@rightkit/release 0.2.73 → 0.2.75

package/direct-bootstrap.mjs

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
-import { RIGHTRELEASE_MANIFEST_SIGNER, signReleaseManifestWithAzure } from "./sign-release-manifest.mjs";
+import { RIGHTRELEASE_MANIFEST_SIGNER, signReleaseManifestCatalogWithAzure } from "./sign-release-manifest.mjs";
 import { validateCycloneDxSbom, validateInTotoSlsaProvenance } from "./supply-chain-evidence.mjs";
 
 const SHA256 = /^[a-f0-9]{64}$/;
@@ -162,14 +162,14 @@ export function materializeDirectRelease({ outputDir, manifestInput }) {
   });
   const manifestText = `${canonicalJson(manifest)}\n`;
   const manifestPath = join(outputDir, "release-manifest.json");
-  const signaturePath = join(outputDir, "release-manifest.sig");
+  const catalogPath = join(outputDir, "release-manifest.cat");
   writeFileSync(manifestPath, manifestText);
-  const signing = signReleaseManifestWithAzure({ manifestPath, signaturePath });
-  if (!statSync(signaturePath).isFile() || statSync(signaturePath).size < 1) throw new Error("detached release manifest signature is missing");
+  const signing = signReleaseManifestCatalogWithAzure({ manifestPath, catalogPath });
+  if (!statSync(catalogPath).isFile() || statSync(catalogPath).size < 1) throw new Error("release manifest catalog is missing");
   if (signing?.signer?.id !== RIGHTRELEASE_MANIFEST_SIGNER.id || signing.signer.subject !== RIGHTRELEASE_MANIFEST_SIGNER.subject || !/^[a-f0-9]{64}$/.test(signing.signer.certificateSha256 ?? "")) {
-    throw new Error("detached release manifest signer is not RightRelease Azure authority");
+    throw new Error("release manifest catalog signer is not RightRelease Azure authority");
   }
-  return { manifest, manifestPath, signaturePath, signing, checksums };
+  return { manifest, manifestPath, catalogPath, signaturePath: catalogPath, signing, checksums };
 }
 
 function psQuote(value) {
@@ -237,8 +237,7 @@ export function renderPowerShellBootstrap({
   };
   // Bind generated contract metadata so a caller cannot pass a marker plus an
   // arbitrary base64 payload and have it treated as a RightRelease bootstrap.
-  // This is not a replacement for CMS manifest signing; it is a structural
-  // integrity fence for the executable bootstrap source itself.
+  // This is a structural integrity fence for the executable bootstrap source itself.
   contract.contractSha256 = createHash("sha256").update(canonicalJson(contract)).digest("hex");
   const contractB64 = Buffer.from(JSON.stringify(contract)).toString("base64");
   const lines = [
@@ -267,17 +266,18 @@ export function renderPowerShellBootstrap({
     "$ReleaseBase = " + psQuote("https://github.com/" + repository + "/releases/download/v") + " + $Version",
     "$Work = Join-Path ([IO.Path]::GetTempPath()) (" + psQuote(product + "-install-") + " + [guid]::NewGuid())",
     "New-Item -ItemType Directory -Force -Path $Work | Out-Null",
-    "$ManifestPath = Join-Path $Work 'release-manifest.json'; $SignaturePath = Join-Path $Work 'release-manifest.sig'; $ChecksumsPath = Join-Path $Work 'checksums.json'",
+    "$ManifestPath = Join-Path $Work 'release-manifest.json'; $CatalogPath = Join-Path $Work 'release-manifest.cat'; $ChecksumsPath = Join-Path $Work 'checksums.json'",
     "Invoke-WebRequest ($ReleaseBase + '/release-manifest.json') -OutFile $ManifestPath",
-    "Invoke-WebRequest ($ReleaseBase + '/release-manifest.sig') -OutFile $SignaturePath",
-    "$ManifestBytes = [IO.File]::ReadAllBytes($ManifestPath); $SignatureBytes = [IO.File]::ReadAllBytes($SignaturePath)",
-    "Add-Type -AssemblyName System.Security; $Cms = New-Object Security.Cryptography.Pkcs.SignedCms((New-Object Security.Cryptography.Pkcs.ContentInfo(,$ManifestBytes)), $true); $Cms.Decode($SignatureBytes); $Cms.CheckSignature($true)",
-    "if ($Cms.SignerInfos.Count -ne 1) { throw 'Release manifest signature is invalid' }; $SignerCertificate = $Cms.SignerInfos[0].Certificate",
+    "Invoke-WebRequest ($ReleaseBase + '/release-manifest.cat') -OutFile $CatalogPath",
+    "$ManifestBytes = [IO.File]::ReadAllBytes($ManifestPath)",
+    "$CatalogSignature = Get-AuthenticodeSignature -FilePath $CatalogPath; if ($CatalogSignature.Status -ne 'Valid' -or $null -eq $CatalogSignature.SignerCertificate) { throw 'Release manifest catalog signature is invalid' }; $SignerCertificate = $CatalogSignature.SignerCertificate",
+    "$ManifestCatalogRoot = Join-Path $Work 'manifest-catalog'; New-Item -ItemType Directory -Force -Path $ManifestCatalogRoot | Out-Null; Copy-Item -LiteralPath $ManifestPath -Destination (Join-Path $ManifestCatalogRoot 'release-manifest.json')",
+    "$CatalogValidation = Test-FileCatalog -Path $ManifestCatalogRoot -CatalogFilePath $CatalogPath; if ([string]$CatalogValidation -ne 'Valid') { throw 'Release manifest catalog does not bind exact bytes' }",
     "$Sha256 = [Security.Cryptography.SHA256]::Create(); try { $SignerFingerprint = ([BitConverter]::ToString($Sha256.ComputeHash($SignerCertificate.RawData))).Replace('-','').ToLowerInvariant() } finally { $Sha256.Dispose() }",
     "$VerifiedKeyId = $null; foreach ($KeyId in $AcceptedSigners.Keys) { $Accepted = $AcceptedSigners[$KeyId]; if ($SignerCertificate.Subject -eq [string]$Accepted.subject -and $SignerFingerprint -eq [string]$Accepted.certificateSha256) { $VerifiedKeyId = $KeyId; break } }",
     "if (-not $VerifiedKeyId) { throw 'Release manifest signer is not accepted' }",
     "$Manifest = [Text.Encoding]::UTF8.GetString($ManifestBytes) | ConvertFrom-Json",
-    "if ($Manifest.signingKeyId -ne $VerifiedKeyId -or $Manifest.signatureAlgorithm -ne 'cms-sha256') { throw 'Release manifest signer identity mismatch' }",
+    "if ($Manifest.signingKeyId -ne $VerifiedKeyId -or $Manifest.signatureAlgorithm -ne 'authenticode-catalog-sha256') { throw 'Release manifest signer identity mismatch' }",
     "if ($Manifest.product -ne " + psQuote(product) + " -or $Manifest.version -ne $Version -or $Manifest.tag -ne ('v' + $Version)) { throw 'Release identity mismatch' }",
     "if ([version]$Contract.bootstrapVersion -lt [version]$Manifest.minimumBootstrapVersion) { throw 'Bootstrap update required' }",
     "$Machine = [Runtime.InteropServices.RuntimeInformation]::OSArchitecture.ToString(); $Target = if ($Machine -eq 'Arm64') { 'windows-arm64' } elseif ($Machine -eq 'X64') { 'windows-x86_64' } else { throw ('Unsupported architecture: ' + $Machine) }",
@@ -334,9 +334,9 @@ export function renderPowerShellBootstrap({
 export function validatePowerShellBootstrap(script, expected = {}) {
   const required = [
     "# rightkit-direct-bootstrap:v1",
-    "Release manifest signature is invalid",
+    "Release manifest catalog signature is invalid",
     "certificateSha256",
-    "CheckSignature($true)",
+    "Test-FileCatalog",
     "checksums.json is not manifest-bound",
     "Provenance checksum mismatch",
     "SBOM checksum mismatch",

package/github-release.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { verifySealedRelease } from "./release-state.mjs";
 import { addonManifestSha256, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
-import { RIGHTRELEASE_MANIFEST_SIGNER, verifyDetachedCmsSignature } from "./sign-release-manifest.mjs";
+import { RIGHTRELEASE_MANIFEST_SIGNER, verifyReleaseManifestCatalog } from "./sign-release-manifest.mjs";
 
 const REPO_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
 const RELEASE_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,159}$/;
@@ -68,8 +68,8 @@ export function prepareGitHubDirectRelease({
   signing,
   signingResult,
   signer,
-  cmsCommandRunner = spawnSync,
-  cmsPlatform = process.platform,
+  catalogCommandRunner = spawnSync,
+  catalogPlatform = process.platform,
 }) {
   if (!REPO_RE.test(repo)) throw new Error(`invalid GitHub repository: ${repo}`);
   const root = path.resolve(repoRoot ?? process.cwd());
@@ -103,7 +103,7 @@ export function prepareGitHubDirectRelease({
     if (unique.has(path.basename(file)) && unique.get(path.basename(file)) !== file) throw new Error(`duplicate direct release payload name: ${path.basename(file)}`);
     unique.set(path.basename(file), file);
   }
-  const requiredEvidence = ["release-manifest.json", "release-manifest.sig", "checksums.json"];
+  const requiredEvidence = ["release-manifest.json", "release-manifest.cat", "checksums.json"];
   for (const name of requiredEvidence) if (![...unique.keys()].some((candidate) => candidate === name || candidate.endsWith(`-${name}`))) throw new Error(`direct release payload missing ${name}`);
   for (const name of declared) if (!unique.has(name)) throw new Error(`direct release archive is not attached: ${name}`);
   const releaseState = stateRoot ?? path.join(root, ".right-release", "state", "direct", manifest.product, manifest.version, "github");
@@ -124,10 +124,10 @@ export function prepareGitHubDirectRelease({
     notesFile,
     manifestUrl: `https://github.com/${repo}/releases/download/${manifest.tag}/${path.basename(manifestFile)}`,
     signer: expectedSigner,
-    cmsPlatform,
+    catalogPlatform,
   };
-  Object.defineProperty(plan, "cmsCommandRunner", { value: cmsCommandRunner, enumerable: false });
-  validateGitHubDirectReleasePlan(plan, { commandRunner: cmsCommandRunner, platform: cmsPlatform });
+  Object.defineProperty(plan, "catalogCommandRunner", { value: catalogCommandRunner, enumerable: false });
+  validateGitHubDirectReleasePlan(plan, { commandRunner: catalogCommandRunner, platform: catalogPlatform });
   return plan;
 }
 
@@ -139,7 +139,7 @@ export const prepareGitHubManifestRelease = prepareGitHubDirectRelease;
  * signed manifest remains authority; checksums.json is only a digest-bound
  * convenience index for archives and attached provenance/SBOM evidence.
  */
-export function validateGitHubDirectReleasePlan(plan, { commandRunner = plan?.cmsCommandRunner ?? spawnSync, platform = plan?.cmsPlatform ?? process.platform } = {}) {
+export function validateGitHubDirectReleasePlan(plan, { commandRunner = plan?.catalogCommandRunner ?? spawnSync, platform = plan?.catalogPlatform ?? process.platform } = {}) {
   if (!plan || plan.kind !== "direct-release") throw new Error("invalid direct GitHub release plan");
   if (!plan.manifestPath || !plan.signaturePath || !plan.checksumsPath || !Array.isArray(plan.assets)) throw new Error("direct GitHub release plan is incomplete");
   const manifestFile = path.resolve(plan.manifestPath);
@@ -148,14 +148,14 @@ export function validateGitHubDirectReleasePlan(plan, { commandRunner = plan?.cm
   for (const file of [manifestFile, signatureFile, checksumsFile]) {
     if (!existsSync(file) || !statSync(file).isFile()) throw new Error(`direct release payload missing: ${file}`);
   }
-  if (statSync(signatureFile).size < 1) throw new Error("detached release manifest signature is missing");
+  if (statSync(signatureFile).size < 1) throw new Error("release manifest catalog is missing");
   const manifest = JSON.parse(readFileSync(manifestFile, "utf8"));
   if (manifest.schemaVersion !== 1 || manifest.kind !== "rightkit-direct-release-manifest" || !STABLE_SEMVER_RE.test(manifest.version ?? "") || manifest.tag !== `v${manifest.version}`) {
     throw new Error("invalid direct release manifest");
   }
   if (plan.tag !== manifest.tag) throw new Error("direct GitHub release tag does not match manifest");
   if (manifest.signingKeyId !== RIGHTRELEASE_MANIFEST_SIGNER.id || manifest.signatureAlgorithm !== RIGHTRELEASE_MANIFEST_SIGNER.algorithm) throw new Error("direct release manifest signer contract is invalid");
-  verifyDetachedCmsSignature({ manifestPath: manifestFile, signaturePath: signatureFile, expectedSigner: plan.signer, commandRunner, platform });
+  verifyReleaseManifestCatalog({ manifestPath: manifestFile, catalogPath: signatureFile, expectedSigner: plan.signer, commandRunner, platform });
   if (!SHA256.test(manifest.checksumsSha256 ?? "")) throw new Error("direct release checksums digest is missing");
   if (sha256(checksumsFile) !== manifest.checksumsSha256) throw new Error("checksums.json is not manifest-bound");
   const checksums = JSON.parse(readFileSync(checksumsFile, "utf8"));
@@ -171,7 +171,7 @@ export function validateGitHubDirectReleasePlan(plan, { commandRunner = plan?.cm
     if (payloadByName.has(name) && payloadByName.get(name) !== file) throw new Error(`duplicate direct release payload name: ${name}`);
     payloadByName.set(name, file);
   }
-  const requiredEvidence = ["release-manifest.json", "release-manifest.sig", "checksums.json"];
+  const requiredEvidence = ["release-manifest.json", "release-manifest.cat", "checksums.json"];
   for (const name of requiredEvidence) if (![...payloadByName.keys()].some((candidate) => candidate === name || candidate.endsWith(`-${name}`))) throw new Error(`direct release payload missing ${name}`);
   for (const file of [manifestFile, signatureFile, checksumsFile]) if (![...payloadByName.values()].includes(file)) throw new Error(`direct release authority file is not attached: ${path.basename(file)}`);
   const expected = new Map();
@@ -232,8 +232,8 @@ export function prepareGitHubAddonRelease({ repoRoot, config, configRoot = repoR
   };
 }
 
-export function publishGitHubRelease(plan, { repo, dryRun = false, run = runCommand, cmsCommandRunner = plan?.cmsCommandRunner, cmsPlatform = plan?.cmsPlatform ?? process.platform } = {}) {
-  if (plan.kind === "direct-release") validateGitHubDirectReleasePlan(plan, { commandRunner: cmsCommandRunner ?? spawnSync, platform: cmsPlatform });
+export function publishGitHubRelease(plan, { repo, dryRun = false, run = runCommand, catalogCommandRunner = plan?.catalogCommandRunner, catalogPlatform = plan?.catalogPlatform ?? process.platform } = {}) {
+  if (plan.kind === "direct-release") validateGitHubDirectReleasePlan(plan, { commandRunner: catalogCommandRunner ?? spawnSync, platform: catalogPlatform });
   const visibility = JSON.parse(run("gh", ["repo", "view", repo, "--json", "visibility"]));
   if (visibility.visibility !== "PUBLIC" && !(plan.kind !== "addon" && visibility.visibility === "PRIVATE")) {
     throw new Error(`GitHub releases require a public or private repository: ${repo}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.73",
+  "version": "0.2.75",
   "description": "Portable Right Suite release CLI/SDK: signed native archives, direct bootstrap transactions, immutable GitHub Release upload, R2 bootstrap publication, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/rightkit-versions.json

@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.73",
+    "@rightkit/release": "0.2.75",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },
@@ -71,7 +71,9 @@
       "0.2.69",
       "0.2.70",
       "0.2.71",
-      "0.2.72"
+      "0.2.72",
+      "0.2.73",
+      "0.2.74"
     ],
     "@rightkit/qa": [
       "0.1.0",

package/sign-release-manifest.mjs

@@ -1,13 +1,15 @@
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename, dirname, join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 
 export const RIGHTRELEASE_MANIFEST_SIGNER = Object.freeze({
   id: "azure-artifact-signing-damned-ventures-v1",
-  subject: "CN=Damned Ventures LLC",
-  algorithm: "cms-sha256",
+  subject: "CN=Damned Ventures LLC, O=Damned Ventures LLC, L=new york, S=New York, C=US",
+  algorithm: "authenticode-catalog-sha256",
+  provider: "windows-authenticode-catalog",
+  providerVersion: 1,
 });
 
 const EXCLUDE_CREDENTIALS = [
@@ -23,41 +25,33 @@ const EXCLUDE_CREDENTIALS = [
 
 const CERTIFICATE_SHA256 = /^[a-f0-9]{64}$/i;
 
-/**
- * Verify detached CMS over exact manifest bytes & bind signer identity to the
- * shared Azure Artifact Signing result. `commandRunner` is an injectable
- * system-process seam; it cannot replace CMS verification because production
- * verification script/arguments are always issued here.
- */
-export function verifyDetachedCmsSignature({
+export function verifyReleaseManifestCatalog({
   manifestPath,
-  signaturePath,
+  catalogPath,
   expectedSigner,
   commandRunner = spawnSync,
   platform = process.platform,
   powershellPath = "powershell",
-  opensslPath = "openssl",
 }) {
   const manifest = resolve(manifestPath);
-  const signature = resolve(signaturePath);
-  if (!existsSync(manifest) || !statSync(manifest).isFile()) throw new Error("CMS manifest bytes are missing");
-  if (!existsSync(signature) || !statSync(signature).isFile() || statSync(signature).size < 1) throw new Error("detached CMS signature is missing");
+  const catalog = resolve(catalogPath);
+  if (platform !== "win32") throw new Error("Authenticode catalog verification requires Windows");
+  if (!existsSync(manifest) || !statSync(manifest).isFile()) throw new Error("catalog manifest bytes are missing");
+  if (!existsSync(catalog) || !statSync(catalog).isFile() || statSync(catalog).size < 1) throw new Error("release manifest catalog is missing");
   if (!expectedSigner || expectedSigner.id !== RIGHTRELEASE_MANIFEST_SIGNER.id || expectedSigner.subject !== RIGHTRELEASE_MANIFEST_SIGNER.subject || expectedSigner.algorithm !== RIGHTRELEASE_MANIFEST_SIGNER.algorithm || !CERTIFICATE_SHA256.test(expectedSigner.certificateSha256 ?? "")) {
-    throw new Error("CMS verification requires exact Azure signer identity");
+    throw new Error("catalog verification requires exact Azure signer identity");
   }
-  const inspection = platform === "win32"
-    ? verifyCmsWithPowerShell({ manifestPath: manifest, signaturePath: signature, commandRunner, powershellPath })
-    : verifyCmsWithOpenSsl({ manifestPath: manifest, signaturePath: signature, commandRunner, opensslPath });
-  if (!inspection.verified) throw new Error("detached CMS signature is invalid");
-  if (normalizeSubject(inspection.subject) !== normalizeSubject(expectedSigner.subject)) throw new Error("CMS signer subject mismatch");
+  const inspection = verifyCatalogWithPowerShell({ manifestPath: manifest, catalogPath: catalog, commandRunner, powershellPath });
+  if (!inspection.verified) throw new Error("release manifest catalog is invalid");
+  if (normalizeSubject(inspection.subject) !== normalizeSubject(expectedSigner.subject)) throw new Error("catalog signer subject mismatch");
   const certificateSha256 = String(inspection.certificateSha256 ?? "").replaceAll(":", "").toLowerCase();
-  if (!CERTIFICATE_SHA256.test(certificateSha256) || certificateSha256 !== String(expectedSigner.certificateSha256).toLowerCase()) throw new Error("CMS signer certificate fingerprint mismatch");
-  return { verified: true, manifestPath: manifest, signaturePath: signature, signer: { ...expectedSigner, certificateSha256 } };
+  if (!CERTIFICATE_SHA256.test(certificateSha256) || certificateSha256 !== String(expectedSigner.certificateSha256).toLowerCase()) throw new Error("catalog signer certificate fingerprint mismatch");
+  return { verified: true, manifestPath: manifest, catalogPath: catalog, signer: { ...expectedSigner, certificateSha256 } };
 }
 
-export function signReleaseManifestWithAzure({
+export function signReleaseManifestCatalogWithAzure({
   manifestPath,
-  signaturePath,
+  catalogPath,
   commandRunner = spawnSync,
   environment = process.env,
   signtoolPath,
@@ -84,98 +78,70 @@ export function signReleaseManifestWithAzure({
   ]);
   if (!dlib) throw new Error("RightRelease manifest signer could not find Azure Artifact Signing dlib");
 
-  const temp = mkdtempSync(join(tmpdir(), "rightrelease-manifest-sign-"));
+  const temp = mkdtempSync(join(tmpdir(), "rightrelease-manifest-catalog-"));
+  const powershellEnvironment = windowsPowerShellEnvironment(environment);
   const metadata = metadataPath || materializeMetadata(temp, env);
-  const outputDir = join(temp, "signature");
-  mkdirSync(outputDir, { recursive: true });
+  const catalogSource = join(temp, "catalog-source");
+  const unsignedCatalog = join(temp, "release-manifest.cat");
+  mkdirSync(catalogSource, { recursive: true });
+  copyFileSync(resolve(manifestPath), join(catalogSource, "release-manifest.json"));
   try {
+    const materializer = join(temp, "new-catalog.ps1");
+    writeFileSync(materializer, [
+      "param([string]$SourcePath, [string]$CatalogPath)",
+      "Import-Module Microsoft.PowerShell.Security -ErrorAction Stop",
+      "$Result = New-FileCatalog -Path $SourcePath -CatalogFilePath $CatalogPath -CatalogVersion 2.0",
+      "if (-not (Test-Path $Result)) { throw 'Manifest catalog was not created' }",
+    ].join("\r\n") + "\r\n");
+    const created = commandRunner("powershell", ["-NoProfile", "-File", materializer, catalogSource, unsignedCatalog], { encoding: "utf8", windowsHide: true, env: powershellEnvironment });
+    if (created?.status !== 0 || !existsSync(unsignedCatalog)) throw new Error(`RightRelease manifest catalog creation failed: ${String(created?.stderr ?? "").trim()}`);
     const result = commandRunner(signtool, [
       "sign", "/v", "/fd", "SHA256", "/tr", "http://timestamp.acs.microsoft.com", "/td", "SHA256",
       "/dlib", dlib, "/dmdf", metadata,
-      "/p7", outputDir, "/p7ce", "DetachedSignedData", "/p7co", "1.2.840.113549.1.7.1",
-      resolve(manifestPath),
+      unsignedCatalog,
     ], { encoding: "utf8", windowsHide: true, env: environment });
-    if (result?.status !== 0) throw new Error(`RightRelease manifest signing failed: ${String(result?.stderr ?? "").trim()}`);
-    const generated = join(outputDir, `${basename(manifestPath)}.p7`);
-    if (!existsSync(generated)) throw new Error("RightRelease manifest signer did not produce detached CMS signature");
-    const inspector = join(temp, "inspect-signer.ps1");
-    writeFileSync(inspector, [
-      "param([string]$ManifestPath, [string]$SignaturePath)",
-      "Add-Type -AssemblyName System.Security",
-      "$Content = New-Object Security.Cryptography.Pkcs.ContentInfo(,[IO.File]::ReadAllBytes($ManifestPath))",
-      "$Cms = New-Object Security.Cryptography.Pkcs.SignedCms($Content, $true)",
-      "$Cms.Decode([IO.File]::ReadAllBytes($SignaturePath))",
-      "$Cms.CheckSignature($true)",
-      "if ($Cms.SignerInfos.Count -ne 1) { throw 'Expected exactly one manifest signer' }",
-      "$Certificate = $Cms.SignerInfos[0].Certificate",
-      "$Sha256 = [Security.Cryptography.SHA256]::Create()",
-      "try { $Fingerprint = ([BitConverter]::ToString($Sha256.ComputeHash($Certificate.RawData))).Replace('-','').ToLowerInvariant() } finally { $Sha256.Dispose() }",
-      "@{ subject=$Certificate.Subject; certificateSha256=$Fingerprint } | ConvertTo-Json -Compress",
-    ].join("\r\n") + "\r\n");
-    const inspection = commandRunner("powershell", ["-NoProfile", "-File", inspector, resolve(manifestPath), generated], { encoding: "utf8", windowsHide: true, env: environment });
-    if (inspection?.status !== 0) throw new Error(`RightRelease could not inspect manifest signer: ${String(inspection?.stderr ?? "").trim()}`);
-    let certificate;
-    try { certificate = JSON.parse(String(inspection.stdout ?? "").trim()); } catch { throw new Error("RightRelease manifest signer inspection returned invalid JSON"); }
-    if (certificate.subject !== RIGHTRELEASE_MANIFEST_SIGNER.subject || !/^[a-f0-9]{64}$/.test(certificate.certificateSha256 ?? "")) {
-      throw new Error("RightRelease manifest signer identity does not match protected Azure profile");
-    }
-    mkdirSync(dirname(signaturePath), { recursive: true });
-    writeFileSync(signaturePath, readFileSync(generated));
-    return { signaturePath: resolve(signaturePath), signer: { ...RIGHTRELEASE_MANIFEST_SIGNER, certificateSha256: certificate.certificateSha256 } };
+    if (result?.status !== 0) throw new Error(`RightRelease manifest catalog signing failed: ${String(result?.stderr ?? "").trim()}`);
+    const inspection = verifyCatalogWithPowerShell({ manifestPath: resolve(manifestPath), catalogPath: unsignedCatalog, commandRunner, powershellPath: "powershell", environment: powershellEnvironment });
+    if (normalizeSubject(inspection.subject) !== normalizeSubject(RIGHTRELEASE_MANIFEST_SIGNER.subject) || !CERTIFICATE_SHA256.test(inspection.certificateSha256 ?? "")) throw new Error(`RightRelease catalog signer identity does not match protected Azure profile: ${inspection.subject}`);
+    mkdirSync(dirname(catalogPath), { recursive: true });
+    copyFileSync(unsignedCatalog, catalogPath);
+    return { catalogPath: resolve(catalogPath), signer: { ...RIGHTRELEASE_MANIFEST_SIGNER, certificateSha256: inspection.certificateSha256.toLowerCase() } };
   } finally {
     rmSync(temp, { recursive: true, force: true });
   }
 }
 
-function verifyCmsWithPowerShell({ manifestPath, signaturePath, commandRunner, powershellPath }) {
-  const temp = mkdtempSync(join(tmpdir(), "rightrelease-cms-verify-"));
-  const verifier = join(temp, "verify-cms.ps1");
+function verifyCatalogWithPowerShell({ manifestPath, catalogPath, commandRunner, powershellPath, environment = process.env }) {
+  const temp = mkdtempSync(join(tmpdir(), "rightrelease-catalog-verify-"));
+  const source = join(temp, "catalog-source");
+  mkdirSync(source, { recursive: true });
+  copyFileSync(manifestPath, join(source, "release-manifest.json"));
+  const verifier = join(temp, "verify-catalog.ps1");
   writeFileSync(verifier, [
-    "param([string]$ManifestPath, [string]$SignaturePath)",
-    "Add-Type -AssemblyName System.Security",
-    "$Content = New-Object Security.Cryptography.Pkcs.ContentInfo(,[IO.File]::ReadAllBytes($ManifestPath))",
-    "$Cms = New-Object Security.Cryptography.Pkcs.SignedCms($Content, $true)",
-    "$Cms.Decode([IO.File]::ReadAllBytes($SignaturePath))",
-    "$Cms.CheckSignature($true)",
-    "if ($Cms.SignerInfos.Count -ne 1) { throw 'Expected exactly one manifest signer' }",
-    "$Certificate = $Cms.SignerInfos[0].Certificate",
+    "param([string]$SourcePath, [string]$CatalogPath)",
+    "Import-Module Microsoft.PowerShell.Security -ErrorAction Stop",
+    "$Signature = Get-AuthenticodeSignature -FilePath $CatalogPath",
+    "if ($Signature.Status -ne 'Valid' -or $null -eq $Signature.SignerCertificate) { throw 'Catalog Authenticode signature is invalid' }",
+    "$Validation = Test-FileCatalog -Path $SourcePath -CatalogFilePath $CatalogPath",
+    "if ([string]$Validation -ne 'Valid') { throw 'Catalog does not bind exact manifest bytes' }",
+    "$Certificate = $Signature.SignerCertificate",
     "$Sha256 = [Security.Cryptography.SHA256]::Create()",
     "try { $Fingerprint = ([BitConverter]::ToString($Sha256.ComputeHash($Certificate.RawData))).Replace('-','').ToLowerInvariant() } finally { $Sha256.Dispose() }",
     "@{ verified=$true; subject=$Certificate.Subject; certificateSha256=$Fingerprint } | ConvertTo-Json -Compress",
   ].join("\r\n") + "\r\n");
   try {
-    const result = commandRunner(powershellPath, ["-NoProfile", "-File", verifier, manifestPath, signaturePath], { encoding: "utf8", windowsHide: true });
-    if (result?.status !== 0) throw new Error(`CMS signature verification failed: ${String(result?.stderr ?? "").trim()}`);
-    return parseCmsInspection(result?.stdout);
+    const result = commandRunner(powershellPath, ["-NoProfile", "-File", verifier, source, catalogPath], { encoding: "utf8", windowsHide: true, env: windowsPowerShellEnvironment(environment) });
+    if (result?.status !== 0) throw new Error(`catalog verification failed: ${String(result?.stderr ?? "").trim()}`);
+    return parseCatalogInspection(result?.stdout);
   } finally {
     rmSync(temp, { recursive: true, force: true });
   }
 }
 
-function verifyCmsWithOpenSsl({ manifestPath, signaturePath, commandRunner, opensslPath }) {
-  const temp = mkdtempSync(join(tmpdir(), "rightrelease-cms-verify-"));
-  const verified = join(temp, "verified-manifest");
-  const certificate = join(temp, "signer.pem");
-  try {
-    const result = commandRunner(opensslPath, ["cms", "-verify", "-binary", "-inform", "DER", "-in", signaturePath, "-content", manifestPath, "-noverify", "-certsout", certificate, "-out", verified], { encoding: "utf8", windowsHide: true });
-    if (result?.status !== 0) throw new Error(`CMS signature verification failed: ${String(result?.stderr ?? "").trim()}`);
-    if (!existsSync(verified) || !readFileSync(verified).equals(readFileSync(manifestPath))) throw new Error("CMS signature content does not match manifest bytes");
-    if (!existsSync(certificate)) throw new Error("CMS signer certificate is missing");
-    const inspection = commandRunner(opensslPath, ["x509", "-in", certificate, "-noout", "-subject", "-fingerprint", "-sha256"], { encoding: "utf8", windowsHide: true });
-    if (inspection?.status !== 0) throw new Error(`CMS signer inspection failed: ${String(inspection?.stderr ?? "").trim()}`);
-    const output = String(inspection?.stdout ?? "");
-    const subject = output.match(/^\s*subject\s*=\s*(.+)$/im)?.[1]?.trim();
-    const certificateSha256 = output.match(/^\s*sha256\s+Fingerprint\s*=\s*([0-9a-f:]+)\s*$/im)?.[1];
-    return parseCmsInspection(JSON.stringify({ verified: true, subject, certificateSha256 }));
-  } finally {
-    rmSync(temp, { recursive: true, force: true });
-  }
-}
-
-function parseCmsInspection(output) {
+function parseCatalogInspection(output) {
   let inspection;
-  try { inspection = JSON.parse(String(output ?? "").trim()); } catch { throw new Error("CMS verifier returned invalid JSON"); }
-  if (inspection.verified !== true || typeof inspection.subject !== "string" || typeof inspection.certificateSha256 !== "string") throw new Error("CMS verifier returned incomplete identity");
+  try { inspection = JSON.parse(String(output ?? "").trim()); } catch { throw new Error("catalog verifier returned invalid JSON"); }
+  if (inspection.verified !== true || typeof inspection.subject !== "string" || typeof inspection.certificateSha256 !== "string") throw new Error("catalog verifier returned incomplete identity");
   return inspection;
 }
 
@@ -183,6 +149,14 @@ function normalizeSubject(subject) {
   return String(subject).trim().replace(/\s*=\s*/g, "=").replace(/\s*,\s*/g, ",");
 }
 
+function windowsPowerShellEnvironment(environment) {
+  const sanitized = { ...environment };
+  for (const key of Object.keys(sanitized)) {
+    if (key.toLowerCase() === "psmodulepath") delete sanitized[key];
+  }
+  return sanitized;
+}
+
 function materializeMetadata(dir, env) {
   const existing = env("AZURE_ARTIFACT_SIGNING_METADATA") || env("AZURE_SIGNING_METADATA");
   if (existing) {