From cc6be10532783d366f48e4424f94b6a2fabe8406 Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Tue, 8 Sep 2026 18:54:36 +0200 Subject: [PATCH] fix(publish): read the signed bytes back as byte[], not as a wrapped Object[] The ',' operator elsewhere in this file exists because PowerShell unrolls an array RETURNED from a function; a property assignment does not unroll, so it wrapped the byte[] in an Object[] of length 1 and the upload failed converting it back. Signing itself was fine -- run 34253331703 signed all six scripts and uploaded none, so nothing reached the download alias. Added the invariant that would have caught it: signed bytes must be longer than the unsigned form, since a signature only ever adds. Co-Authored-By: Claude Opus 5 (1M context) --- .github/scripts/Publish-BootstrapScripts.ps1 | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/.github/scripts/Publish-BootstrapScripts.ps1 b/.github/scripts/Publish-BootstrapScripts.ps1 index a8c9b624..8a054304 100644 --- a/.github/scripts/Publish-BootstrapScripts.ps1 +++ b/.github/scripts/Publish-BootstrapScripts.ps1 @@ -232,8 +232,18 @@ function Set-PublishSetSignature { if ($ExpectedPublisher -and $sig.SignerCertificate.Subject -notlike $ExpectedPublisher) { throw "$($item.BlobName) was signed by '$($sig.SignerCertificate.Subject)', expected '$ExpectedPublisher'." } - $item.Bytes = ,([System.IO.File]::ReadAllBytes($path)) - Write-Host " signed $($item.BlobName) ($($item.Bytes.Length) bytes, signer $($sig.SignerCertificate.Subject.Split(',')[0]))" + # Plain assignment, NO comma operator: the ',' elsewhere in this file exists because + # PowerShell unrolls an array RETURNED from a function, which is not what a property + # assignment does -- here it would wrap the byte[] in an Object[] of length 1 and the + # upload would fail converting it back. + $signedBytes = [System.IO.File]::ReadAllBytes($path) + if ($signedBytes.Length -le $item.Bytes.Length) { + throw ("Signed $($item.BlobName) is $($signedBytes.Length) bytes but the unsigned form " + + "was $($item.Bytes.Length) -- a signature only ever adds bytes, so this is a " + + 'read-back bug, not a signing result.') + } + $item.Bytes = $signedBytes + Write-Host " signed $($item.BlobName) ($($signedBytes.Length) bytes, signer $($sig.SignerCertificate.Subject.Split(',')[0]))" } }