@rightkit/release 0.2.72 → 0.2.74

package/direct-bootstrap.mjs

@@ -145,6 +145,8 @@ export function buildReleaseManifest({
     minimumBootstrapVersion,
     signingKeyId: RIGHTRELEASE_MANIFEST_SIGNER.id,
     signatureAlgorithm: RIGHTRELEASE_MANIFEST_SIGNER.algorithm,
+    signatureProvider: RIGHTRELEASE_MANIFEST_SIGNER.provider,
+    signatureProviderVersion: RIGHTRELEASE_MANIFEST_SIGNER.providerVersion,
     checksumsSha256: checksumsDigest,
     assets: normalizedAssets,
   };
@@ -162,7 +164,7 @@ export function materializeDirectRelease({ outputDir, manifestInput }) {
   });
   const manifestText = `${canonicalJson(manifest)}\n`;
   const manifestPath = join(outputDir, "release-manifest.json");
-  const signaturePath = join(outputDir, "release-manifest.sig");
+  const signaturePath = join(outputDir, "release-manifest.cat");
   writeFileSync(manifestPath, manifestText);
   const signing = signReleaseManifestWithAzure({ manifestPath, signaturePath });
   if (!statSync(signaturePath).isFile() || statSync(signaturePath).size < 1) throw new Error("detached release manifest signature is missing");
@@ -237,7 +239,7 @@ export function renderPowerShellBootstrap({
   };
   // Bind generated contract metadata so a caller cannot pass a marker plus an
   // arbitrary base64 payload and have it treated as a RightRelease bootstrap.
-  // This is not a replacement for CMS manifest signing; it is a structural
+  // This is not a replacement for manifest catalog signing; it is a structural
   // integrity fence for the executable bootstrap source itself.
   contract.contractSha256 = createHash("sha256").update(canonicalJson(contract)).digest("hex");
   const contractB64 = Buffer.from(JSON.stringify(contract)).toString("base64");
@@ -267,17 +269,18 @@ export function renderPowerShellBootstrap({
     "$ReleaseBase = " + psQuote("https://github.com/" + repository + "/releases/download/v") + " + $Version",
     "$Work = Join-Path ([IO.Path]::GetTempPath()) (" + psQuote(product + "-install-") + " + [guid]::NewGuid())",
     "New-Item -ItemType Directory -Force -Path $Work | Out-Null",
-    "$ManifestPath = Join-Path $Work 'release-manifest.json'; $SignaturePath = Join-Path $Work 'release-manifest.sig'; $ChecksumsPath = Join-Path $Work 'checksums.json'",
+    "$ManifestPath = Join-Path $Work 'release-manifest.json'; $SignaturePath = Join-Path $Work 'release-manifest.cat'; $ChecksumsPath = Join-Path $Work 'checksums.json'",
     "Invoke-WebRequest ($ReleaseBase + '/release-manifest.json') -OutFile $ManifestPath",
-    "Invoke-WebRequest ($ReleaseBase + '/release-manifest.sig') -OutFile $SignaturePath",
-    "$ManifestBytes = [IO.File]::ReadAllBytes($ManifestPath); $SignatureBytes = [IO.File]::ReadAllBytes($SignaturePath)",
-    "Add-Type -AssemblyName System.Security; $Cms = New-Object Security.Cryptography.Pkcs.SignedCms((New-Object Security.Cryptography.Pkcs.ContentInfo(,$ManifestBytes)), $true); $Cms.Decode($SignatureBytes); $Cms.CheckSignature($true)",
-    "if ($Cms.SignerInfos.Count -ne 1) { throw 'Release manifest signature is invalid' }; $SignerCertificate = $Cms.SignerInfos[0].Certificate",
+    "Invoke-WebRequest ($ReleaseBase + '/release-manifest.cat') -OutFile $SignaturePath",
+    "$ManifestBytes = [IO.File]::ReadAllBytes($ManifestPath); Import-Module Microsoft.PowerShell.Security -ErrorAction Stop",
+    "$Catalog = Test-FileCatalog -CatalogFilePath $SignaturePath -Path $ManifestPath -Detailed; if ([string]$Catalog.Status -ne 'Valid') { throw 'Release manifest catalog binding is invalid' }",
+    "$CatalogSignature = Get-AuthenticodeSignature -FilePath $SignaturePath; if ([string]$CatalogSignature.Status -ne 'Valid' -or -not $CatalogSignature.SignerCertificate) { throw 'Release manifest signature is invalid' }; $SignerCertificate = $CatalogSignature.SignerCertificate",
+    "$SignerSubject = 'CN=' + $SignerCertificate.GetNameInfo([Security.Cryptography.X509Certificates.X509NameType]::SimpleName, $false)",
     "$Sha256 = [Security.Cryptography.SHA256]::Create(); try { $SignerFingerprint = ([BitConverter]::ToString($Sha256.ComputeHash($SignerCertificate.RawData))).Replace('-','').ToLowerInvariant() } finally { $Sha256.Dispose() }",
-    "$VerifiedKeyId = $null; foreach ($KeyId in $AcceptedSigners.Keys) { $Accepted = $AcceptedSigners[$KeyId]; if ($SignerCertificate.Subject -eq [string]$Accepted.subject -and $SignerFingerprint -eq [string]$Accepted.certificateSha256) { $VerifiedKeyId = $KeyId; break } }",
+    "$VerifiedKeyId = $null; foreach ($KeyId in $AcceptedSigners.Keys) { $Accepted = $AcceptedSigners[$KeyId]; if ($SignerSubject -eq [string]$Accepted.subject -and $SignerFingerprint -eq [string]$Accepted.certificateSha256) { $VerifiedKeyId = $KeyId; break } }",
     "if (-not $VerifiedKeyId) { throw 'Release manifest signer is not accepted' }",
     "$Manifest = [Text.Encoding]::UTF8.GetString($ManifestBytes) | ConvertFrom-Json",
-    "if ($Manifest.signingKeyId -ne $VerifiedKeyId -or $Manifest.signatureAlgorithm -ne 'cms-sha256') { throw 'Release manifest signer identity mismatch' }",
+    "if ($Manifest.signingKeyId -ne $VerifiedKeyId -or $Manifest.signatureAlgorithm -ne 'authenticode-catalog-sha256' -or $Manifest.signatureProvider -ne 'windows-authenticode-catalog' -or $Manifest.signatureProviderVersion -ne 1) { throw 'Release manifest signer identity mismatch' }",
     "if ($Manifest.product -ne " + psQuote(product) + " -or $Manifest.version -ne $Version -or $Manifest.tag -ne ('v' + $Version)) { throw 'Release identity mismatch' }",
     "if ([version]$Contract.bootstrapVersion -lt [version]$Manifest.minimumBootstrapVersion) { throw 'Bootstrap update required' }",
     "$Machine = [Runtime.InteropServices.RuntimeInformation]::OSArchitecture.ToString(); $Target = if ($Machine -eq 'Arm64') { 'windows-arm64' } elseif ($Machine -eq 'X64') { 'windows-x86_64' } else { throw ('Unsupported architecture: ' + $Machine) }",
@@ -336,7 +339,8 @@ export function validatePowerShellBootstrap(script, expected = {}) {
     "# rightkit-direct-bootstrap:v1",
     "Release manifest signature is invalid",
     "certificateSha256",
-    "CheckSignature($true)",
+    "Test-FileCatalog",
+    "Get-AuthenticodeSignature",
     "checksums.json is not manifest-bound",
     "Provenance checksum mismatch",
     "SBOM checksum mismatch",

package/github-release.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { verifySealedRelease } from "./release-state.mjs";
 import { addonManifestSha256, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
-import { RIGHTRELEASE_MANIFEST_SIGNER, verifyDetachedCmsSignature } from "./sign-release-manifest.mjs";
+import { RIGHTRELEASE_MANIFEST_SIGNER, verifyManifestCatalogSignature } from "./sign-release-manifest.mjs";
 
 const REPO_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
 const RELEASE_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,159}$/;
@@ -68,9 +68,13 @@ export function prepareGitHubDirectRelease({
   signing,
   signingResult,
   signer,
-  cmsCommandRunner = spawnSync,
-  cmsPlatform = process.platform,
+  signatureCommandRunner,
+  signaturePlatform,
+  cmsCommandRunner,
+  cmsPlatform,
 }) {
+  const effectiveSignatureRunner = signatureCommandRunner ?? cmsCommandRunner ?? spawnSync;
+  const effectiveSignaturePlatform = signaturePlatform ?? cmsPlatform ?? process.platform;
   if (!REPO_RE.test(repo)) throw new Error(`invalid GitHub repository: ${repo}`);
   const root = path.resolve(repoRoot ?? process.cwd());
   const manifestFile = path.resolve(root, manifestPath);
@@ -84,7 +88,7 @@ export function prepareGitHubDirectRelease({
   if (product && manifest.product !== product) throw new Error("direct release product mismatch");
   if (version && manifest.version !== version) throw new Error("direct release version mismatch");
   if (!STABLE_SEMVER_RE.test(manifest.version) || manifest.tag !== `v${manifest.version}`) throw new Error("direct release manifest tag is invalid stable SemVer");
-  if (manifest.signingKeyId !== RIGHTRELEASE_MANIFEST_SIGNER.id || manifest.signatureAlgorithm !== RIGHTRELEASE_MANIFEST_SIGNER.algorithm) throw new Error("direct release manifest signer contract is invalid");
+  if (manifest.signingKeyId !== RIGHTRELEASE_MANIFEST_SIGNER.id || manifest.signatureAlgorithm !== RIGHTRELEASE_MANIFEST_SIGNER.algorithm || manifest.signatureProvider !== RIGHTRELEASE_MANIFEST_SIGNER.provider || manifest.signatureProviderVersion !== RIGHTRELEASE_MANIFEST_SIGNER.providerVersion) throw new Error("direct release manifest signer contract is invalid");
   const declared = new Set((manifest.assets ?? []).map((asset) => asset.name));
   if (!declared.size) throw new Error("direct release manifest has no archive assets");
   if ([...declared].some((name) => /(?:installer|setup)\.(?:exe|dmg|pkg|msi)$/i.test(name))) throw new Error("direct release must not contain installer assets");
@@ -103,7 +107,7 @@ export function prepareGitHubDirectRelease({
     if (unique.has(path.basename(file)) && unique.get(path.basename(file)) !== file) throw new Error(`duplicate direct release payload name: ${path.basename(file)}`);
     unique.set(path.basename(file), file);
   }
-  const requiredEvidence = ["release-manifest.json", "release-manifest.sig", "checksums.json"];
+  const requiredEvidence = ["release-manifest.json", "release-manifest.cat", "checksums.json"];
   for (const name of requiredEvidence) if (![...unique.keys()].some((candidate) => candidate === name || candidate.endsWith(`-${name}`))) throw new Error(`direct release payload missing ${name}`);
   for (const name of declared) if (!unique.has(name)) throw new Error(`direct release archive is not attached: ${name}`);
   const releaseState = stateRoot ?? path.join(root, ".right-release", "state", "direct", manifest.product, manifest.version, "github");
@@ -124,10 +128,10 @@ export function prepareGitHubDirectRelease({
     notesFile,
     manifestUrl: `https://github.com/${repo}/releases/download/${manifest.tag}/${path.basename(manifestFile)}`,
     signer: expectedSigner,
-    cmsPlatform,
+    signaturePlatform: effectiveSignaturePlatform,
   };
-  Object.defineProperty(plan, "cmsCommandRunner", { value: cmsCommandRunner, enumerable: false });
-  validateGitHubDirectReleasePlan(plan, { commandRunner: cmsCommandRunner, platform: cmsPlatform });
+  Object.defineProperty(plan, "signatureCommandRunner", { value: effectiveSignatureRunner, enumerable: false });
+  validateGitHubDirectReleasePlan(plan, { commandRunner: effectiveSignatureRunner, platform: effectiveSignaturePlatform });
   return plan;
 }
 
@@ -139,7 +143,7 @@ export const prepareGitHubManifestRelease = prepareGitHubDirectRelease;
  * signed manifest remains authority; checksums.json is only a digest-bound
  * convenience index for archives and attached provenance/SBOM evidence.
  */
-export function validateGitHubDirectReleasePlan(plan, { commandRunner = plan?.cmsCommandRunner ?? spawnSync, platform = plan?.cmsPlatform ?? process.platform } = {}) {
+export function validateGitHubDirectReleasePlan(plan, { commandRunner = plan?.signatureCommandRunner ?? plan?.cmsCommandRunner ?? spawnSync, platform = plan?.signaturePlatform ?? plan?.cmsPlatform ?? process.platform } = {}) {
   if (!plan || plan.kind !== "direct-release") throw new Error("invalid direct GitHub release plan");
   if (!plan.manifestPath || !plan.signaturePath || !plan.checksumsPath || !Array.isArray(plan.assets)) throw new Error("direct GitHub release plan is incomplete");
   const manifestFile = path.resolve(plan.manifestPath);
@@ -154,8 +158,8 @@ export function validateGitHubDirectReleasePlan(plan, { commandRunner = plan?.cm
     throw new Error("invalid direct release manifest");
   }
   if (plan.tag !== manifest.tag) throw new Error("direct GitHub release tag does not match manifest");
-  if (manifest.signingKeyId !== RIGHTRELEASE_MANIFEST_SIGNER.id || manifest.signatureAlgorithm !== RIGHTRELEASE_MANIFEST_SIGNER.algorithm) throw new Error("direct release manifest signer contract is invalid");
-  verifyDetachedCmsSignature({ manifestPath: manifestFile, signaturePath: signatureFile, expectedSigner: plan.signer, commandRunner, platform });
+  if (manifest.signingKeyId !== RIGHTRELEASE_MANIFEST_SIGNER.id || manifest.signatureAlgorithm !== RIGHTRELEASE_MANIFEST_SIGNER.algorithm || manifest.signatureProvider !== RIGHTRELEASE_MANIFEST_SIGNER.provider || manifest.signatureProviderVersion !== RIGHTRELEASE_MANIFEST_SIGNER.providerVersion) throw new Error("direct release manifest signer contract is invalid");
+  verifyManifestCatalogSignature({ manifestPath: manifestFile, signaturePath: signatureFile, expectedSigner: plan.signer, commandRunner, platform });
   if (!SHA256.test(manifest.checksumsSha256 ?? "")) throw new Error("direct release checksums digest is missing");
   if (sha256(checksumsFile) !== manifest.checksumsSha256) throw new Error("checksums.json is not manifest-bound");
   const checksums = JSON.parse(readFileSync(checksumsFile, "utf8"));
@@ -171,7 +175,7 @@ export function validateGitHubDirectReleasePlan(plan, { commandRunner = plan?.cm
     if (payloadByName.has(name) && payloadByName.get(name) !== file) throw new Error(`duplicate direct release payload name: ${name}`);
     payloadByName.set(name, file);
   }
-  const requiredEvidence = ["release-manifest.json", "release-manifest.sig", "checksums.json"];
+  const requiredEvidence = ["release-manifest.json", "release-manifest.cat", "checksums.json"];
   for (const name of requiredEvidence) if (![...payloadByName.keys()].some((candidate) => candidate === name || candidate.endsWith(`-${name}`))) throw new Error(`direct release payload missing ${name}`);
   for (const file of [manifestFile, signatureFile, checksumsFile]) if (![...payloadByName.values()].includes(file)) throw new Error(`direct release authority file is not attached: ${path.basename(file)}`);
   const expected = new Map();
@@ -232,8 +236,8 @@ export function prepareGitHubAddonRelease({ repoRoot, config, configRoot = repoR
   };
 }
 
-export function publishGitHubRelease(plan, { repo, dryRun = false, run = runCommand, cmsCommandRunner = plan?.cmsCommandRunner, cmsPlatform = plan?.cmsPlatform ?? process.platform } = {}) {
-  if (plan.kind === "direct-release") validateGitHubDirectReleasePlan(plan, { commandRunner: cmsCommandRunner ?? spawnSync, platform: cmsPlatform });
+export function publishGitHubRelease(plan, { repo, dryRun = false, run = runCommand, signatureCommandRunner = plan?.signatureCommandRunner ?? plan?.cmsCommandRunner, signaturePlatform = plan?.signaturePlatform ?? plan?.cmsPlatform ?? process.platform } = {}) {
+  if (plan.kind === "direct-release") validateGitHubDirectReleasePlan(plan, { commandRunner: signatureCommandRunner ?? spawnSync, platform: signaturePlatform });
   const visibility = JSON.parse(run("gh", ["repo", "view", repo, "--json", "visibility"]));
   if (visibility.visibility !== "PUBLIC" && !(plan.kind !== "addon" && visibility.visibility === "PRIVATE")) {
     throw new Error(`GitHub releases require a public or private repository: ${repo}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.72",
+  "version": "0.2.74",
   "description": "Portable Right Suite release CLI/SDK: signed native archives, direct bootstrap transactions, immutable GitHub Release upload, R2 bootstrap publication, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -29,6 +29,7 @@
   "scripts": {
     "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
     "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
+    "test:signer:windows": "node sign-release-manifest.integration.mjs",
     "doctor:all": "node --test right-suite-contract.test.mjs",
     "verify:standalone": "node standalone-clone-verify.mjs"
   }

package/registry-parity.mjs

@@ -39,6 +39,23 @@ export function comparePackedTrees(local, published) {
   return Object.freeze({ equal: false, differences: Object.freeze(differences) });
 }
 
+export function packedArchivePath(output) {
+  const parsed = typeof output === 'string' ? JSON.parse(output) : output;
+  const record = Array.isArray(parsed) ? parsed[0] : parsed;
+  if (typeof record?.filename !== 'string' || !record.filename.trim()) {
+    throw new Error('pnpm pack output omitted filename');
+  }
+  return record.filename;
+}
+
+function runPnpm(args, options = {}) {
+  const npmExecPath = process.env.npm_execpath;
+  if (typeof npmExecPath !== 'string' || !npmExecPath.trim()) {
+    throw new Error('registry parity must run through the pnpm package script');
+  }
+  return execFileSync(process.execPath, [npmExecPath, ...args], options);
+}
+
 async function extract(archive, destination) {
   await mkdir(destination, { recursive: true });
   execFileSync('tar', ['-xzf', archive, '-C', destination], { stdio: 'pipe' });
@@ -57,8 +74,8 @@ export async function verifyRegistryParity({ allowUnpublished = false, fetchImpl
   try {
     const localDir = join(root, 'local'); const publishedArchive = join(root, 'published.tgz');
     await mkdir(localDir, { recursive: true });
-    const packed = JSON.parse(execFileSync('pnpm', ['pack', '--pack-destination', localDir, '--json'], { cwd: packageRoot, encoding: 'utf8' }));
-    const localArchive = join(localDir, basename(packed[0]?.filename ?? ''));
+    const packed = runPnpm(['pack', '--pack-destination', localDir, '--json'], { cwd: packageRoot, encoding: 'utf8' });
+    const localArchive = join(localDir, basename(packedArchivePath(packed)));
     const response = await fetchImpl(record.dist.tarball);
     if (!response.ok) throw new Error(`registry tarball failed: HTTP ${response.status}`);
     await writeFile(publishedArchive, Buffer.from(await response.arrayBuffer()));

package/rightkit-versions.json

@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.72",
+    "@rightkit/release": "0.2.74",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },
@@ -70,7 +70,9 @@
       "0.2.68",
       "0.2.69",
       "0.2.70",
-      "0.2.71"
+      "0.2.71",
+      "0.2.72",
+      "0.2.73"
     ],
     "@rightkit/qa": [
       "0.1.0",

package/sign-release-manifest.integration.mjs

@@ -0,0 +1,27 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { RIGHTRELEASE_MANIFEST_SIGNER, signReleaseManifestWithAzure, verifyManifestCatalogSignature } from "./sign-release-manifest.mjs";
+
+if (process.platform !== "win32") throw new Error("protected manifest signer integration must run on Windows");
+
+const root = mkdtempSync(join(tmpdir(), "rightrelease-live-signer-"));
+const manifestPath = join(root, "release-manifest.json");
+const signaturePath = join(root, "release-manifest.cat");
+try {
+  writeFileSync(manifestPath, '{"kind":"rightrelease-live-signer-probe","schemaVersion":1}\n');
+  const signing = signReleaseManifestWithAzure({ manifestPath, signaturePath });
+  const verification = verifyManifestCatalogSignature({ manifestPath, signaturePath, expectedSigner: signing.signer });
+  assert.equal(verification.verified, true);
+  assert.equal(verification.signer.id, RIGHTRELEASE_MANIFEST_SIGNER.id);
+
+  writeFileSync(manifestPath, `${readFileSync(manifestPath, "utf8")}tampered\n`);
+  assert.throws(
+    () => verifyManifestCatalogSignature({ manifestPath, signaturePath, expectedSigner: signing.signer }),
+    /manifest catalog signature is invalid/,
+  );
+  process.stdout.write(`${JSON.stringify({ status: "PASS", provider: signing.signer.provider, providerVersion: signing.signer.providerVersion, algorithm: signing.signer.algorithm, subject: signing.signer.subject, certificateSha256: signing.signer.certificateSha256 })}\n`);
+} finally {
+  rmSync(root, { recursive: true, force: true });
+}

package/sign-release-manifest.mjs

@@ -1,13 +1,14 @@
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename, dirname, join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
 
 export const RIGHTRELEASE_MANIFEST_SIGNER = Object.freeze({
   id: "azure-artifact-signing-damned-ventures-v1",
   subject: "CN=Damned Ventures LLC",
-  algorithm: "cms-sha256",
+  algorithm: "authenticode-catalog-sha256",
+  provider: "windows-authenticode-catalog",
+  providerVersion: 1,
 });
 
 const EXCLUDE_CREDENTIALS = [
@@ -20,38 +21,30 @@ const EXCLUDE_CREDENTIALS = [
   "AzureDeveloperCliCredential",
   "InteractiveBrowserCredential",
 ];
-
 const CERTIFICATE_SHA256 = /^[a-f0-9]{64}$/i;
 
-/**
- * Verify detached CMS over exact manifest bytes & bind signer identity to the
- * shared Azure Artifact Signing result. `commandRunner` is an injectable
- * system-process seam; it cannot replace CMS verification because production
- * verification script/arguments are always issued here.
- */
-export function verifyDetachedCmsSignature({
+/** Verify Azure-signed catalog binding exact release-manifest bytes. */
+export function verifyManifestCatalogSignature({
   manifestPath,
   signaturePath,
   expectedSigner,
   commandRunner = spawnSync,
   platform = process.platform,
-  powershellPath = "powershell",
-  opensslPath = "openssl",
+  powershellPath = "pwsh",
 }) {
   const manifest = resolve(manifestPath);
   const signature = resolve(signaturePath);
-  if (!existsSync(manifest) || !statSync(manifest).isFile()) throw new Error("CMS manifest bytes are missing");
-  if (!existsSync(signature) || !statSync(signature).isFile() || statSync(signature).size < 1) throw new Error("detached CMS signature is missing");
-  if (!expectedSigner || expectedSigner.id !== RIGHTRELEASE_MANIFEST_SIGNER.id || expectedSigner.subject !== RIGHTRELEASE_MANIFEST_SIGNER.subject || expectedSigner.algorithm !== RIGHTRELEASE_MANIFEST_SIGNER.algorithm || !CERTIFICATE_SHA256.test(expectedSigner.certificateSha256 ?? "")) {
-    throw new Error("CMS verification requires exact Azure signer identity");
+  if (!existsSync(manifest) || !statSync(manifest).isFile()) throw new Error("manifest bytes are missing");
+  if (!existsSync(signature) || !statSync(signature).isFile() || statSync(signature).size < 1) throw new Error("detached manifest catalog signature is missing");
+  if (!expectedSigner || expectedSigner.id !== RIGHTRELEASE_MANIFEST_SIGNER.id || expectedSigner.subject !== RIGHTRELEASE_MANIFEST_SIGNER.subject || expectedSigner.algorithm !== RIGHTRELEASE_MANIFEST_SIGNER.algorithm || expectedSigner.provider !== RIGHTRELEASE_MANIFEST_SIGNER.provider || expectedSigner.providerVersion !== RIGHTRELEASE_MANIFEST_SIGNER.providerVersion || !CERTIFICATE_SHA256.test(expectedSigner.certificateSha256 ?? "")) {
+    throw new Error("catalog verification requires exact Azure signer identity");
   }
-  const inspection = platform === "win32"
-    ? verifyCmsWithPowerShell({ manifestPath: manifest, signaturePath: signature, commandRunner, powershellPath })
-    : verifyCmsWithOpenSsl({ manifestPath: manifest, signaturePath: signature, commandRunner, opensslPath });
-  if (!inspection.verified) throw new Error("detached CMS signature is invalid");
-  if (normalizeSubject(inspection.subject) !== normalizeSubject(expectedSigner.subject)) throw new Error("CMS signer subject mismatch");
+  if (platform !== "win32" && commandRunner === spawnSync) throw new Error("RightRelease catalog verification must run on Windows");
+  const inspection = inspectCatalog({ manifestPath: manifest, signaturePath: signature, commandRunner, powershellPath });
+  if (inspection.verified !== true || inspection.catalogStatus !== "Valid" || inspection.signatureStatus !== "Valid") throw new Error("manifest catalog signature is invalid");
+  if (normalizeSubject(inspection.subject) !== normalizeSubject(expectedSigner.subject)) throw new Error("catalog signer subject mismatch");
   const certificateSha256 = String(inspection.certificateSha256 ?? "").replaceAll(":", "").toLowerCase();
-  if (!CERTIFICATE_SHA256.test(certificateSha256) || certificateSha256 !== String(expectedSigner.certificateSha256).toLowerCase()) throw new Error("CMS signer certificate fingerprint mismatch");
+  if (!CERTIFICATE_SHA256.test(certificateSha256) || certificateSha256 !== String(expectedSigner.certificateSha256).toLowerCase()) throw new Error("catalog signer certificate fingerprint mismatch");
   return { verified: true, manifestPath: manifest, signaturePath: signature, signer: { ...expectedSigner, certificateSha256 } };
 }
 
@@ -63,17 +56,12 @@ export function signReleaseManifestWithAzure({
   signtoolPath,
   dlibPath,
   metadataPath,
+  powershellPath = "pwsh",
 }) {
-  if (process.platform !== "win32" && commandRunner === spawnSync) {
-    throw new Error("RightRelease manifest signing must run on protected Windows release host");
-  }
+  if (process.platform !== "win32" && commandRunner === spawnSync) throw new Error("RightRelease manifest signing must run on protected Windows release host");
   const userEnv = (name) => readUserEnvironment(name, commandRunner);
   const env = (name) => environment[name] || userEnv(name);
-  const signtool = signtoolPath || firstExisting([
-    env("AZURE_SIGNTOOL_PATH"),
-    env("SIGNTOOL_PATH"),
-    ...signtoolCandidates(env),
-  ]);
+  const signtool = signtoolPath || firstExisting([env("AZURE_SIGNTOOL_PATH"), env("SIGNTOOL_PATH"), ...signtoolCandidates(env)]);
   if (!signtool) throw new Error("RightRelease manifest signer could not find signtool.exe");
   const dlib = dlibPath || firstExisting([
     env("AZURE_CODESIGN_DLIB_PATH"),
@@ -86,99 +74,64 @@ export function signReleaseManifestWithAzure({
 
   const temp = mkdtempSync(join(tmpdir(), "rightrelease-manifest-sign-"));
   const metadata = metadataPath || materializeMetadata(temp, env);
-  const outputDir = join(temp, "signature");
-  mkdirSync(outputDir, { recursive: true });
+  const catalogDir = join(temp, "catalog");
+  mkdirSync(catalogDir, { recursive: true });
+  const catalog = join(catalogDir, "catalog.cat");
+  const generator = join(temp, "create-catalog.ps1");
+  writeFileSync(generator, [
+    "param([string]$ManifestPath, [string]$CatalogDirectory)",
+    "$ErrorActionPreference = 'Stop'",
+    "Import-Module Microsoft.PowerShell.Security -ErrorAction Stop",
+    "New-FileCatalog -Path $ManifestPath -CatalogFilePath $CatalogDirectory -CatalogVersion 2.0 | Out-Null",
+  ].join("\r\n") + "\r\n");
   try {
+    const generation = commandRunner(powershellPath, ["-NoProfile", "-File", generator, resolve(manifestPath), catalogDir], { encoding: "utf8", windowsHide: true, env: environment });
+    if (generation?.status !== 0) throw new Error(`RightRelease manifest catalog generation failed: ${String(generation?.stderr ?? "").trim()}`);
+    if (!existsSync(catalog) || !statSync(catalog).isFile()) throw new Error("RightRelease manifest catalog was not produced");
     const result = commandRunner(signtool, [
       "sign", "/v", "/fd", "SHA256", "/tr", "http://timestamp.acs.microsoft.com", "/td", "SHA256",
-      "/dlib", dlib, "/dmdf", metadata,
-      "/p7", outputDir, "/p7ce", "DetachedSignedData", "/p7co", "1.2.840.113549.1.7.1",
-      resolve(manifestPath),
+      "/dlib", dlib, "/dmdf", metadata, catalog,
     ], { encoding: "utf8", windowsHide: true, env: environment });
     if (result?.status !== 0) throw new Error(`RightRelease manifest signing failed: ${String(result?.stderr ?? "").trim()}`);
-    const generated = join(outputDir, `${basename(manifestPath)}.p7`);
-    if (!existsSync(generated)) throw new Error("RightRelease manifest signer did not produce detached CMS signature");
-    const inspector = join(temp, "inspect-signer.ps1");
-    writeFileSync(inspector, [
-      "param([string]$ManifestPath, [string]$SignaturePath)",
-      "Add-Type -AssemblyName System.Security",
-      "$Content = New-Object Security.Cryptography.Pkcs.ContentInfo(,[IO.File]::ReadAllBytes($ManifestPath))",
-      "$Cms = New-Object Security.Cryptography.Pkcs.SignedCms($Content, $true)",
-      "$Cms.Decode([IO.File]::ReadAllBytes($SignaturePath))",
-      "$Cms.CheckSignature($true)",
-      "if ($Cms.SignerInfos.Count -ne 1) { throw 'Expected exactly one manifest signer' }",
-      "$Certificate = $Cms.SignerInfos[0].Certificate",
-      "$Sha256 = [Security.Cryptography.SHA256]::Create()",
-      "try { $Fingerprint = ([BitConverter]::ToString($Sha256.ComputeHash($Certificate.RawData))).Replace('-','').ToLowerInvariant() } finally { $Sha256.Dispose() }",
-      "@{ subject=$Certificate.Subject; certificateSha256=$Fingerprint } | ConvertTo-Json -Compress",
-    ].join("\r\n") + "\r\n");
-    const inspection = commandRunner("powershell", ["-NoProfile", "-File", inspector, resolve(manifestPath), generated], { encoding: "utf8", windowsHide: true, env: environment });
-    if (inspection?.status !== 0) throw new Error(`RightRelease could not inspect manifest signer: ${String(inspection?.stderr ?? "").trim()}`);
-    let certificate;
-    try { certificate = JSON.parse(String(inspection.stdout ?? "").trim()); } catch { throw new Error("RightRelease manifest signer inspection returned invalid JSON"); }
-    if (certificate.subject !== RIGHTRELEASE_MANIFEST_SIGNER.subject || !/^[a-f0-9]{64}$/.test(certificate.certificateSha256 ?? "")) {
-      throw new Error("RightRelease manifest signer identity does not match protected Azure profile");
-    }
+    const inspection = inspectCatalog({ manifestPath: resolve(manifestPath), signaturePath: catalog, commandRunner, powershellPath, environment });
+    if (inspection.verified !== true || inspection.catalogStatus !== "Valid" || inspection.signatureStatus !== "Valid") throw new Error("RightRelease manifest catalog verification failed");
+    if (normalizeSubject(inspection.subject) !== normalizeSubject(RIGHTRELEASE_MANIFEST_SIGNER.subject) || !CERTIFICATE_SHA256.test(inspection.certificateSha256 ?? "")) throw new Error("RightRelease manifest signer identity does not match protected Azure profile");
     mkdirSync(dirname(signaturePath), { recursive: true });
-    writeFileSync(signaturePath, readFileSync(generated));
-    return { signaturePath: resolve(signaturePath), signer: { ...RIGHTRELEASE_MANIFEST_SIGNER, certificateSha256: certificate.certificateSha256 } };
+    copyFileSync(catalog, signaturePath);
+    return { signaturePath: resolve(signaturePath), signer: { ...RIGHTRELEASE_MANIFEST_SIGNER, certificateSha256: inspection.certificateSha256.toLowerCase() } };
   } finally {
     rmSync(temp, { recursive: true, force: true });
   }
 }
 
-function verifyCmsWithPowerShell({ manifestPath, signaturePath, commandRunner, powershellPath }) {
-  const temp = mkdtempSync(join(tmpdir(), "rightrelease-cms-verify-"));
-  const verifier = join(temp, "verify-cms.ps1");
+function inspectCatalog({ manifestPath, signaturePath, commandRunner, powershellPath, environment = process.env }) {
+  const temp = mkdtempSync(join(tmpdir(), "rightrelease-catalog-verify-"));
+  const verifier = join(temp, "verify-catalog.ps1");
   writeFileSync(verifier, [
     "param([string]$ManifestPath, [string]$SignaturePath)",
-    "Add-Type -AssemblyName System.Security",
-    "$Content = New-Object Security.Cryptography.Pkcs.ContentInfo(,[IO.File]::ReadAllBytes($ManifestPath))",
-    "$Cms = New-Object Security.Cryptography.Pkcs.SignedCms($Content, $true)",
-    "$Cms.Decode([IO.File]::ReadAllBytes($SignaturePath))",
-    "$Cms.CheckSignature($true)",
-    "if ($Cms.SignerInfos.Count -ne 1) { throw 'Expected exactly one manifest signer' }",
-    "$Certificate = $Cms.SignerInfos[0].Certificate",
+    "$ErrorActionPreference = 'Stop'",
+    "Import-Module Microsoft.PowerShell.Security -ErrorAction Stop",
+    "$Catalog = Test-FileCatalog -CatalogFilePath $SignaturePath -Path $ManifestPath -Detailed",
+    "$Signature = Get-AuthenticodeSignature -FilePath $SignaturePath",
+    "$Certificate = $Signature.SignerCertificate",
+    "if (-not $Certificate) { throw 'Catalog signer certificate is missing' }",
+    "$SimpleName = $Certificate.GetNameInfo([Security.Cryptography.X509Certificates.X509NameType]::SimpleName, $false)",
     "$Sha256 = [Security.Cryptography.SHA256]::Create()",
     "try { $Fingerprint = ([BitConverter]::ToString($Sha256.ComputeHash($Certificate.RawData))).Replace('-','').ToLowerInvariant() } finally { $Sha256.Dispose() }",
-    "@{ verified=$true; subject=$Certificate.Subject; certificateSha256=$Fingerprint } | ConvertTo-Json -Compress",
+    "@{ verified=([string]$Catalog.Status -eq 'Valid' -and [string]$Signature.Status -eq 'Valid'); catalogStatus=[string]$Catalog.Status; signatureStatus=[string]$Signature.Status; subject=('CN=' + $SimpleName); certificateSha256=$Fingerprint } | ConvertTo-Json -Compress",
   ].join("\r\n") + "\r\n");
   try {
-    const result = commandRunner(powershellPath, ["-NoProfile", "-File", verifier, manifestPath, signaturePath], { encoding: "utf8", windowsHide: true });
-    if (result?.status !== 0) throw new Error(`CMS signature verification failed: ${String(result?.stderr ?? "").trim()}`);
-    return parseCmsInspection(result?.stdout);
+    const result = commandRunner(powershellPath, ["-NoProfile", "-File", verifier, manifestPath, signaturePath], { encoding: "utf8", windowsHide: true, env: environment });
+    if (result?.status !== 0) throw new Error(`manifest catalog verification failed: ${String(result?.stderr ?? "").trim()}`);
+    let inspection;
+    try { inspection = JSON.parse(String(result?.stdout ?? "").trim()); } catch { throw new Error("catalog verifier returned invalid JSON"); }
+    if (typeof inspection.subject !== "string" || typeof inspection.certificateSha256 !== "string") throw new Error("catalog verifier returned incomplete identity");
+    return inspection;
   } finally {
     rmSync(temp, { recursive: true, force: true });
   }
 }
 
-function verifyCmsWithOpenSsl({ manifestPath, signaturePath, commandRunner, opensslPath }) {
-  const temp = mkdtempSync(join(tmpdir(), "rightrelease-cms-verify-"));
-  const verified = join(temp, "verified-manifest");
-  const certificate = join(temp, "signer.pem");
-  try {
-    const result = commandRunner(opensslPath, ["cms", "-verify", "-binary", "-inform", "DER", "-in", signaturePath, "-content", manifestPath, "-noverify", "-certsout", certificate, "-out", verified], { encoding: "utf8", windowsHide: true });
-    if (result?.status !== 0) throw new Error(`CMS signature verification failed: ${String(result?.stderr ?? "").trim()}`);
-    if (!existsSync(verified) || !readFileSync(verified).equals(readFileSync(manifestPath))) throw new Error("CMS signature content does not match manifest bytes");
-    if (!existsSync(certificate)) throw new Error("CMS signer certificate is missing");
-    const inspection = commandRunner(opensslPath, ["x509", "-in", certificate, "-noout", "-subject", "-fingerprint", "-sha256"], { encoding: "utf8", windowsHide: true });
-    if (inspection?.status !== 0) throw new Error(`CMS signer inspection failed: ${String(inspection?.stderr ?? "").trim()}`);
-    const output = String(inspection?.stdout ?? "");
-    const subject = output.match(/^\s*subject\s*=\s*(.+)$/im)?.[1]?.trim();
-    const certificateSha256 = output.match(/^\s*sha256\s+Fingerprint\s*=\s*([0-9a-f:]+)\s*$/im)?.[1];
-    return parseCmsInspection(JSON.stringify({ verified: true, subject, certificateSha256 }));
-  } finally {
-    rmSync(temp, { recursive: true, force: true });
-  }
-}
-
-function parseCmsInspection(output) {
-  let inspection;
-  try { inspection = JSON.parse(String(output ?? "").trim()); } catch { throw new Error("CMS verifier returned invalid JSON"); }
-  if (inspection.verified !== true || typeof inspection.subject !== "string" || typeof inspection.certificateSha256 !== "string") throw new Error("CMS verifier returned incomplete identity");
-  return inspection;
-}
-
 function normalizeSubject(subject) {
   return String(subject).trim().replace(/\s*=\s*/g, "=").replace(/\s*,\s*/g, ",");
 }
@@ -192,9 +145,7 @@ function materializeMetadata(dir, env) {
   const Endpoint = env("AZURE_ARTIFACT_SIGNING_ENDPOINT") || env("AZURE_SIGNING_ENDPOINT") || env("AZURE_ENDPOINT");
   const CodeSigningAccountName = env("AZURE_ARTIFACT_SIGNING_ACCOUNT") || env("AZURE_SIGNING_ACCOUNT_NAME") || env("AZURE_ACCOUNT");
   const CertificateProfileName = env("AZURE_ARTIFACT_SIGNING_PROFILE") || env("AZURE_CERTIFICATE_PROFILE_NAME") || env("AZURE_PROFILE");
-  if (!Endpoint || !CodeSigningAccountName || !CertificateProfileName) {
-    throw new Error("RightRelease manifest signer requires existing Azure Artifact Signing configuration");
-  }
+  if (!Endpoint || !CodeSigningAccountName || !CertificateProfileName) throw new Error("RightRelease manifest signer requires existing Azure Artifact Signing configuration");
   const path = join(dir, "metadata.json");
   writeFileSync(path, `${JSON.stringify({ Endpoint, CodeSigningAccountName, CertificateProfileName, ExcludeCredentials: EXCLUDE_CREDENTIALS }, null, 2)}\n`);
   return path;
@@ -215,9 +166,6 @@ function firstExisting(candidates) {
 }
 
 function readUserEnvironment(name, commandRunner) {
-  const result = commandRunner("powershell", ["-NoProfile", "-Command", `[Environment]::GetEnvironmentVariable('${name.replaceAll("'", "''")}','User')`], {
-    encoding: "utf8",
-    windowsHide: true,
-  });
+  const result = commandRunner("powershell", ["-NoProfile", "-Command", `[Environment]::GetEnvironmentVariable('${name.replaceAll("'", "''")}','User')`], { encoding: "utf8", windowsHide: true });
   return result?.status === 0 ? String(result.stdout ?? "").trim() : "";
 }