@rightkit/release 0.2.70 → 0.2.72

package/release.mjs

@@ -9,10 +9,19 @@ import { validateRightKitCargoContract } from "./cargo-contract.mjs";
 import { assertQaBackdoorContract } from "./qa-contract.mjs";
 import { assertLegalReleaseContract } from "./legal-contract.mjs";
 import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
+import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
+import {
+  canonicalPackageIdentity,
+  createNativeFinalizationReceipt,
+  mintNativeProvenance,
+  resolveNativeFinalizerConfig,
+  validateNativeFinalizationOutput,
+} from "./native-release-finalization.mjs";
 import { collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
 import { patchTauriBundleType } from "./tauri-bundle-marker.mjs";
 import { verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
 import { terminateProcessTree } from "./heavy-command.mjs";
+import { materializeHardeningEvidence } from "./hardening-evidence.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
@@ -41,7 +50,6 @@ const opts = {
   install: false,
   dryRun: false,
   skipChecks: false,
-  skipHardening: false,
   doctor: false,
   tier: null,
 };
@@ -56,7 +64,7 @@ for (let i = 0; i < args.length; i++) {
   else if (arg === "--install") opts.install = true;
   else if (arg === "--dry-run") opts.dryRun = true;
   else if (arg === "--skip-checks") opts.skipChecks = true;
-  else if (arg === "--skip-hardening") opts.skipHardening = true;
+  else if (arg === "--skip-hardening") fail("--skip-hardening is forbidden; use exact artifact/source-bound hardeningAllowances");
   else if (arg === "--doctor") opts.doctor = true;
   else if (arg === "--tier") opts.tier = args[++i];
   else if (arg.startsWith("--tier=")) opts.tier = arg.slice("--tier=".length);
@@ -92,6 +100,9 @@ if (config.schema !== 1) fail(`unsupported config schema: ${config.schema ?? "<m
 
 const root = path.dirname(configPath);
 const workdir = path.resolve(root, config.workdir ?? ".");
+const nativeLayout = resolveNativeCargoLayout({ appRoot: root, config });
+const nativeAssembly = config.nativeAssembly;
+const nativeFinalizer = resolveNativeFinalizerConfig(nativeAssembly);
 await validateRightKitPackageContract(root, config.app, config.hostedWorkflows);
 validateRightKitCargoContract(root, RIGHTKIT_CARGO_ALLOWED, config.app ?? path.basename(root));
 const target = config.targets?.[opts.platform];
@@ -118,7 +129,7 @@ if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.pl
  * Assemble preflight inputs from the app's own files. Kept here (not in
  * preflight.mjs) so the check module stays free of release.mjs's config shape.
  */
-function releasePreflight({ config, configPath, root, repoRoot, platform }) {
+function releasePreflight({ config, configPath, root, repoRoot, platform, nativeLayout: suppliedNativeLayout = nativeLayout }) {
   let version;
   try {
     version = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).version;
@@ -128,10 +139,9 @@ function releasePreflight({ config, configPath, root, repoRoot, platform }) {
   // Every Cargo.lock the build compiles from; a vendored-OpenSSL edge in any of
   // them means the build needs a real Windows Perl.
   const cargoLockPaths = [
-    path.join(root, "src-tauri", "Cargo.lock"),
-    path.join(root, "Cargo.lock"),
+    ...(suppliedNativeLayout?.lockCandidates ?? []),
     ...(config.cargoLocks ?? []).map((entry) => path.resolve(root, entry)),
-  ];
+  ].filter((entry, index, entries) => entries.indexOf(entry) === index);
   return collectPreflight({
     platform,
     appRoot: root,
@@ -140,11 +150,13 @@ function releasePreflight({ config, configPath, root, repoRoot, platform }) {
     version,
     configPath,
     cargoLockPaths,
+    nativeLayout: suppliedNativeLayout,
+    targetLink: suppliedNativeLayout?.targetLink,
   });
 }
 
 if (opts.doctor) {
-  const { buildInputs } = resolveReleaseBuildInputs({
+  const { buildInputs, nativeLayout: resolvedNativeLayout } = resolveReleaseBuildInputs({
     repoRoot: doctorInvocation.repoRoot,
     appRoot: root,
     configPath,
@@ -174,7 +186,7 @@ if (opts.doctor) {
 
   // Config above, MACHINE below. Printing config never told anyone whether this
   // box could finish a build; these checks do.
-  const checks = releasePreflight({ config, configPath, root, repoRoot: doctorInvocation.repoRoot, platform: opts.platform });
+  const checks = releasePreflight({ config, configPath, root, repoRoot: doctorInvocation.repoRoot, platform: opts.platform, nativeLayout: resolvedNativeLayout });
   console.log("preflight:");
   console.log(formatPreflight(checks));
   const failures = preflightFailures(checks);
@@ -200,6 +212,7 @@ if (!opts.skipChecks) {
   for (const script of config.checks ?? []) await runPackageScript(config.packageManager, script, workdir);
 }
 
+let nativeFinalization = null;
 let bundleMarkerReceipts = [];
 if (opts.platform === "win") {
   const rawFiles = target.sign.prePackageFiles.map((p) => path.resolve(root, p));
@@ -215,6 +228,29 @@ if (opts.platform === "win") {
     console.log(`right-release: bundle marker ${receipt.bundle} ${receipt.alreadyPatched ? "already applied" : "applied"} at offset ${receipt.offset} in ${path.basename(receipt.file)}`);
   }
   await signWindows(rawFiles, "raw-exe", root);
+  if (nativeAssembly?.packageHook && !hasNativeTargetSpecificPrePackage(target, nativeAssembly.packageHook)) {
+    await runCommand(nativeAssembly.packageHook, root);
+  }
+  if (nativeFinalizer) {
+    nativeFinalization = await runNativeFinalizer({
+      finalizer: nativeFinalizer,
+      nativeAssembly,
+      target,
+      root,
+      signedFiles: rawFiles,
+    });
+  }
+} else if (nativeAssembly) {
+  if (nativeAssembly.packageHook) await runCommand(nativeAssembly.packageHook, root);
+  if (nativeFinalizer) {
+    nativeFinalization = await runNativeFinalizer({
+      finalizer: nativeFinalizer,
+      nativeAssembly,
+      target,
+      root,
+      signedFiles: target.sign?.prePackageFiles ?? target.sign?.files ?? [],
+    });
+  }
 }
 
 await runCommand(command, root);
@@ -223,6 +259,8 @@ for (const rel of target.artifacts ?? []) {
   await mustExist(path.resolve(root, rel), `missing release artifact: ${rel}`);
 }
 
+if (nativeFinalization) await completeNativeFinalization(nativeFinalization, { root, target, nativeAssembly });
+
 if (opts.platform === "win" && target.signingContract === WINDOWS_NSIS_SIGNING_CONTRACT) {
   const files = target.sign.files.map((p) => path.resolve(root, p));
   for (const file of files) await mustExist(file, `missing signing artifact: ${file}`);
@@ -241,10 +279,21 @@ if (target.postSign && opts.platform !== "win") {
   await runCommand(target.postSign, root);
 }
 
-if (!opts.skipHardening) {
+{
   const scanTargets = target.hardening ?? target.artifacts ?? [];
   if (scanTargets.length) {
-    await run("node", [HARDENING_SCAN, ...scanTargets.map((p) => path.resolve(root, p))], root);
+    let hardeningEvidence = null;
+    if (target.hardeningAllowances?.length) {
+      const receiptRoot = path.resolve(root, ".right-release", "receipts");
+      mkdirSync(receiptRoot, { recursive: true });
+      hardeningEvidence = path.join(receiptRoot, opts.platform + "-hardening-evidence.json");
+      materializeHardeningEvidence({ root, allowances: target.hardeningAllowances, outputPath: hardeningEvidence });
+    }
+    await run("node", [
+      HARDENING_SCAN,
+      ...(hardeningEvidence ? ["--allow-evidence", hardeningEvidence] : []),
+      ...scanTargets.map((p) => path.resolve(root, p)),
+    ], root);
   }
 }
 
@@ -311,13 +360,180 @@ async function mustExist(file, message) {
   await access(file).catch(() => fail(message));
 }
 
+async function runNativeFinalizer({ finalizer, nativeAssembly, target, root, signedFiles }) {
+  if (!finalizer?.cmd) fail(`${config.app} ${opts.platform} nativeAssembly.finalizer must declare a command`);
+  const signedArtifacts = nativeSignedArtifacts(signedFiles, root);
+  const packageIdentity = nativePackageIdentity({ nativeAssembly, target });
+  const provenance = mintNativeProvenance({
+    app: config.app,
+    version: config.version,
+    platform: opts.platform,
+    architecture: target.selectedArchitecture ?? target.architecture ?? nativeAssembly?.architecture ?? process.arch,
+    targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget,
+    signedArtifacts,
+    packageIdentity,
+  });
+  const outputPath = nativeFinalizerOutputPath({ finalizer, target, root });
+  const finalizerCommand = {
+    ...finalizer,
+    args: finalizer.args.map((arg) => expandFinalizerToken(arg, { provenance, outputPath, packageIdentity })),
+  };
+  const stdout = await runCommand(finalizerCommand, root, {
+    captureStdout: true,
+    env: {
+      RIGHT_RELEASE_NATIVE_PROVENANCE: provenance,
+      RIGHT_RELEASE_NATIVE_FINALIZATION_RECEIPT: outputPath,
+      RIGHT_RELEASE_NATIVE_PACKAGE_IDENTITY: JSON.stringify(packageIdentity),
+      RIGHT_RELEASE_NATIVE_SIGNED_ARTIFACTS: JSON.stringify(signedArtifacts),
+    },
+  });
+  if (opts.dryRun) return { outputPath, provenance, signedArtifacts, packageIdentity, output: null };
+
+  let output = null;
+  if (existsSync(outputPath)) {
+    try { output = JSON.parse(readFileSync(outputPath, "utf8")); } catch (error) { fail(`native finalizer output is not valid JSON: ${outputPath}: ${error.message}`); }
+  } else if (stdout?.trim()) {
+    try { output = JSON.parse(stdout); } catch { fail(`native finalizer output missing: ${outputPath}`); }
+  } else {
+    fail(`native finalizer output missing: ${outputPath}`);
+  }
+  output = enrichNativeFinalizerOutput(output, root);
+  try {
+    output = validateNativeFinalizationOutput(output, { expectedProvenance: provenance });
+  } catch (error) {
+    fail(`invalid native finalizer output: ${error.message}`);
+  }
+  return { outputPath, provenance, signedArtifacts, packageIdentity, output };
+}
+
+function enrichNativeFinalizerOutput(output, root) {
+  if (output?.provenance) return output;
+  if (output?.runtime?.provenance) return { ...output, provenance: output.runtime.provenance };
+  if (!output?.output) return output;
+  const manifestPath = path.join(path.resolve(root, output.output), "share", "legion", "release.json");
+  if (!existsSync(manifestPath)) return output;
+  try {
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+    const provenance = manifest.runtime?.provenance;
+    if (provenance) return { ...output, provenance };
+  } catch {
+    return output;
+  }
+  return output;
+}
+
+async function completeNativeFinalization(finalization, { root, target, nativeAssembly }) {
+  if (opts.dryRun) {
+    console.log(`dry-run: native finalization receipt binds archive identity at ${finalization.outputPath}`);
+    return;
+  }
+  const archivePath = nativeArchiveCandidates({ root, target, nativeAssembly }).find((file) => existsSync(file));
+  if (!archivePath) fail(`${config.app} ${opts.platform} native finalization cannot find final archive`);
+  let receipt;
+  try {
+    receipt = createNativeFinalizationReceipt({
+      app: config.app,
+      version: config.version,
+      platform: opts.platform,
+      architecture: target.selectedArchitecture ?? target.architecture ?? nativeAssembly?.architecture ?? process.arch,
+      targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget,
+      signedArtifacts: finalization.signedArtifacts,
+      packageIdentity: finalization.packageIdentity,
+      archivePath,
+      finalizerOutput: finalization.output,
+      root,
+    });
+  } catch (error) {
+    fail(`native finalization archive binding failed: ${error.message}`);
+  }
+  mkdirSync(path.dirname(finalization.outputPath), { recursive: true });
+  writeFileSync(finalization.outputPath, `${JSON.stringify(receipt, null, 2)}\n`);
+  console.log(`right-release: native finalization verified ${receipt.provenance} archive=${receipt.archiveSha256}`);
+}
+
+function nativeSignedArtifacts(files, root) {
+  const values = Array.isArray(files) ? files : [];
+  return values.map((value) => {
+    const declared = typeof value === "string" ? value : value?.path ?? value?.file;
+    if (!declared) fail("native finalizer signed artifact path is missing");
+    const absolute = path.resolve(root, declared);
+    if (opts.dryRun) return { path: path.relative(root, absolute).replaceAll("\\", "/") };
+    if (!existsSync(absolute)) fail(`native finalizer signed artifact missing: ${absolute}`);
+    return {
+      path: path.relative(root, absolute).replaceAll("\\", "/"),
+      sha256: createHash("sha256").update(readFileSync(absolute)).digest("hex"),
+      sizeBytes: readFileSync(absolute).length,
+    };
+  });
+}
+
+function nativePackageIdentity({ nativeAssembly, target }) {
+  const declared = nativeAssembly?.packageIdentity ?? target.packageIdentity;
+  if (declared) return canonicalPackageIdentity(declared);
+  const artifacts = [
+    ...(target.artifacts ?? []),
+    ...(target.installer?.artifacts ?? []).map((artifact) => artifact.file),
+    ...(target.updater?.artifacts ?? []).map((artifact) => artifact.file),
+  ].filter(Boolean);
+  return canonicalPackageIdentity({
+    kind: target.packageKind ?? "release",
+    platform: opts.platform,
+    architecture: target.selectedArchitecture ?? target.architecture ?? nativeAssembly?.architecture ?? process.arch,
+    ...(artifacts.length ? { artifacts } : {}),
+  });
+}
+
+function nativeArchiveCandidates({ root, target, nativeAssembly }) {
+  const declared = [
+    nativeAssembly?.archive,
+    nativeAssembly?.archivePath,
+    nativeAssembly?.packageIdentity?.path,
+    target.archive,
+    target.archivePath,
+    ...(target.artifacts ?? []),
+    ...(target.installer?.artifacts ?? []).map((artifact) => artifact.file),
+    ...(target.updater?.artifacts ?? []).map((artifact) => artifact.file),
+  ].filter((value) => typeof value === "string" && value.trim());
+  return [...new Set(declared.map((value) => path.resolve(root, value)))];
+}
+
+function nativeFinalizerOutputPath({ finalizer, target, root }) {
+  const declared = finalizer.output
+    ?? target.evidence?.provenance
+    ?? target.provenance
+    ?? `.right-release/receipts/native-finalization-${opts.platform}.json`;
+  return path.resolve(root, declared);
+}
+
+function expandFinalizerToken(value, { provenance, outputPath, packageIdentity }) {
+  const replacements = {
+    "{{provenance}}": provenance,
+    "{provenance}": provenance,
+    "${RIGHT_RELEASE_NATIVE_PROVENANCE}": provenance,
+    "$RIGHT_RELEASE_NATIVE_PROVENANCE": provenance,
+    "{{receipt}}": outputPath,
+    "{receipt}": outputPath,
+    "${RIGHT_RELEASE_NATIVE_FINALIZATION_RECEIPT}": outputPath,
+    "$RIGHT_RELEASE_NATIVE_FINALIZATION_RECEIPT": outputPath,
+    "{{packageIdentity}}": JSON.stringify(packageIdentity),
+    "{packageIdentity}": JSON.stringify(packageIdentity),
+  };
+  return Object.entries(replacements).reduce((result, [token, replacement]) => result.replaceAll(token, replacement), String(value));
+}
+
+function hasNativeTargetSpecificPrePackage(target, packageHook) {
+  if (!target?.prePackage || !packageHook || target.prePackage.cmd !== packageHook.cmd) return false;
+  const args = target.prePackage.args ?? [];
+  return args.some((arg) => ["--platform", "--architecture", "--target", "--out"].includes(arg));
+}
+
 // Post-release target/ hygiene: `cargo sweep --installed` deletes artifacts left
 // by toolchains rustup no longer has (each update orphans a multi-GB pile per
 // app) and never touches anything the current toolchains produced. Runs after
 // publish so it cannot race an artifact, and is best-effort: a missing
 // cargo-sweep or a sweep failure must never fail a release.
 function sweepStaleRustArtifacts() {
-  const candidates = [...new Set([root, workdir].flatMap((base) => [base, path.join(base, "src-tauri")]))];
+  const candidates = [...new Set([root, workdir, nativeLayout.manifestDir, nativeLayout.workspaceRoot])];
   const projects = candidates.filter((dir) => existsSync(path.join(dir, "target")));
   for (const dir of projects) {
     if (opts.dryRun) {
@@ -348,10 +564,11 @@ async function runPackageScript(pm, script, cwd) {
   await run(pm, ["run", script], cwd);
 }
 
-async function runCommand(command, root) {
+async function runCommand(command, root, { env = {}, captureStdout = false } = {}) {
   const cwd = path.resolve(root, command.cwd ?? ".");
-  await run(command.cmd, command.args ?? [], cwd, await commandEnv(command, root), {
+  return run(command.cmd, command.args ?? [], cwd, { ...(await commandEnv(command, root)), ...env }, {
     ...command,
+    captureStdout,
     timeoutMs: commandTimeoutMs(command),
   });
 }
@@ -550,7 +767,7 @@ function run(cmd, runArgs, cwd, env = {}, options = {}) {
     const timeout = options.timeoutMs ? ` timeout=${options.timeoutMs}ms` : "";
     const tier = opts.tier ? `RIGHT_RELEASE_TIER=${opts.tier} ` : "";
     console.log(`dry-run: (${cwd}) ${tier}${printable}${timeout}`);
-    return Promise.resolve();
+    return Promise.resolve("");
   }
   const started = Date.now();
   return new Promise((resolve) => {
@@ -558,10 +775,12 @@ function run(cmd, runArgs, cwd, env = {}, options = {}) {
     const child = spawn(cmd, runArgs, {
       cwd,
       env: { ...process.env, ...releaseEnv, ...env },
-      stdio: "inherit",
+      stdio: options.captureStdout ? ["inherit", "pipe", "inherit"] : "inherit",
       shell: useShell,
       windowsHide: true,
     });
+    let stdout = "";
+    if (options.captureStdout) child.stdout?.on("data", (chunk) => { stdout += String(chunk); });
     const timer = options.timeoutMs
       ? setTimeout(() => {
           killProcessTree(child.pid);
@@ -579,7 +798,7 @@ function run(cmd, runArgs, cwd, env = {}, options = {}) {
       if (timer) clearTimeout(timer);
       console.log(`right-release step: ${printable} (${Date.now() - started}ms)`);
       if (code !== 0) process.exit(code ?? 1);
-      resolve();
+      resolve(options.captureStdout ? stdout : "");
     });
   });
 }

package/rightkit-versions.json

@@ -13,7 +13,7 @@
     "@rightkit/updates": "0.2.3"
   },
   "stagedNpm": {
-    "@rightkit/ax": "0.2.0",
+    "@rightkit/ax": "0.2.1",
     "@rightkit/git": "0.2.1",
     "@rightkit/hooks": "0.1.1",
     "@rightkit/legal": "0.3.1",
@@ -22,11 +22,14 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.70",
+    "@rightkit/release": "0.2.72",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },
   "legacyNpm": {
+    "@rightkit/ax": [
+      "0.2.0"
+    ],
     "@rightkit/legal-ui": [
       "0.1.0"
     ],
@@ -65,7 +68,9 @@
       "0.2.66",
       "0.2.67",
       "0.2.68",
-      "0.2.69"
+      "0.2.69",
+      "0.2.70",
+      "0.2.71"
     ],
     "@rightkit/qa": [
       "0.1.0",

package/sign-release-manifest.mjs

@@ -0,0 +1,223 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+
+export const RIGHTRELEASE_MANIFEST_SIGNER = Object.freeze({
+  id: "azure-artifact-signing-damned-ventures-v1",
+  subject: "CN=Damned Ventures LLC",
+  algorithm: "cms-sha256",
+});
+
+const EXCLUDE_CREDENTIALS = [
+  "ManagedIdentityCredential",
+  "WorkloadIdentityCredential",
+  "SharedTokenCacheCredential",
+  "VisualStudioCredential",
+  "VisualStudioCodeCredential",
+  "AzurePowerShellCredential",
+  "AzureDeveloperCliCredential",
+  "InteractiveBrowserCredential",
+];
+
+const CERTIFICATE_SHA256 = /^[a-f0-9]{64}$/i;
+
+/**
+ * Verify detached CMS over exact manifest bytes & bind signer identity to the
+ * shared Azure Artifact Signing result. `commandRunner` is an injectable
+ * system-process seam; it cannot replace CMS verification because production
+ * verification script/arguments are always issued here.
+ */
+export function verifyDetachedCmsSignature({
+  manifestPath,
+  signaturePath,
+  expectedSigner,
+  commandRunner = spawnSync,
+  platform = process.platform,
+  powershellPath = "powershell",
+  opensslPath = "openssl",
+}) {
+  const manifest = resolve(manifestPath);
+  const signature = resolve(signaturePath);
+  if (!existsSync(manifest) || !statSync(manifest).isFile()) throw new Error("CMS manifest bytes are missing");
+  if (!existsSync(signature) || !statSync(signature).isFile() || statSync(signature).size < 1) throw new Error("detached CMS signature is missing");
+  if (!expectedSigner || expectedSigner.id !== RIGHTRELEASE_MANIFEST_SIGNER.id || expectedSigner.subject !== RIGHTRELEASE_MANIFEST_SIGNER.subject || expectedSigner.algorithm !== RIGHTRELEASE_MANIFEST_SIGNER.algorithm || !CERTIFICATE_SHA256.test(expectedSigner.certificateSha256 ?? "")) {
+    throw new Error("CMS verification requires exact Azure signer identity");
+  }
+  const inspection = platform === "win32"
+    ? verifyCmsWithPowerShell({ manifestPath: manifest, signaturePath: signature, commandRunner, powershellPath })
+    : verifyCmsWithOpenSsl({ manifestPath: manifest, signaturePath: signature, commandRunner, opensslPath });
+  if (!inspection.verified) throw new Error("detached CMS signature is invalid");
+  if (normalizeSubject(inspection.subject) !== normalizeSubject(expectedSigner.subject)) throw new Error("CMS signer subject mismatch");
+  const certificateSha256 = String(inspection.certificateSha256 ?? "").replaceAll(":", "").toLowerCase();
+  if (!CERTIFICATE_SHA256.test(certificateSha256) || certificateSha256 !== String(expectedSigner.certificateSha256).toLowerCase()) throw new Error("CMS signer certificate fingerprint mismatch");
+  return { verified: true, manifestPath: manifest, signaturePath: signature, signer: { ...expectedSigner, certificateSha256 } };
+}
+
+export function signReleaseManifestWithAzure({
+  manifestPath,
+  signaturePath,
+  commandRunner = spawnSync,
+  environment = process.env,
+  signtoolPath,
+  dlibPath,
+  metadataPath,
+}) {
+  if (process.platform !== "win32" && commandRunner === spawnSync) {
+    throw new Error("RightRelease manifest signing must run on protected Windows release host");
+  }
+  const userEnv = (name) => readUserEnvironment(name, commandRunner);
+  const env = (name) => environment[name] || userEnv(name);
+  const signtool = signtoolPath || firstExisting([
+    env("AZURE_SIGNTOOL_PATH"),
+    env("SIGNTOOL_PATH"),
+    ...signtoolCandidates(env),
+  ]);
+  if (!signtool) throw new Error("RightRelease manifest signer could not find signtool.exe");
+  const dlib = dlibPath || firstExisting([
+    env("AZURE_CODESIGN_DLIB_PATH"),
+    env("AZURE_ARTIFACT_SIGNING_DLIB_PATH"),
+    join(env("LOCALAPPDATA") || "", "AzureArtifactSigningTools", "Microsoft.ArtifactSigning.Client", "bin", "x64", "Azure.CodeSigning.Dlib.dll"),
+    "C:\\Program Files\\Microsoft Azure Artifact Signing Client Tools\\x64\\Azure.CodeSigning.Dlib.dll",
+    "C:\\Program Files (x86)\\Microsoft\\ArtifactSigningClientTools\\bin\\x64\\Azure.CodeSigning.Dlib.dll",
+  ]);
+  if (!dlib) throw new Error("RightRelease manifest signer could not find Azure Artifact Signing dlib");
+
+  const temp = mkdtempSync(join(tmpdir(), "rightrelease-manifest-sign-"));
+  const metadata = metadataPath || materializeMetadata(temp, env);
+  const outputDir = join(temp, "signature");
+  mkdirSync(outputDir, { recursive: true });
+  try {
+    const result = commandRunner(signtool, [
+      "sign", "/v", "/fd", "SHA256", "/tr", "http://timestamp.acs.microsoft.com", "/td", "SHA256",
+      "/dlib", dlib, "/dmdf", metadata,
+      "/p7", outputDir, "/p7ce", "DetachedSignedData", "/p7co", "1.2.840.113549.1.7.1",
+      resolve(manifestPath),
+    ], { encoding: "utf8", windowsHide: true, env: environment });
+    if (result?.status !== 0) throw new Error(`RightRelease manifest signing failed: ${String(result?.stderr ?? "").trim()}`);
+    const generated = join(outputDir, `${basename(manifestPath)}.p7`);
+    if (!existsSync(generated)) throw new Error("RightRelease manifest signer did not produce detached CMS signature");
+    const inspector = join(temp, "inspect-signer.ps1");
+    writeFileSync(inspector, [
+      "param([string]$ManifestPath, [string]$SignaturePath)",
+      "Add-Type -AssemblyName System.Security",
+      "$Content = New-Object Security.Cryptography.Pkcs.ContentInfo(,[IO.File]::ReadAllBytes($ManifestPath))",
+      "$Cms = New-Object Security.Cryptography.Pkcs.SignedCms($Content, $true)",
+      "$Cms.Decode([IO.File]::ReadAllBytes($SignaturePath))",
+      "$Cms.CheckSignature($true)",
+      "if ($Cms.SignerInfos.Count -ne 1) { throw 'Expected exactly one manifest signer' }",
+      "$Certificate = $Cms.SignerInfos[0].Certificate",
+      "$Sha256 = [Security.Cryptography.SHA256]::Create()",
+      "try { $Fingerprint = ([BitConverter]::ToString($Sha256.ComputeHash($Certificate.RawData))).Replace('-','').ToLowerInvariant() } finally { $Sha256.Dispose() }",
+      "@{ subject=$Certificate.Subject; certificateSha256=$Fingerprint } | ConvertTo-Json -Compress",
+    ].join("\r\n") + "\r\n");
+    const inspection = commandRunner("powershell", ["-NoProfile", "-File", inspector, resolve(manifestPath), generated], { encoding: "utf8", windowsHide: true, env: environment });
+    if (inspection?.status !== 0) throw new Error(`RightRelease could not inspect manifest signer: ${String(inspection?.stderr ?? "").trim()}`);
+    let certificate;
+    try { certificate = JSON.parse(String(inspection.stdout ?? "").trim()); } catch { throw new Error("RightRelease manifest signer inspection returned invalid JSON"); }
+    if (certificate.subject !== RIGHTRELEASE_MANIFEST_SIGNER.subject || !/^[a-f0-9]{64}$/.test(certificate.certificateSha256 ?? "")) {
+      throw new Error("RightRelease manifest signer identity does not match protected Azure profile");
+    }
+    mkdirSync(dirname(signaturePath), { recursive: true });
+    writeFileSync(signaturePath, readFileSync(generated));
+    return { signaturePath: resolve(signaturePath), signer: { ...RIGHTRELEASE_MANIFEST_SIGNER, certificateSha256: certificate.certificateSha256 } };
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+}
+
+function verifyCmsWithPowerShell({ manifestPath, signaturePath, commandRunner, powershellPath }) {
+  const temp = mkdtempSync(join(tmpdir(), "rightrelease-cms-verify-"));
+  const verifier = join(temp, "verify-cms.ps1");
+  writeFileSync(verifier, [
+    "param([string]$ManifestPath, [string]$SignaturePath)",
+    "Add-Type -AssemblyName System.Security",
+    "$Content = New-Object Security.Cryptography.Pkcs.ContentInfo(,[IO.File]::ReadAllBytes($ManifestPath))",
+    "$Cms = New-Object Security.Cryptography.Pkcs.SignedCms($Content, $true)",
+    "$Cms.Decode([IO.File]::ReadAllBytes($SignaturePath))",
+    "$Cms.CheckSignature($true)",
+    "if ($Cms.SignerInfos.Count -ne 1) { throw 'Expected exactly one manifest signer' }",
+    "$Certificate = $Cms.SignerInfos[0].Certificate",
+    "$Sha256 = [Security.Cryptography.SHA256]::Create()",
+    "try { $Fingerprint = ([BitConverter]::ToString($Sha256.ComputeHash($Certificate.RawData))).Replace('-','').ToLowerInvariant() } finally { $Sha256.Dispose() }",
+    "@{ verified=$true; subject=$Certificate.Subject; certificateSha256=$Fingerprint } | ConvertTo-Json -Compress",
+  ].join("\r\n") + "\r\n");
+  try {
+    const result = commandRunner(powershellPath, ["-NoProfile", "-File", verifier, manifestPath, signaturePath], { encoding: "utf8", windowsHide: true });
+    if (result?.status !== 0) throw new Error(`CMS signature verification failed: ${String(result?.stderr ?? "").trim()}`);
+    return parseCmsInspection(result?.stdout);
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+}
+
+function verifyCmsWithOpenSsl({ manifestPath, signaturePath, commandRunner, opensslPath }) {
+  const temp = mkdtempSync(join(tmpdir(), "rightrelease-cms-verify-"));
+  const verified = join(temp, "verified-manifest");
+  const certificate = join(temp, "signer.pem");
+  try {
+    const result = commandRunner(opensslPath, ["cms", "-verify", "-binary", "-inform", "DER", "-in", signaturePath, "-content", manifestPath, "-noverify", "-certsout", certificate, "-out", verified], { encoding: "utf8", windowsHide: true });
+    if (result?.status !== 0) throw new Error(`CMS signature verification failed: ${String(result?.stderr ?? "").trim()}`);
+    if (!existsSync(verified) || !readFileSync(verified).equals(readFileSync(manifestPath))) throw new Error("CMS signature content does not match manifest bytes");
+    if (!existsSync(certificate)) throw new Error("CMS signer certificate is missing");
+    const inspection = commandRunner(opensslPath, ["x509", "-in", certificate, "-noout", "-subject", "-fingerprint", "-sha256"], { encoding: "utf8", windowsHide: true });
+    if (inspection?.status !== 0) throw new Error(`CMS signer inspection failed: ${String(inspection?.stderr ?? "").trim()}`);
+    const output = String(inspection?.stdout ?? "");
+    const subject = output.match(/^\s*subject\s*=\s*(.+)$/im)?.[1]?.trim();
+    const certificateSha256 = output.match(/^\s*sha256\s+Fingerprint\s*=\s*([0-9a-f:]+)\s*$/im)?.[1];
+    return parseCmsInspection(JSON.stringify({ verified: true, subject, certificateSha256 }));
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+}
+
+function parseCmsInspection(output) {
+  let inspection;
+  try { inspection = JSON.parse(String(output ?? "").trim()); } catch { throw new Error("CMS verifier returned invalid JSON"); }
+  if (inspection.verified !== true || typeof inspection.subject !== "string" || typeof inspection.certificateSha256 !== "string") throw new Error("CMS verifier returned incomplete identity");
+  return inspection;
+}
+
+function normalizeSubject(subject) {
+  return String(subject).trim().replace(/\s*=\s*/g, "=").replace(/\s*,\s*/g, ",");
+}
+
+function materializeMetadata(dir, env) {
+  const existing = env("AZURE_ARTIFACT_SIGNING_METADATA") || env("AZURE_SIGNING_METADATA");
+  if (existing) {
+    if (!existsSync(existing)) throw new Error(`Azure signing metadata file not found: ${existing}`);
+    return existing;
+  }
+  const Endpoint = env("AZURE_ARTIFACT_SIGNING_ENDPOINT") || env("AZURE_SIGNING_ENDPOINT") || env("AZURE_ENDPOINT");
+  const CodeSigningAccountName = env("AZURE_ARTIFACT_SIGNING_ACCOUNT") || env("AZURE_SIGNING_ACCOUNT_NAME") || env("AZURE_ACCOUNT");
+  const CertificateProfileName = env("AZURE_ARTIFACT_SIGNING_PROFILE") || env("AZURE_CERTIFICATE_PROFILE_NAME") || env("AZURE_PROFILE");
+  if (!Endpoint || !CodeSigningAccountName || !CertificateProfileName) {
+    throw new Error("RightRelease manifest signer requires existing Azure Artifact Signing configuration");
+  }
+  const path = join(dir, "metadata.json");
+  writeFileSync(path, `${JSON.stringify({ Endpoint, CodeSigningAccountName, CertificateProfileName, ExcludeCredentials: EXCLUDE_CREDENTIALS }, null, 2)}\n`);
+  return path;
+}
+
+function signtoolCandidates(env) {
+  const roots = [
+    join(env("LOCALAPPDATA") || "", "AzureArtifactSigningTools", "Microsoft.Windows.SDK.BuildTools", "bin"),
+    join(env("ProgramFiles(x86)") || "C:\\Program Files (x86)", "Windows Kits", "10", "bin"),
+  ];
+  return roots.flatMap((root) => existsSync(root)
+    ? readdirSync(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join(root, entry.name, "x64", "signtool.exe")).sort().reverse()
+    : []);
+}
+
+function firstExisting(candidates) {
+  return candidates.find((candidate) => candidate && existsSync(candidate));
+}
+
+function readUserEnvironment(name, commandRunner) {
+  const result = commandRunner("powershell", ["-NoProfile", "-Command", `[Environment]::GetEnvironmentVariable('${name.replaceAll("'", "''")}','User')`], {
+    encoding: "utf8",
+    windowsHide: true,
+  });
+  return result?.status === 0 ? String(result.stdout ?? "").trim() : "";
+}