From 64ca267384443dc9a052a4947f28fda1fb5ca6b9 Mon Sep 17 00:00:00 2001
From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com>
Date: Wed, 29 Jul 2026 16:36:46 +0200
Subject: [PATCH] fix: pass signature targets without shell interpolation

---
 SOURCE_MANIFEST.txt                   | 2 +-
 scripts/verify-release-signatures.mjs | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/SOURCE_MANIFEST.txt b/SOURCE_MANIFEST.txt
index 5ccfab6..3429e9f 100644
--- a/SOURCE_MANIFEST.txt
+++ b/SOURCE_MANIFEST.txt
@@ -135,7 +135,7 @@ f6f89e893195b9c8ef0ff01e256005b9b3cd7d4a278722979a5e0e616c86a89f          1733
 b83d443f5724ac15393567f3a688aed8315fbe3e5966832c864a9466e0669464          8102  scripts/publish-binary-release.cjs
 444b397d515d65a7ee59d3088cba869cbb812d2b8cc18fc5d255105e3edb58c2          1468  scripts/serve-demo.mjs
 4393f7dc5f417e6d601a68238f4e26791799a3634acec228fe4d79deaee85eb5          3109  scripts/validate-installed-connections.cjs
-eb23800559dc9c71f40a1584e287c2ca26322ef8673c8179448871fb0d082220          1837  scripts/verify-release-signatures.mjs
+d2dd98055e50f11b4e1484531e43fb5ac7f876bea4b9cf5bca2cb0a15022b60a          1913  scripts/verify-release-signatures.mjs
 20cc93c86efaf4d23851225e031639b093cafb23dabb083e1804cade17651e82         16542  scripts/verify.mjs
 0b9f03ba3c67ff7cdb2916a902ad8ce25e81a7c90b210e4ae52d2ad029efabf3          2353  scripts/write-release-checksums.mjs
 619515f524cb89960370ffcbd3fafd3c0e178b95f69c5868b1dd44777f23ec1e          2081  setup-windows.ps1
diff --git a/scripts/verify-release-signatures.mjs b/scripts/verify-release-signatures.mjs
index 108fe1a..0e11359 100644
--- a/scripts/verify-release-signatures.mjs
+++ b/scripts/verify-release-signatures.mjs
@@ -12,8 +12,8 @@ if (signedRelease && !expectedPublisher) throw new Error("FORGEFLOW_EXPECTED_PUB
 
 const artifacts = ["Setup", "Portable"].map((kind) => path.join(root, "dist", `ForgeFlow-${kind}-${pkg.version}-win-x64.exe`));
 for (const artifact of artifacts) {
-  const script = `$s=Get-AuthenticodeSignature -LiteralPath $args[0]; [pscustomobject]@{Status=$s.Status.ToString();Subject=$s.SignerCertificate.Subject;Thumbprint=$s.SignerCertificate.Thumbprint;TimestampSubject=$s.TimeStamperCertificate.Subject}|ConvertTo-Json -Compress`;
-  const { stdout } = await execFileAsync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script, artifact], { windowsHide: true });
+  const script = `$s=Get-AuthenticodeSignature -LiteralPath $env:FORGEFLOW_SIGNATURE_TARGET; [pscustomobject]@{Status=$s.Status.ToString();Subject=$s.SignerCertificate.Subject;Thumbprint=$s.SignerCertificate.Thumbprint;TimestampSubject=$s.TimeStamperCertificate.Subject}|ConvertTo-Json -Compress`;
+  const { stdout } = await execFileAsync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { windowsHide: true, env: { ...process.env, FORGEFLOW_SIGNATURE_TARGET: artifact } });
   const result = JSON.parse(stdout.trim());
   const valid = result.Status === "Valid" && Boolean(result.TimestampSubject);
   const publisherMatches = !expectedPublisher || String(result.Subject || "").includes(expectedPublisher);