@rightkit/release 0.2.75 → 0.2.77

package/direct-bootstrap.mjs

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
-import { RIGHTRELEASE_MANIFEST_SIGNER, signReleaseManifestCatalogWithAzure } from "./sign-release-manifest.mjs";
+import { RIGHTRELEASE_MANIFEST_SIGNER, signReleaseManifestWithAzure } from "./sign-release-manifest.mjs";
 import { validateCycloneDxSbom, validateInTotoSlsaProvenance } from "./supply-chain-evidence.mjs";
 
 const SHA256 = /^[a-f0-9]{64}$/;
@@ -145,6 +145,8 @@ export function buildReleaseManifest({
     minimumBootstrapVersion,
     signingKeyId: RIGHTRELEASE_MANIFEST_SIGNER.id,
     signatureAlgorithm: RIGHTRELEASE_MANIFEST_SIGNER.algorithm,
+    signatureProvider: RIGHTRELEASE_MANIFEST_SIGNER.provider,
+    signatureProviderVersion: RIGHTRELEASE_MANIFEST_SIGNER.providerVersion,
     checksumsSha256: checksumsDigest,
     assets: normalizedAssets,
   };
@@ -162,14 +164,14 @@ export function materializeDirectRelease({ outputDir, manifestInput }) {
   });
   const manifestText = `${canonicalJson(manifest)}\n`;
   const manifestPath = join(outputDir, "release-manifest.json");
-  const catalogPath = join(outputDir, "release-manifest.cat");
+  const signaturePath = join(outputDir, "release-manifest.cat");
   writeFileSync(manifestPath, manifestText);
-  const signing = signReleaseManifestCatalogWithAzure({ manifestPath, catalogPath });
-  if (!statSync(catalogPath).isFile() || statSync(catalogPath).size < 1) throw new Error("release manifest catalog is missing");
+  const signing = signReleaseManifestWithAzure({ manifestPath, signaturePath });
+  if (!statSync(signaturePath).isFile() || statSync(signaturePath).size < 1) throw new Error("detached release manifest signature is missing");
   if (signing?.signer?.id !== RIGHTRELEASE_MANIFEST_SIGNER.id || signing.signer.subject !== RIGHTRELEASE_MANIFEST_SIGNER.subject || !/^[a-f0-9]{64}$/.test(signing.signer.certificateSha256 ?? "")) {
-    throw new Error("release manifest catalog signer is not RightRelease Azure authority");
+    throw new Error("detached release manifest signer is not RightRelease Azure authority");
   }
-  return { manifest, manifestPath, catalogPath, signaturePath: catalogPath, signing, checksums };
+  return { manifest, manifestPath, signaturePath, signing, checksums };
 }
 
 function psQuote(value) {
@@ -237,7 +239,8 @@ export function renderPowerShellBootstrap({
   };
   // Bind generated contract metadata so a caller cannot pass a marker plus an
   // arbitrary base64 payload and have it treated as a RightRelease bootstrap.
-  // This is a structural integrity fence for the executable bootstrap source itself.
+  // This is not a replacement for manifest catalog signing; it is a structural
+  // integrity fence for the executable bootstrap source itself.
   contract.contractSha256 = createHash("sha256").update(canonicalJson(contract)).digest("hex");
   const contractB64 = Buffer.from(JSON.stringify(contract)).toString("base64");
   const lines = [
@@ -266,18 +269,18 @@ export function renderPowerShellBootstrap({
     "$ReleaseBase = " + psQuote("https://github.com/" + repository + "/releases/download/v") + " + $Version",
     "$Work = Join-Path ([IO.Path]::GetTempPath()) (" + psQuote(product + "-install-") + " + [guid]::NewGuid())",
     "New-Item -ItemType Directory -Force -Path $Work | Out-Null",
-    "$ManifestPath = Join-Path $Work 'release-manifest.json'; $CatalogPath = Join-Path $Work 'release-manifest.cat'; $ChecksumsPath = Join-Path $Work 'checksums.json'",
+    "$ManifestPath = Join-Path $Work 'release-manifest.json'; $SignaturePath = Join-Path $Work 'release-manifest.cat'; $ChecksumsPath = Join-Path $Work 'checksums.json'",
     "Invoke-WebRequest ($ReleaseBase + '/release-manifest.json') -OutFile $ManifestPath",
-    "Invoke-WebRequest ($ReleaseBase + '/release-manifest.cat') -OutFile $CatalogPath",
-    "$ManifestBytes = [IO.File]::ReadAllBytes($ManifestPath)",
-    "$CatalogSignature = Get-AuthenticodeSignature -FilePath $CatalogPath; if ($CatalogSignature.Status -ne 'Valid' -or $null -eq $CatalogSignature.SignerCertificate) { throw 'Release manifest catalog signature is invalid' }; $SignerCertificate = $CatalogSignature.SignerCertificate",
-    "$ManifestCatalogRoot = Join-Path $Work 'manifest-catalog'; New-Item -ItemType Directory -Force -Path $ManifestCatalogRoot | Out-Null; Copy-Item -LiteralPath $ManifestPath -Destination (Join-Path $ManifestCatalogRoot 'release-manifest.json')",
-    "$CatalogValidation = Test-FileCatalog -Path $ManifestCatalogRoot -CatalogFilePath $CatalogPath; if ([string]$CatalogValidation -ne 'Valid') { throw 'Release manifest catalog does not bind exact bytes' }",
+    "Invoke-WebRequest ($ReleaseBase + '/release-manifest.cat') -OutFile $SignaturePath",
+    "$ManifestBytes = [IO.File]::ReadAllBytes($ManifestPath); Import-Module Microsoft.PowerShell.Security -ErrorAction Stop",
+    "$Catalog = Test-FileCatalog -CatalogFilePath $SignaturePath -Path $ManifestPath -Detailed; if ([string]$Catalog.Status -ne 'Valid') { throw 'Release manifest catalog binding is invalid' }",
+    "$CatalogSignature = Get-AuthenticodeSignature -FilePath $SignaturePath; if ([string]$CatalogSignature.Status -ne 'Valid' -or -not $CatalogSignature.SignerCertificate) { throw 'Release manifest signature is invalid' }; $SignerCertificate = $CatalogSignature.SignerCertificate",
+    "$SignerSubject = 'CN=' + $SignerCertificate.GetNameInfo([Security.Cryptography.X509Certificates.X509NameType]::SimpleName, $false)",
     "$Sha256 = [Security.Cryptography.SHA256]::Create(); try { $SignerFingerprint = ([BitConverter]::ToString($Sha256.ComputeHash($SignerCertificate.RawData))).Replace('-','').ToLowerInvariant() } finally { $Sha256.Dispose() }",
-    "$VerifiedKeyId = $null; foreach ($KeyId in $AcceptedSigners.Keys) { $Accepted = $AcceptedSigners[$KeyId]; if ($SignerCertificate.Subject -eq [string]$Accepted.subject -and $SignerFingerprint -eq [string]$Accepted.certificateSha256) { $VerifiedKeyId = $KeyId; break } }",
+    "$VerifiedKeyId = $null; foreach ($KeyId in $AcceptedSigners.Keys) { $Accepted = $AcceptedSigners[$KeyId]; if ($SignerSubject -eq [string]$Accepted.subject -and $SignerFingerprint -eq [string]$Accepted.certificateSha256) { $VerifiedKeyId = $KeyId; break } }",
     "if (-not $VerifiedKeyId) { throw 'Release manifest signer is not accepted' }",
     "$Manifest = [Text.Encoding]::UTF8.GetString($ManifestBytes) | ConvertFrom-Json",
-    "if ($Manifest.signingKeyId -ne $VerifiedKeyId -or $Manifest.signatureAlgorithm -ne 'authenticode-catalog-sha256') { throw 'Release manifest signer identity mismatch' }",
+    "if ($Manifest.signingKeyId -ne $VerifiedKeyId -or $Manifest.signatureAlgorithm -ne 'authenticode-catalog-sha256' -or $Manifest.signatureProvider -ne 'windows-authenticode-catalog' -or $Manifest.signatureProviderVersion -ne 1) { throw 'Release manifest signer identity mismatch' }",
     "if ($Manifest.product -ne " + psQuote(product) + " -or $Manifest.version -ne $Version -or $Manifest.tag -ne ('v' + $Version)) { throw 'Release identity mismatch' }",
     "if ([version]$Contract.bootstrapVersion -lt [version]$Manifest.minimumBootstrapVersion) { throw 'Bootstrap update required' }",
     "$Machine = [Runtime.InteropServices.RuntimeInformation]::OSArchitecture.ToString(); $Target = if ($Machine -eq 'Arm64') { 'windows-arm64' } elseif ($Machine -eq 'X64') { 'windows-x86_64' } else { throw ('Unsupported architecture: ' + $Machine) }",
@@ -334,9 +337,10 @@ export function renderPowerShellBootstrap({
 export function validatePowerShellBootstrap(script, expected = {}) {
   const required = [
     "# rightkit-direct-bootstrap:v1",
-    "Release manifest catalog signature is invalid",
+    "Release manifest signature is invalid",
     "certificateSha256",
     "Test-FileCatalog",
+    "Get-AuthenticodeSignature",
     "checksums.json is not manifest-bound",
     "Provenance checksum mismatch",
     "SBOM checksum mismatch",

package/github-release.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { verifySealedRelease } from "./release-state.mjs";
 import { addonManifestSha256, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
-import { RIGHTRELEASE_MANIFEST_SIGNER, verifyReleaseManifestCatalog } from "./sign-release-manifest.mjs";
+import { RIGHTRELEASE_MANIFEST_SIGNER, verifyManifestCatalogSignature } from "./sign-release-manifest.mjs";
 
 const REPO_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
 const RELEASE_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,159}$/;
@@ -68,9 +68,13 @@ export function prepareGitHubDirectRelease({
   signing,
   signingResult,
   signer,
-  catalogCommandRunner = spawnSync,
-  catalogPlatform = process.platform,
+  signatureCommandRunner,
+  signaturePlatform,
+  cmsCommandRunner,
+  cmsPlatform,
 }) {
+  const effectiveSignatureRunner = signatureCommandRunner ?? cmsCommandRunner ?? spawnSync;
+  const effectiveSignaturePlatform = signaturePlatform ?? cmsPlatform ?? process.platform;
   if (!REPO_RE.test(repo)) throw new Error(`invalid GitHub repository: ${repo}`);
   const root = path.resolve(repoRoot ?? process.cwd());
   const manifestFile = path.resolve(root, manifestPath);
@@ -84,7 +88,7 @@ export function prepareGitHubDirectRelease({
   if (product && manifest.product !== product) throw new Error("direct release product mismatch");
   if (version && manifest.version !== version) throw new Error("direct release version mismatch");
   if (!STABLE_SEMVER_RE.test(manifest.version) || manifest.tag !== `v${manifest.version}`) throw new Error("direct release manifest tag is invalid stable SemVer");
-  if (manifest.signingKeyId !== RIGHTRELEASE_MANIFEST_SIGNER.id || manifest.signatureAlgorithm !== RIGHTRELEASE_MANIFEST_SIGNER.algorithm) throw new Error("direct release manifest signer contract is invalid");
+  if (manifest.signingKeyId !== RIGHTRELEASE_MANIFEST_SIGNER.id || manifest.signatureAlgorithm !== RIGHTRELEASE_MANIFEST_SIGNER.algorithm || manifest.signatureProvider !== RIGHTRELEASE_MANIFEST_SIGNER.provider || manifest.signatureProviderVersion !== RIGHTRELEASE_MANIFEST_SIGNER.providerVersion) throw new Error("direct release manifest signer contract is invalid");
   const declared = new Set((manifest.assets ?? []).map((asset) => asset.name));
   if (!declared.size) throw new Error("direct release manifest has no archive assets");
   if ([...declared].some((name) => /(?:installer|setup)\.(?:exe|dmg|pkg|msi)$/i.test(name))) throw new Error("direct release must not contain installer assets");
@@ -124,10 +128,10 @@ export function prepareGitHubDirectRelease({
     notesFile,
     manifestUrl: `https://github.com/${repo}/releases/download/${manifest.tag}/${path.basename(manifestFile)}`,
     signer: expectedSigner,
-    catalogPlatform,
+    signaturePlatform: effectiveSignaturePlatform,
   };
-  Object.defineProperty(plan, "catalogCommandRunner", { value: catalogCommandRunner, enumerable: false });
-  validateGitHubDirectReleasePlan(plan, { commandRunner: catalogCommandRunner, platform: catalogPlatform });
+  Object.defineProperty(plan, "signatureCommandRunner", { value: effectiveSignatureRunner, enumerable: false });
+  validateGitHubDirectReleasePlan(plan, { commandRunner: effectiveSignatureRunner, platform: effectiveSignaturePlatform });
   return plan;
 }
 
@@ -139,7 +143,7 @@ export const prepareGitHubManifestRelease = prepareGitHubDirectRelease;
  * signed manifest remains authority; checksums.json is only a digest-bound
  * convenience index for archives and attached provenance/SBOM evidence.
  */
-export function validateGitHubDirectReleasePlan(plan, { commandRunner = plan?.catalogCommandRunner ?? spawnSync, platform = plan?.catalogPlatform ?? process.platform } = {}) {
+export function validateGitHubDirectReleasePlan(plan, { commandRunner = plan?.signatureCommandRunner ?? plan?.cmsCommandRunner ?? spawnSync, platform = plan?.signaturePlatform ?? plan?.cmsPlatform ?? process.platform } = {}) {
   if (!plan || plan.kind !== "direct-release") throw new Error("invalid direct GitHub release plan");
   if (!plan.manifestPath || !plan.signaturePath || !plan.checksumsPath || !Array.isArray(plan.assets)) throw new Error("direct GitHub release plan is incomplete");
   const manifestFile = path.resolve(plan.manifestPath);
@@ -148,14 +152,14 @@ export function validateGitHubDirectReleasePlan(plan, { commandRunner = plan?.ca
   for (const file of [manifestFile, signatureFile, checksumsFile]) {
     if (!existsSync(file) || !statSync(file).isFile()) throw new Error(`direct release payload missing: ${file}`);
   }
-  if (statSync(signatureFile).size < 1) throw new Error("release manifest catalog is missing");
+  if (statSync(signatureFile).size < 1) throw new Error("detached release manifest signature is missing");
   const manifest = JSON.parse(readFileSync(manifestFile, "utf8"));
   if (manifest.schemaVersion !== 1 || manifest.kind !== "rightkit-direct-release-manifest" || !STABLE_SEMVER_RE.test(manifest.version ?? "") || manifest.tag !== `v${manifest.version}`) {
     throw new Error("invalid direct release manifest");
   }
   if (plan.tag !== manifest.tag) throw new Error("direct GitHub release tag does not match manifest");
-  if (manifest.signingKeyId !== RIGHTRELEASE_MANIFEST_SIGNER.id || manifest.signatureAlgorithm !== RIGHTRELEASE_MANIFEST_SIGNER.algorithm) throw new Error("direct release manifest signer contract is invalid");
-  verifyReleaseManifestCatalog({ manifestPath: manifestFile, catalogPath: signatureFile, expectedSigner: plan.signer, commandRunner, platform });
+  if (manifest.signingKeyId !== RIGHTRELEASE_MANIFEST_SIGNER.id || manifest.signatureAlgorithm !== RIGHTRELEASE_MANIFEST_SIGNER.algorithm || manifest.signatureProvider !== RIGHTRELEASE_MANIFEST_SIGNER.provider || manifest.signatureProviderVersion !== RIGHTRELEASE_MANIFEST_SIGNER.providerVersion) throw new Error("direct release manifest signer contract is invalid");
+  verifyManifestCatalogSignature({ manifestPath: manifestFile, signaturePath: signatureFile, expectedSigner: plan.signer, commandRunner, platform });
   if (!SHA256.test(manifest.checksumsSha256 ?? "")) throw new Error("direct release checksums digest is missing");
   if (sha256(checksumsFile) !== manifest.checksumsSha256) throw new Error("checksums.json is not manifest-bound");
   const checksums = JSON.parse(readFileSync(checksumsFile, "utf8"));
@@ -232,8 +236,8 @@ export function prepareGitHubAddonRelease({ repoRoot, config, configRoot = repoR
   };
 }
 
-export function publishGitHubRelease(plan, { repo, dryRun = false, run = runCommand, catalogCommandRunner = plan?.catalogCommandRunner, catalogPlatform = plan?.catalogPlatform ?? process.platform } = {}) {
-  if (plan.kind === "direct-release") validateGitHubDirectReleasePlan(plan, { commandRunner: catalogCommandRunner ?? spawnSync, platform: catalogPlatform });
+export function publishGitHubRelease(plan, { repo, dryRun = false, run = runCommand, signatureCommandRunner = plan?.signatureCommandRunner ?? plan?.cmsCommandRunner, signaturePlatform = plan?.signaturePlatform ?? plan?.cmsPlatform ?? process.platform } = {}) {
+  if (plan.kind === "direct-release") validateGitHubDirectReleasePlan(plan, { commandRunner: signatureCommandRunner ?? spawnSync, platform: signaturePlatform });
   const visibility = JSON.parse(run("gh", ["repo", "view", repo, "--json", "visibility"]));
   if (visibility.visibility !== "PUBLIC" && !(plan.kind !== "addon" && visibility.visibility === "PRIVATE")) {
     throw new Error(`GitHub releases require a public or private repository: ${repo}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.75",
+  "version": "0.2.77",
   "description": "Portable Right Suite release CLI/SDK: signed native archives, direct bootstrap transactions, immutable GitHub Release upload, R2 bootstrap publication, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -29,6 +29,7 @@
   "scripts": {
     "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
     "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
+    "test:signer:windows": "node sign-release-manifest.integration.mjs",
     "doctor:all": "node --test right-suite-contract.test.mjs",
     "verify:standalone": "node standalone-clone-verify.mjs"
   }

package/release.mjs

@@ -619,9 +619,6 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
   if (policy !== "right-git-ci-only") {
     fail(`${appName} hosted workflow files are forbidden: ${workflows.join(", ")}`);
   }
-  if (workflows.length !== 1 || workflows[0] !== "ci.yml") {
-    fail(`${appName} right-git-ci-only policy permits only ci.yml, got: ${workflows.join(", ")}`);
-  }
   const manifestPath = path.join(root, ".rightgit.json");
   let manifest;
   try {
@@ -629,16 +626,30 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
   } catch {
     fail(`${appName} right-git-ci-only policy requires a valid .rightgit.json`);
   }
-  if (manifest?.schemaVersion !== 1 || JSON.stringify(manifest?.lanes) !== JSON.stringify(["ci"])) {
-    fail(`${appName} right-git-ci-only policy requires .rightgit.json lanes=["ci"]`);
-  }
-  const source = await readFile(path.join(root, ".github", "workflows", "ci.yml"), "utf8");
-  if (!source.startsWith("# Managed by right-git")) {
-    fail(`${appName} ci.yml is not marked as right-git managed`);
-  }
-  if (/^\s*(?:actions|attestations|contents|id-token|packages|security-events):\s*write\s*$/mi.test(source)
-    || /\bsecrets\s*\./i.test(source)) {
-    fail(`${appName} right-git managed ci.yml requests release-capable permissions or secrets`);
+  const lanes = manifest?.lanes;
+  const safeLanes = new Set(["ci", "release-candidate"]);
+  if (manifest?.schemaVersion !== 1
+    || !Array.isArray(lanes)
+    || lanes.length === 0
+    || !lanes.includes("ci")
+    || new Set(lanes).size !== lanes.length
+    || lanes.some((lane) => !safeLanes.has(lane))) {
+    fail(`${appName} right-git-ci-only policy requires unique .rightgit.json lanes drawn from ["ci", "release-candidate"] and including "ci"`);
+  }
+  const expectedWorkflows = lanes.map((lane) => `${lane}.yml`).sort();
+  if (JSON.stringify(workflows) !== JSON.stringify(expectedWorkflows)) {
+    fail(`${appName} right-git-ci-only policy requires workflows declared by .rightgit.json; expected ${expectedWorkflows.join(", ")}, got: ${workflows.join(", ")}`);
+  }
+  for (const workflow of expectedWorkflows) {
+    const source = await readFile(path.join(root, ".github", "workflows", workflow), "utf8");
+    if (!source.startsWith("# Managed by right-git")) {
+      fail(`${appName} ${workflow} is not marked as right-git managed`);
+    }
+    if (/^\s*permissions:\s*write-all\s*$/mi.test(source)
+      || /^\s*(?:actions|attestations|checks|contents|deployments|discussions|id-token|issues|models|packages|pages|pull-requests|security-events|statuses):\s*write\s*$/mi.test(source)
+      || /\bsecrets\s*(?:\.|\[)/i.test(source)) {
+      fail(`${appName} right-git managed ${workflow} requests release-capable permissions or secrets`);
+    }
   }
 }
 

package/rightkit-versions.json

@@ -14,7 +14,7 @@
   },
   "stagedNpm": {
     "@rightkit/ax": "0.2.1",
-    "@rightkit/git": "0.2.1",
+    "@rightkit/git": "0.2.5",
     "@rightkit/hooks": "0.1.1",
     "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.1.1",
@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.75",
+    "@rightkit/release": "0.2.77",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },
@@ -30,6 +30,12 @@
     "@rightkit/ax": [
       "0.2.0"
     ],
+    "@rightkit/git": [
+      "0.2.1",
+      "0.2.2",
+      "0.2.3",
+      "0.2.4"
+    ],
     "@rightkit/legal-ui": [
       "0.1.0"
     ],
@@ -73,7 +79,9 @@
       "0.2.71",
       "0.2.72",
       "0.2.73",
-      "0.2.74"
+      "0.2.74",
+      "0.2.75",
+      "0.2.76"
     ],
     "@rightkit/qa": [
       "0.1.0",

package/sign-release-manifest.integration.mjs

@@ -0,0 +1,27 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { RIGHTRELEASE_MANIFEST_SIGNER, signReleaseManifestWithAzure, verifyManifestCatalogSignature } from "./sign-release-manifest.mjs";
+
+if (process.platform !== "win32") throw new Error("protected manifest signer integration must run on Windows");
+
+const root = mkdtempSync(join(tmpdir(), "rightrelease-live-signer-"));
+const manifestPath = join(root, "release-manifest.json");
+const signaturePath = join(root, "release-manifest.cat");
+try {
+  writeFileSync(manifestPath, '{"kind":"rightrelease-live-signer-probe","schemaVersion":1}\n');
+  const signing = signReleaseManifestWithAzure({ manifestPath, signaturePath });
+  const verification = verifyManifestCatalogSignature({ manifestPath, signaturePath, expectedSigner: signing.signer });
+  assert.equal(verification.verified, true);
+  assert.equal(verification.signer.id, RIGHTRELEASE_MANIFEST_SIGNER.id);
+
+  writeFileSync(manifestPath, `${readFileSync(manifestPath, "utf8")}tampered\n`);
+  assert.throws(
+    () => verifyManifestCatalogSignature({ manifestPath, signaturePath, expectedSigner: signing.signer }),
+    /manifest catalog signature is invalid/,
+  );
+  process.stdout.write(`${JSON.stringify({ status: "PASS", provider: signing.signer.provider, providerVersion: signing.signer.providerVersion, algorithm: signing.signer.algorithm, subject: signing.signer.subject, certificateSha256: signing.signer.certificateSha256 })}\n`);
+} finally {
+  rmSync(root, { recursive: true, force: true });
+}

package/sign-release-manifest.mjs

@@ -2,11 +2,10 @@ import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync,
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
 
 export const RIGHTRELEASE_MANIFEST_SIGNER = Object.freeze({
   id: "azure-artifact-signing-damned-ventures-v1",
-  subject: "CN=Damned Ventures LLC, O=Damned Ventures LLC, L=new york, S=New York, C=US",
+  subject: "CN=Damned Ventures LLC",
   algorithm: "authenticode-catalog-sha256",
   provider: "windows-authenticode-catalog",
   providerVersion: 1,
@@ -22,52 +21,47 @@ const EXCLUDE_CREDENTIALS = [
   "AzureDeveloperCliCredential",
   "InteractiveBrowserCredential",
 ];
-
 const CERTIFICATE_SHA256 = /^[a-f0-9]{64}$/i;
 
-export function verifyReleaseManifestCatalog({
+/** Verify Azure-signed catalog binding exact release-manifest bytes. */
+export function verifyManifestCatalogSignature({
   manifestPath,
-  catalogPath,
+  signaturePath,
   expectedSigner,
   commandRunner = spawnSync,
   platform = process.platform,
-  powershellPath = "powershell",
+  powershellPath = "pwsh",
 }) {
   const manifest = resolve(manifestPath);
-  const catalog = resolve(catalogPath);
-  if (platform !== "win32") throw new Error("Authenticode catalog verification requires Windows");
-  if (!existsSync(manifest) || !statSync(manifest).isFile()) throw new Error("catalog manifest bytes are missing");
-  if (!existsSync(catalog) || !statSync(catalog).isFile() || statSync(catalog).size < 1) throw new Error("release manifest catalog is missing");
-  if (!expectedSigner || expectedSigner.id !== RIGHTRELEASE_MANIFEST_SIGNER.id || expectedSigner.subject !== RIGHTRELEASE_MANIFEST_SIGNER.subject || expectedSigner.algorithm !== RIGHTRELEASE_MANIFEST_SIGNER.algorithm || !CERTIFICATE_SHA256.test(expectedSigner.certificateSha256 ?? "")) {
+  const signature = resolve(signaturePath);
+  if (!existsSync(manifest) || !statSync(manifest).isFile()) throw new Error("manifest bytes are missing");
+  if (!existsSync(signature) || !statSync(signature).isFile() || statSync(signature).size < 1) throw new Error("detached manifest catalog signature is missing");
+  if (!expectedSigner || expectedSigner.id !== RIGHTRELEASE_MANIFEST_SIGNER.id || expectedSigner.subject !== RIGHTRELEASE_MANIFEST_SIGNER.subject || expectedSigner.algorithm !== RIGHTRELEASE_MANIFEST_SIGNER.algorithm || expectedSigner.provider !== RIGHTRELEASE_MANIFEST_SIGNER.provider || expectedSigner.providerVersion !== RIGHTRELEASE_MANIFEST_SIGNER.providerVersion || !CERTIFICATE_SHA256.test(expectedSigner.certificateSha256 ?? "")) {
     throw new Error("catalog verification requires exact Azure signer identity");
   }
-  const inspection = verifyCatalogWithPowerShell({ manifestPath: manifest, catalogPath: catalog, commandRunner, powershellPath });
-  if (!inspection.verified) throw new Error("release manifest catalog is invalid");
+  if (platform !== "win32" && commandRunner === spawnSync) throw new Error("RightRelease catalog verification must run on Windows");
+  const inspection = inspectCatalog({ manifestPath: manifest, signaturePath: signature, commandRunner, powershellPath });
+  if (inspection.verified !== true || inspection.catalogStatus !== "Valid" || inspection.signatureStatus !== "Valid") throw new Error("manifest catalog signature is invalid");
   if (normalizeSubject(inspection.subject) !== normalizeSubject(expectedSigner.subject)) throw new Error("catalog signer subject mismatch");
   const certificateSha256 = String(inspection.certificateSha256 ?? "").replaceAll(":", "").toLowerCase();
   if (!CERTIFICATE_SHA256.test(certificateSha256) || certificateSha256 !== String(expectedSigner.certificateSha256).toLowerCase()) throw new Error("catalog signer certificate fingerprint mismatch");
-  return { verified: true, manifestPath: manifest, catalogPath: catalog, signer: { ...expectedSigner, certificateSha256 } };
+  return { verified: true, manifestPath: manifest, signaturePath: signature, signer: { ...expectedSigner, certificateSha256 } };
 }
 
-export function signReleaseManifestCatalogWithAzure({
+export function signReleaseManifestWithAzure({
   manifestPath,
-  catalogPath,
+  signaturePath,
   commandRunner = spawnSync,
   environment = process.env,
   signtoolPath,
   dlibPath,
   metadataPath,
+  powershellPath = "pwsh",
 }) {
-  if (process.platform !== "win32" && commandRunner === spawnSync) {
-    throw new Error("RightRelease manifest signing must run on protected Windows release host");
-  }
+  if (process.platform !== "win32" && commandRunner === spawnSync) throw new Error("RightRelease manifest signing must run on protected Windows release host");
   const userEnv = (name) => readUserEnvironment(name, commandRunner);
   const env = (name) => environment[name] || userEnv(name);
-  const signtool = signtoolPath || firstExisting([
-    env("AZURE_SIGNTOOL_PATH"),
-    env("SIGNTOOL_PATH"),
-    ...signtoolCandidates(env),
-  ]);
+  const signtool = signtoolPath || firstExisting([env("AZURE_SIGNTOOL_PATH"), env("SIGNTOOL_PATH"), ...signtoolCandidates(env)]);
   if (!signtool) throw new Error("RightRelease manifest signer could not find signtool.exe");
   const dlib = dlibPath || firstExisting([
     env("AZURE_CODESIGN_DLIB_PATH"),
@@ -78,85 +72,70 @@ export function signReleaseManifestCatalogWithAzure({
   ]);
   if (!dlib) throw new Error("RightRelease manifest signer could not find Azure Artifact Signing dlib");
 
-  const temp = mkdtempSync(join(tmpdir(), "rightrelease-manifest-catalog-"));
-  const powershellEnvironment = windowsPowerShellEnvironment(environment);
+  const temp = mkdtempSync(join(tmpdir(), "rightrelease-manifest-sign-"));
   const metadata = metadataPath || materializeMetadata(temp, env);
-  const catalogSource = join(temp, "catalog-source");
-  const unsignedCatalog = join(temp, "release-manifest.cat");
-  mkdirSync(catalogSource, { recursive: true });
-  copyFileSync(resolve(manifestPath), join(catalogSource, "release-manifest.json"));
+  const catalogDir = join(temp, "catalog");
+  mkdirSync(catalogDir, { recursive: true });
+  const catalog = join(catalogDir, "catalog.cat");
+  const generator = join(temp, "create-catalog.ps1");
+  writeFileSync(generator, [
+    "param([string]$ManifestPath, [string]$CatalogDirectory)",
+    "$ErrorActionPreference = 'Stop'",
+    "Import-Module Microsoft.PowerShell.Security -ErrorAction Stop",
+    "New-FileCatalog -Path $ManifestPath -CatalogFilePath $CatalogDirectory -CatalogVersion 2.0 | Out-Null",
+  ].join("\r\n") + "\r\n");
   try {
-    const materializer = join(temp, "new-catalog.ps1");
-    writeFileSync(materializer, [
-      "param([string]$SourcePath, [string]$CatalogPath)",
-      "Import-Module Microsoft.PowerShell.Security -ErrorAction Stop",
-      "$Result = New-FileCatalog -Path $SourcePath -CatalogFilePath $CatalogPath -CatalogVersion 2.0",
-      "if (-not (Test-Path $Result)) { throw 'Manifest catalog was not created' }",
-    ].join("\r\n") + "\r\n");
-    const created = commandRunner("powershell", ["-NoProfile", "-File", materializer, catalogSource, unsignedCatalog], { encoding: "utf8", windowsHide: true, env: powershellEnvironment });
-    if (created?.status !== 0 || !existsSync(unsignedCatalog)) throw new Error(`RightRelease manifest catalog creation failed: ${String(created?.stderr ?? "").trim()}`);
+    const generation = commandRunner(powershellPath, ["-NoProfile", "-File", generator, resolve(manifestPath), catalogDir], { encoding: "utf8", windowsHide: true, env: environment });
+    if (generation?.status !== 0) throw new Error(`RightRelease manifest catalog generation failed: ${String(generation?.stderr ?? "").trim()}`);
+    if (!existsSync(catalog) || !statSync(catalog).isFile()) throw new Error("RightRelease manifest catalog was not produced");
     const result = commandRunner(signtool, [
       "sign", "/v", "/fd", "SHA256", "/tr", "http://timestamp.acs.microsoft.com", "/td", "SHA256",
-      "/dlib", dlib, "/dmdf", metadata,
-      unsignedCatalog,
+      "/dlib", dlib, "/dmdf", metadata, catalog,
     ], { encoding: "utf8", windowsHide: true, env: environment });
-    if (result?.status !== 0) throw new Error(`RightRelease manifest catalog signing failed: ${String(result?.stderr ?? "").trim()}`);
-    const inspection = verifyCatalogWithPowerShell({ manifestPath: resolve(manifestPath), catalogPath: unsignedCatalog, commandRunner, powershellPath: "powershell", environment: powershellEnvironment });
-    if (normalizeSubject(inspection.subject) !== normalizeSubject(RIGHTRELEASE_MANIFEST_SIGNER.subject) || !CERTIFICATE_SHA256.test(inspection.certificateSha256 ?? "")) throw new Error(`RightRelease catalog signer identity does not match protected Azure profile: ${inspection.subject}`);
-    mkdirSync(dirname(catalogPath), { recursive: true });
-    copyFileSync(unsignedCatalog, catalogPath);
-    return { catalogPath: resolve(catalogPath), signer: { ...RIGHTRELEASE_MANIFEST_SIGNER, certificateSha256: inspection.certificateSha256.toLowerCase() } };
+    if (result?.status !== 0) throw new Error(`RightRelease manifest signing failed: ${String(result?.stderr ?? "").trim()}`);
+    const inspection = inspectCatalog({ manifestPath: resolve(manifestPath), signaturePath: catalog, commandRunner, powershellPath, environment });
+    if (inspection.verified !== true || inspection.catalogStatus !== "Valid" || inspection.signatureStatus !== "Valid") throw new Error("RightRelease manifest catalog verification failed");
+    if (normalizeSubject(inspection.subject) !== normalizeSubject(RIGHTRELEASE_MANIFEST_SIGNER.subject) || !CERTIFICATE_SHA256.test(inspection.certificateSha256 ?? "")) throw new Error("RightRelease manifest signer identity does not match protected Azure profile");
+    mkdirSync(dirname(signaturePath), { recursive: true });
+    copyFileSync(catalog, signaturePath);
+    return { signaturePath: resolve(signaturePath), signer: { ...RIGHTRELEASE_MANIFEST_SIGNER, certificateSha256: inspection.certificateSha256.toLowerCase() } };
   } finally {
     rmSync(temp, { recursive: true, force: true });
   }
 }
 
-function verifyCatalogWithPowerShell({ manifestPath, catalogPath, commandRunner, powershellPath, environment = process.env }) {
+function inspectCatalog({ manifestPath, signaturePath, commandRunner, powershellPath, environment = process.env }) {
   const temp = mkdtempSync(join(tmpdir(), "rightrelease-catalog-verify-"));
-  const source = join(temp, "catalog-source");
-  mkdirSync(source, { recursive: true });
-  copyFileSync(manifestPath, join(source, "release-manifest.json"));
   const verifier = join(temp, "verify-catalog.ps1");
   writeFileSync(verifier, [
-    "param([string]$SourcePath, [string]$CatalogPath)",
+    "param([string]$ManifestPath, [string]$SignaturePath)",
+    "$ErrorActionPreference = 'Stop'",
     "Import-Module Microsoft.PowerShell.Security -ErrorAction Stop",
-    "$Signature = Get-AuthenticodeSignature -FilePath $CatalogPath",
-    "if ($Signature.Status -ne 'Valid' -or $null -eq $Signature.SignerCertificate) { throw 'Catalog Authenticode signature is invalid' }",
-    "$Validation = Test-FileCatalog -Path $SourcePath -CatalogFilePath $CatalogPath",
-    "if ([string]$Validation -ne 'Valid') { throw 'Catalog does not bind exact manifest bytes' }",
+    "$Catalog = Test-FileCatalog -CatalogFilePath $SignaturePath -Path $ManifestPath -Detailed",
+    "$Signature = Get-AuthenticodeSignature -FilePath $SignaturePath",
     "$Certificate = $Signature.SignerCertificate",
+    "if (-not $Certificate) { throw 'Catalog signer certificate is missing' }",
+    "$SimpleName = $Certificate.GetNameInfo([Security.Cryptography.X509Certificates.X509NameType]::SimpleName, $false)",
     "$Sha256 = [Security.Cryptography.SHA256]::Create()",
     "try { $Fingerprint = ([BitConverter]::ToString($Sha256.ComputeHash($Certificate.RawData))).Replace('-','').ToLowerInvariant() } finally { $Sha256.Dispose() }",
-    "@{ verified=$true; subject=$Certificate.Subject; certificateSha256=$Fingerprint } | ConvertTo-Json -Compress",
+    "@{ verified=([string]$Catalog.Status -eq 'Valid' -and [string]$Signature.Status -eq 'Valid'); catalogStatus=[string]$Catalog.Status; signatureStatus=[string]$Signature.Status; subject=('CN=' + $SimpleName); certificateSha256=$Fingerprint } | ConvertTo-Json -Compress",
   ].join("\r\n") + "\r\n");
   try {
-    const result = commandRunner(powershellPath, ["-NoProfile", "-File", verifier, source, catalogPath], { encoding: "utf8", windowsHide: true, env: windowsPowerShellEnvironment(environment) });
-    if (result?.status !== 0) throw new Error(`catalog verification failed: ${String(result?.stderr ?? "").trim()}`);
-    return parseCatalogInspection(result?.stdout);
+    const result = commandRunner(powershellPath, ["-NoProfile", "-File", verifier, manifestPath, signaturePath], { encoding: "utf8", windowsHide: true, env: environment });
+    if (result?.status !== 0) throw new Error(`manifest catalog verification failed: ${String(result?.stderr ?? "").trim()}`);
+    let inspection;
+    try { inspection = JSON.parse(String(result?.stdout ?? "").trim()); } catch { throw new Error("catalog verifier returned invalid JSON"); }
+    if (typeof inspection.subject !== "string" || typeof inspection.certificateSha256 !== "string") throw new Error("catalog verifier returned incomplete identity");
+    return inspection;
   } finally {
     rmSync(temp, { recursive: true, force: true });
   }
 }
 
-function parseCatalogInspection(output) {
-  let inspection;
-  try { inspection = JSON.parse(String(output ?? "").trim()); } catch { throw new Error("catalog verifier returned invalid JSON"); }
-  if (inspection.verified !== true || typeof inspection.subject !== "string" || typeof inspection.certificateSha256 !== "string") throw new Error("catalog verifier returned incomplete identity");
-  return inspection;
-}
-
 function normalizeSubject(subject) {
   return String(subject).trim().replace(/\s*=\s*/g, "=").replace(/\s*,\s*/g, ",");
 }
 
-function windowsPowerShellEnvironment(environment) {
-  const sanitized = { ...environment };
-  for (const key of Object.keys(sanitized)) {
-    if (key.toLowerCase() === "psmodulepath") delete sanitized[key];
-  }
-  return sanitized;
-}
-
 function materializeMetadata(dir, env) {
   const existing = env("AZURE_ARTIFACT_SIGNING_METADATA") || env("AZURE_SIGNING_METADATA");
   if (existing) {
@@ -166,9 +145,7 @@ function materializeMetadata(dir, env) {
   const Endpoint = env("AZURE_ARTIFACT_SIGNING_ENDPOINT") || env("AZURE_SIGNING_ENDPOINT") || env("AZURE_ENDPOINT");
   const CodeSigningAccountName = env("AZURE_ARTIFACT_SIGNING_ACCOUNT") || env("AZURE_SIGNING_ACCOUNT_NAME") || env("AZURE_ACCOUNT");
   const CertificateProfileName = env("AZURE_ARTIFACT_SIGNING_PROFILE") || env("AZURE_CERTIFICATE_PROFILE_NAME") || env("AZURE_PROFILE");
-  if (!Endpoint || !CodeSigningAccountName || !CertificateProfileName) {
-    throw new Error("RightRelease manifest signer requires existing Azure Artifact Signing configuration");
-  }
+  if (!Endpoint || !CodeSigningAccountName || !CertificateProfileName) throw new Error("RightRelease manifest signer requires existing Azure Artifact Signing configuration");
   const path = join(dir, "metadata.json");
   writeFileSync(path, `${JSON.stringify({ Endpoint, CodeSigningAccountName, CertificateProfileName, ExcludeCredentials: EXCLUDE_CREDENTIALS }, null, 2)}\n`);
   return path;
@@ -189,9 +166,6 @@ function firstExisting(candidates) {
 }
 
 function readUserEnvironment(name, commandRunner) {
-  const result = commandRunner("powershell", ["-NoProfile", "-Command", `[Environment]::GetEnvironmentVariable('${name.replaceAll("'", "''")}','User')`], {
-    encoding: "utf8",
-    windowsHide: true,
-  });
+  const result = commandRunner("powershell", ["-NoProfile", "-Command", `[Environment]::GetEnvironmentVariable('${name.replaceAll("'", "''")}','User')`], { encoding: "utf8", windowsHide: true });
   return result?.status === 0 ? String(result.stdout ?? "").trim() : "";
 }