]);
+  const rawReceiptPath = windowsReceiptPath(root, "raw-exe");
+  let rawReceipt;
+  try { rawReceipt = JSON.parse(readFileSync(rawReceiptPath, "utf8")); } catch { fail(`missing raw EXE signing receipt: ${rawReceiptPath}`); }
+  const signed = rawReceipt.files?.find((item) => path.resolve(item.file) === rawFile);
+  const signedSha256 = signed?.after?.sha256;
+  if (!signedSha256) fail(`raw EXE signing receipt does not record a signed digest for ${rawFile}`);
+
+  await mustExist(rawFile, `signed raw EXE disappeared before packaging completed: ${rawFile}`);
+  const currentSha256 = createHash("sha256").update(readFileSync(rawFile)).digest("hex");
+  if (currentSha256 !== signedSha256) {
+    fail(
+      `packaging rewrote the signed raw EXE: signed sha256 ${signedSha256}, on-disk sha256 ${currentSha256}. `
+      + "Its Authenticode signature is now invalid. Apply every deterministic byte patch before signing, never after.",
+    );
+  }
+  // signtool, not inference: a hash match proves the bytes, this proves the chain.
+  await run("node", [SIGN_WINDOWS, "--verify-only", rawFile], root);
+
+  const embedded = [];
+  for (const installer of files) {
+    let receipt;
+    try {
+      receipt = verifyNsisEmbeddedBinary({ installer, entryName: path.basename(rawFile), expectedSha256: signedSha256 });
+    } catch (error) {
+      fail(error.message);
+    }
+    console.log(`right-release: ${path.basename(installer)} embeds the signed ${receipt.entry} (sha256 ${receipt.sha256.slice(0, 16)}…)`);
+    embedded.push(receipt);
+  }
+
+  const receiptPath = windowsReceiptPath(root, "embedding");
+  mkdirSync(path.dirname(receiptPath), { recursive: true });
+  writeFileSync(receiptPath, `${JSON.stringify({
+    schema: 1,
+    rawExe: { file: rawFile, signedSha256, verifiedSha256: currentSha256 },
+    bundleMarkers: markers ?? [],
+    embedded,
+    verifiedAt: new Date().toISOString(),
+  }, null, 2)}\n`);
+}
+
 function verifyWindowsReceipt(receipt, files, phase) {
   if (!existsSync(receipt)) fail(`missing ${phase} Windows signing receipt: ${receipt}`);
   let evidence;

package/release.test.mjs

@@ -372,6 +372,17 @@ test("Windows tier-neutral build builds raw EXE, signs it, bundles, signs instal
   assert.doesNotMatch(result.stdout, /publish-update\.mjs/);
 });
 
+test("Windows verifies the installer embeds the signed EXE after bundling and before the installer is signed", () => {
+  const result = run(fixture({ publish: true }));
+  assert.equal(result.status, 0, result.stderr);
+  const rawSignAt = result.stdout.indexOf("signing windows raw-exe");
+  const bundleAt = result.stdout.indexOf("node -e", rawSignAt);
+  const embeddingAt = result.stdout.indexOf("verify installer embeds the signed raw EXE");
+  const installerSignAt = result.stdout.indexOf("signing windows installer");
+  assert.ok(embeddingAt > bundleAt, `embedding check must follow bundling:\n${result.stdout}`);
+  assert.ok(installerSignAt > embeddingAt, `a mutated payload must never reach the installer signature:\n${result.stdout}`);
+});
+
 test("legacy internal tier does not make the build worker upload", () => {
   const result = run(fixture({ publish: true }), "--tier=update");
   assert.equal(result.status, 0, result.stderr);

package/right-suite-contract.test.mjs

@@ -464,11 +464,13 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.1",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.56",
+    "@rightkit/release": "0.2.57",
+    "@rightkit/qa": "0.2.0",
   });
   assert.deepEqual(versions.legacyNpm, {
     "@rightkit/legal-ui": ["0.1.0"],
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55", "0.2.56"],
+    "@rightkit/qa": ["0.1.0"],
   });
   assert.ok(
     new Set([versions.npm["@rightkit/release"], ...versions.legacyNpm["@rightkit/release"]]).has("0.2.42"),

package/rightkit-versions.json

@@ -1,43 +1,67 @@
-{
-  "schema": 2,
-  "packageManager": "pnpm@11.18.0",
-  "npm": {
-    "@rightkit/git": "0.2.0",
-    "@rightkit/legal": "0.2.0",
-    "@rightkit/license": "0.1.5",
-    "@rightkit/logs": "0.1.3",
-    "@rightkit/platform-ui": "0.1.0",
-    "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.47",
-    "@rightkit/tauri": "0.1.0",
-    "@rightkit/updates": "0.2.3"
-  },
-  "stagedNpm": {
-    "@rightkit/ax": "0.2.0",
-    "@rightkit/git": "0.2.0",
-    "@rightkit/legal": "0.3.0",
-    "@rightkit/legal-ui": "0.1.1",
-    "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.56"
-  },
-  "legacyNpm": {
-    "@rightkit/legal-ui": ["0.1.0"],
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55"]
-  },
-  "cargo": {
-    "rightkit-license": "0.1.2",
-    "rightkit-logs": "0.1.0",
-    "rightkit-process": "0.1.0",
-    "rightkit-tauri": "0.1.0"
-  },
-  "stagedCargo": {
-    "rightkit-license": "0.1.3",
-    "rightkit-tauri": "0.1.1"
-  },
-  "swift": {
-    "rightkit-swift": {
-      "url": "https://github.com/bogusyogi/rightkit-swift.git",
-      "version": "0.1.0"
-    }
-  }
-}
+{
+  "schema": 2,
+  "packageManager": "pnpm@11.18.0",
+  "npm": {
+    "@rightkit/git": "0.2.0",
+    "@rightkit/legal": "0.2.0",
+    "@rightkit/license": "0.1.5",
+    "@rightkit/logs": "0.1.3",
+    "@rightkit/platform-ui": "0.1.0",
+    "@rightkit/qa": "0.1.0",
+    "@rightkit/release": "0.2.47",
+    "@rightkit/tauri": "0.1.0",
+    "@rightkit/updates": "0.2.3"
+  },
+  "stagedNpm": {
+    "@rightkit/ax": "0.2.0",
+    "@rightkit/git": "0.2.0",
+    "@rightkit/legal": "0.3.0",
+    "@rightkit/legal-ui": "0.1.1",
+    "@rightkit/license": "0.1.6",
+    "@rightkit/release": "0.2.57",
+    "@rightkit/qa": "0.2.0"
+  },
+  "legacyNpm": {
+    "@rightkit/legal-ui": [
+      "0.1.0"
+    ],
+    "@rightkit/release": [
+      "0.2.22",
+      "0.2.29",
+      "0.2.30",
+      "0.2.31",
+      "0.2.41",
+      "0.2.42",
+      "0.2.43",
+      "0.2.44",
+      "0.2.45",
+      "0.2.46",
+      "0.2.49",
+      "0.2.50",
+      "0.2.51",
+      "0.2.53",
+      "0.2.54",
+      "0.2.55",
+      "0.2.56"
+    ],
+    "@rightkit/qa": [
+      "0.1.0"
+    ]
+  },
+  "cargo": {
+    "rightkit-license": "0.1.2",
+    "rightkit-logs": "0.1.0",
+    "rightkit-process": "0.1.0",
+    "rightkit-tauri": "0.1.0"
+  },
+  "stagedCargo": {
+    "rightkit-license": "0.1.3",
+    "rightkit-tauri": "0.1.1"
+  },
+  "swift": {
+    "rightkit-swift": {
+      "url": "https://github.com/bogusyogi/rightkit-swift.git",
+      "version": "0.1.0"
+    }
+  }
+}

package/tauri-bundle-marker.mjs

@@ -0,0 +1,165 @@
+// Tauri stamps the bundle kind into the compiled binary as an ASCII marker, and
+// its NSIS bundler rewrites that marker WHILE bundling. Doing that to an EXE we
+// already Authenticode-signed silently invalidates the signature — the installer
+// then ships a binary Windows reports as unsigned/corrupt, which is exactly the
+// failure this module exists to make impossible.
+//
+// The contract: patch the marker to its final value BEFORE signing, so Tauri's
+// own rewrite finds nothing left to change and the signed bytes survive intact.
+// Fail closed on anything ambiguous — a missing marker, more than one marker, or
+// a byte changing outside the marker all mean the assumption no longer holds.
+
+import { createHash } from "node:crypto";
+import { readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const MARKER_PREFIX = "__TAURI_BUNDLE_TYPE_VAR_";
+
+export const BUNDLE_MARKERS = Object.freeze({
+  unknown: "UNK",
+  nsis: "NSS",
+  msi: "MSI",
+  app: "APP",
+  dmg: "DMG",
+  deb: "DEB",
+  rpm: "RPM",
+  appimage: "AIM",
+});
+
+export function bundleMarkerBuffer(code) {
+  if (typeof code !== "string" || code.length !== 3) {
+    throw new Error(`Tauri bundle marker code must be exactly 3 ASCII characters, received ${JSON.stringify(code)}`);
+  }
+  return Buffer.from(`${MARKER_PREFIX}${code}`, "ascii");
+}
+
+/**
+ * Rewrite the single unknown bundle marker to the requested bundle kind.
+ *
+ * Idempotent by design: a binary already carrying the target marker (and no
+ * unknown marker) is reported as `alreadyPatched` rather than failing, so a
+ * retried build does not have to distinguish "never patched" from "resumed".
+ */
+export function patchTauriBundleType(file, { bundle = "nsis", read = readFileSync, write = writeFileSync } = {}) {
+  const targetCode = BUNDLE_MARKERS[bundle];
+  if (!targetCode) {
+    throw new Error(`unsupported Tauri bundle kind: ${bundle} (expected one of ${Object.keys(BUNDLE_MARKERS).join(", ")})`);
+  }
+  const resolved = path.resolve(file);
+  const unknownMarker = bundleMarkerBuffer(BUNDLE_MARKERS.unknown);
+  const targetMarker = bundleMarkerBuffer(targetCode);
+
+  const before = read(resolved);
+  const beforeSha256 = sha256(before);
+  const unknownOffsets = findAll(before, unknownMarker);
+  const targetOffsets = findAll(before, targetMarker);
+
+  if (unknownOffsets.length === 0) {
+    if (targetOffsets.length === 1) {
+      return {
+        file: resolved,
+        bundle,
+        offset: targetOffsets[0],
+        changedBytes: 0,
+        alreadyPatched: true,
+        size: before.length,
+        beforeSha256,
+        afterSha256: beforeSha256,
+      };
+    }
+    throw new Error(
+      `no Tauri unknown bundle marker in ${resolved} and ${targetOffsets.length} ${targetCode} markers; refusing to guess the bundle identity`,
+    );
+  }
+  if (unknownOffsets.length !== 1) {
+    throw new Error(`expected exactly one Tauri unknown bundle marker in ${resolved}; found ${unknownOffsets.length}`);
+  }
+
+  const offset = unknownOffsets[0];
+  const after = Buffer.from(before);
+  targetMarker.copy(after, offset);
+
+  const expectedChanges = markerChangeOffsets(unknownMarker, targetMarker, offset);
+  const actualChanges = [];
+  for (let index = 0; index < before.length; index += 1) {
+    if (before[index] !== after[index]) actualChanges.push(index);
+  }
+  if (actualChanges.join(",") !== expectedChanges.join(",")) {
+    throw new Error(`unexpected Tauri bundle marker mutation in ${resolved}`);
+  }
+
+  write(resolved, after);
+  const written = read(resolved);
+  if (!written.equals(after) || findAll(written, unknownMarker).length !== 0) {
+    throw new Error(`failed to verify Tauri ${targetCode} bundle marker in ${resolved}`);
+  }
+
+  return {
+    file: resolved,
+    bundle,
+    offset,
+    changedBytes: actualChanges.length,
+    alreadyPatched: false,
+    size: written.length,
+    beforeSha256,
+    afterSha256: sha256(written),
+  };
+}
+
+/** Back-compat alias for the original app-local helper name. */
+export function patchTauriBundleTypeForNsis(file, options = {}) {
+  return patchTauriBundleType(file, { ...options, bundle: "nsis" });
+}
+
+/**
+ * Report which markers a binary currently carries, without writing. Used by the
+ * post-package audit to prove the packaged binary is the one that was signed.
+ */
+export function readTauriBundleMarkers(file, { read = readFileSync } = {}) {
+  const resolved = path.resolve(file);
+  const bytes = read(resolved);
+  const markers = {};
+  for (const [bundle, code] of Object.entries(BUNDLE_MARKERS)) {
+    const offsets = findAll(bytes, bundleMarkerBuffer(code));
+    if (offsets.length) markers[bundle] = offsets;
+  }
+  return { file: resolved, size: bytes.length, sha256: sha256(bytes), markers };
+}
+
+function findAll(haystack, needle) {
+  const offsets = [];
+  for (let offset = haystack.indexOf(needle); offset !== -1; offset = haystack.indexOf(needle, offset + 1)) {
+    offsets.push(offset);
+  }
+  return offsets;
+}
+
+function markerChangeOffsets(from, to, offset) {
+  const changes = [];
+  for (let index = 0; index < from.length; index += 1) {
+    if (from[index] !== to[index]) changes.push(offset + index);
+  }
+  return changes;
+}
+
+function sha256(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const argv = process.argv.slice(2);
+  const bundleIndex = argv.indexOf("--bundle");
+  const bundle = bundleIndex >= 0 ? argv[bundleIndex + 1] : "nsis";
+  const file = argv.filter((arg, index) => arg !== "--bundle" && index !== bundleIndex + 1)[0];
+  if (!file) {
+    console.error("usage: node tauri-bundle-marker.mjs [--bundle nsis] <binary>");
+    process.exit(2);
+  }
+  try {
+    console.log(JSON.stringify(patchTauriBundleType(file, { bundle })));
+  } catch (error) {
+    console.error(`tauri-bundle-marker: ${error.message}`);
+    process.exit(1);
+  }
+}

package/tauri-bundle-marker.test.mjs

@@ -0,0 +1,81 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { BUNDLE_MARKERS, patchTauriBundleType, patchTauriBundleTypeForNsis, readTauriBundleMarkers } from "./tauri-bundle-marker.mjs";
+
+/** A stand-in binary: filler, one marker, filler. */
+function fakeBinary(code = BUNDLE_MARKERS.unknown, { copies = 1 } = {}) {
+  const parts = [Buffer.alloc(64, 0x41)];
+  for (let index = 0; index < copies; index += 1) {
+    parts.push(Buffer.from(`__TAURI_BUNDLE_TYPE_VAR_${code}`, "ascii"), Buffer.alloc(32, 0x42));
+  }
+  return Buffer.concat(parts);
+}
+
+function memoryFs(initial) {
+  const store = new Map([["binary.exe", Buffer.from(initial)]]);
+  return {
+    store,
+    read: (file) => {
+      const key = file.endsWith("binary.exe") ? "binary.exe" : file;
+      const value = store.get(key);
+      if (!value) throw Object.assign(new Error("ENOENT"), { code: "ENOENT" });
+      return Buffer.from(value);
+    },
+    write: (file, bytes) => {
+      store.set(file.endsWith("binary.exe") ? "binary.exe" : file, Buffer.from(bytes));
+    },
+  };
+}
+
+test("rewrites the single unknown marker to the NSIS marker and nothing else", () => {
+  const fs = memoryFs(fakeBinary());
+  const before = fs.read("binary.exe");
+  const receipt = patchTauriBundleTypeForNsis("binary.exe", { read: fs.read, write: fs.write });
+  const after = fs.read("binary.exe");
+
+  assert.equal(receipt.alreadyPatched, false);
+  assert.equal(receipt.bundle, "nsis");
+  assert.equal(receipt.changedBytes, 3, "only the 3-character bundle code may change");
+  assert.equal(after.length, before.length, "patching must not resize the binary");
+  assert.equal(after.includes(Buffer.from("__TAURI_BUNDLE_TYPE_VAR_NSS")), true);
+  assert.equal(after.includes(Buffer.from("__TAURI_BUNDLE_TYPE_VAR_UNK")), false);
+  assert.notEqual(receipt.beforeSha256, receipt.afterSha256);
+});
+
+test("is idempotent: an already-patched binary is reported, not rewritten", () => {
+  const fs = memoryFs(fakeBinary(BUNDLE_MARKERS.nsis));
+  const receipt = patchTauriBundleTypeForNsis("binary.exe", { read: fs.read, write: fs.write });
+  assert.equal(receipt.alreadyPatched, true);
+  assert.equal(receipt.changedBytes, 0);
+  assert.equal(receipt.beforeSha256, receipt.afterSha256, "an already-patched binary keeps its signed bytes");
+});
+
+test("fails closed when the binary carries more than one unknown marker", () => {
+  const fs = memoryFs(fakeBinary(BUNDLE_MARKERS.unknown, { copies: 2 }));
+  assert.throws(
+    () => patchTauriBundleTypeForNsis("binary.exe", { read: fs.read, write: fs.write }),
+    /found 2/,
+  );
+});
+
+test("fails closed when no marker of any kind is present", () => {
+  const fs = memoryFs(Buffer.alloc(128, 0x41));
+  assert.throws(
+    () => patchTauriBundleTypeForNsis("binary.exe", { read: fs.read, write: fs.write }),
+    /refusing to guess the bundle identity/,
+  );
+});
+
+test("rejects an unsupported bundle kind before touching the file", () => {
+  const fs = memoryFs(fakeBinary());
+  assert.throws(() => patchTauriBundleType("binary.exe", { bundle: "zip", read: fs.read, write: fs.write }), /unsupported Tauri bundle kind/);
+  assert.equal(fs.read("binary.exe").includes(Buffer.from("__TAURI_BUNDLE_TYPE_VAR_UNK")), true);
+});
+
+test("readTauriBundleMarkers reports offsets without writing", () => {
+  const fs = memoryFs(fakeBinary(BUNDLE_MARKERS.nsis));
+  const report = readTauriBundleMarkers("binary.exe", { read: fs.read });
+  assert.deepEqual(report.markers.nsis, [64]);
+  assert.equal(report.markers.unknown, undefined);
+  assert.match(report.sha256, /^[0-9a-f]{64}$/);
+});