From 44aa452a76d40f26b17348878c92aeffa33f8f7e Mon Sep 17 00:00:00 2001
From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com>
Date: Sat, 1 Aug 2026 14:35:59 +0200
Subject: [PATCH] fix: tolerate unavailable unsigned signature inspection

---
 SOURCE_MANIFEST.txt                   | 4 ++--
 scripts/verify-release-signatures.mjs | 9 ++++++++-
 tests/update-service.test.mjs         | 1 +
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/SOURCE_MANIFEST.txt b/SOURCE_MANIFEST.txt
index 8bbed1e..4469ba5 100644
--- a/SOURCE_MANIFEST.txt
+++ b/SOURCE_MANIFEST.txt
@@ -119,7 +119,7 @@ b83d443f5724ac15393567f3a688aed8315fbe3e5966832c864a9466e0669464          8102
 444b397d515d65a7ee59d3088cba869cbb812d2b8cc18fc5d255105e3edb58c2          1468  scripts/serve-demo.mjs
 c76507857292c5713e1c699cf02e24b80265da39af2cecd148034bdb874adbb6          5246  scripts/test-authenticode-chain.ps1
 4393f7dc5f417e6d601a68238f4e26791799a3634acec228fe4d79deaee85eb5          3109  scripts/validate-installed-connections.cjs
-50880ac76b7d681dc65019dc794efc3cea4ffd379507fe0518985312f5b39304          2096  scripts/verify-release-signatures.mjs
+e6127e1e62f39c70ddb1abf72f4d7e7b8e3f19ff1f219e1a3660353c2e0cdfac          2411  scripts/verify-release-signatures.mjs
 c1763bad24b747051ad18d911ba9c7176882663e3b6ce9921a2f8b1aae056bd7         18156  scripts/verify.mjs
 0b9f03ba3c67ff7cdb2916a902ad8ce25e81a7c90b210e4ae52d2ad029efabf3          2353  scripts/write-release-checksums.mjs
 619515f524cb89960370ffcbd3fafd3c0e178b95f69c5868b1dd44777f23ec1e          2081  setup-windows.ps1
@@ -224,7 +224,7 @@ e631e9ca49a5bac7075860aac2ff4d377a32a78377b70e06ecf833f0f192fd5f         11552
 0d1bc4d623ce299337736c577ec61c8ffd6974ebe20335b72838d10eae35ecb1          7993  tests/ssh-service.test.mjs
 8a6a8477eb94b85ccef18cddd2640afb0d1eafa679c96bc7de20428d5d69e1be          1794  tests/tool-invocation.test.mjs
 4182b61e395aff310b9a964c973a43c3566df0b44c454054c3abdd9459e86e3b         49134  tests/unraid-deployment.test.mjs
-c93d9706eb206b17db8ba490a1e93067f654c66595325f34532d0b1d7617fedc         19691  tests/update-service.test.mjs
+edec1007826bff6b5457fca603d8c816a9e1eedb3ce398269f151144ae3d2197         19764  tests/update-service.test.mjs
 9cea5c1d5ba3e0972a0b5c7236cf1f7c5616373e0a39ea4a492ecebf70452e40           948  tests/validation.test.mjs
 7ef4d4b9f5f3e6979293b29d571ce0e39f83197f3cade2d999a9cea7bacdd84d          1781  tests/zip-writer.test.mjs
 8f36b542736f2933bad8b9464ad7fa37b68196009c81cf702ce3b677cd637dea           767  UPDATE_FROM_0.3.2.md
diff --git a/scripts/verify-release-signatures.mjs b/scripts/verify-release-signatures.mjs
index a4594a9..29d3467 100644
--- a/scripts/verify-release-signatures.mjs
+++ b/scripts/verify-release-signatures.mjs
@@ -14,7 +14,14 @@ if (signedRelease && !/^CN=.+/i.test(expectedPublisher)) throw new Error("FORGEF
 const artifacts = ["Setup", "Portable"].map((kind) => path.join(root, "dist", `ForgeFlow-${kind}-${pkg.version}-win-x64.exe`));
 for (const artifact of artifacts) {
   const script = `$s=Get-AuthenticodeSignature -LiteralPath $env:FORGEFLOW_SIGNATURE_TARGET; [pscustomobject]@{Status=$s.Status.ToString();Subject=$s.SignerCertificate.Subject;Thumbprint=$s.SignerCertificate.Thumbprint;TimestampSubject=$s.TimeStamperCertificate.Subject}|ConvertTo-Json -Compress`;
-  const { stdout } = await execFileAsync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { windowsHide: true, env: { ...process.env, FORGEFLOW_SIGNATURE_TARGET: artifact } });
+  let stdout;
+  try {
+    ({ stdout } = await execFileAsync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { windowsHide: true, env: { ...process.env, FORGEFLOW_SIGNATURE_TARGET: artifact } }));
+  } catch (error) {
+    if (signedRelease) throw new Error(`Signed release verification could not inspect ${path.basename(artifact)}: ${error.message}`);
+    console.log(`${path.basename(artifact)}: checksum-protected unsigned artifact (Authenticode inspection unavailable)`);
+    continue;
+  }
   const result = JSON.parse(stdout.trim());
   const valid = result.Status === "Valid" && Boolean(result.TimestampSubject);
   const publisherMatches = !expectedPublisher || String(result.Subject || "").trim() === expectedPublisher;
diff --git a/tests/update-service.test.mjs b/tests/update-service.test.mjs
index 7531a1b..c52cfd4 100644
--- a/tests/update-service.test.mjs
+++ b/tests/update-service.test.mjs
@@ -518,6 +518,7 @@ test("Windows release pipeline preserves optional signing checks and emits prove
   assert.match(signatureSource, /FORGEFLOW_EXPECTED_PUBLISHER/);
   assert.match(signatureSource, /TimestampSubject/);
   assert.match(signatureSource, /Signed release verification failed/);
+  assert.match(signatureSource, /Authenticode inspection unavailable/);
   assert.match(checksumSource, /provenance\.json/);
   assert.match(checksumSource, /sbom\.cdx\.json/);
   assert.match(checksumSource, /CycloneDX/);