ci: verify artifact signatures before upload

Add per-cell signature gates that run after the build and before upload, so a
bad signature fails the cell instead of publishing an artifact we only assume
is signed. Each gate is placed where a failure is still fixable — in CI, on the
build that produced it — rather than surfacing downstream at a store upload or
on a user's machine:

- installers: signtool verify /pa (validity + trust chain + timestamp) on each
  Setup.exe and the MSI, plus a signer-identity check that it's our cert.
- appx: assert the packages are NOT signed — the Microsoft Store re-signs during
  certification, so this catches the inverse regression.
- dmg: mount the image and validate the .app inside (stapler validate + spctl
  --assess --type execute). electron-builder staples the .app, not the dmg
  container, so the app is what carries the ticket and what Gatekeeper checks.
- mas: pkgutil confirms the package is signed with Apple distribution certs,
  catching a broken signing/match setup before App Store Connect upload. No
  spctl here — MAS distribution certs aren't Gatekeeper-valid for direct launch.
- mas-dev: codesign validity plus an embedded development provisioning profile,
  the two things a sandboxed MAS build needs to launch on a registered device.

These are automated regression gates, not a replacement for on-device checks
(SmartScreen reputation, UAC publisher string, ARM64 native execution).

Author: cwillisf

.github/workflows/release-candidate.yml

@@ -171,6 +171,100 @@ jobs:
           cd dist/mas-dev-universal
           ditto -v -c -k --sequesterRsrc --keepParent --zlibCompressionLevel 9 \
             Scratch*.app ../mas-dev-universal-${NPM_APP_VERSION}.zip
+      # Signature checks run before upload and gate the job: a bad signature fails the cell
+      # (and skips its uploads) rather than publishing an artifact we only think is signed.
+      # These catch regressions automatically; they don't replace on-device checks (SmartScreen
+      # reputation, the UAC publisher string, ARM64 native execution), which still need real hardware.
+      - name: Verify Windows signatures
+        if: matrix.target == 'installers'
+        shell: pwsh
+        run: |
+          $signtool = Get-ChildItem 'C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe' -ErrorAction SilentlyContinue |
+            Sort-Object FullName -Descending | Select-Object -First 1
+          if (-not $signtool) { Write-Host '::error::signtool.exe not found on runner'; exit 1 }
+          $files = @(Get-ChildItem -Path dist -Filter 'Scratch *Setup.exe') +
+                   @(Get-ChildItem -Path dist -Filter 'Scratch *.msi')
+          if (-not $files) { Write-Host '::error::No signed installers found to verify'; exit 1 }
+          $failed = $false
+          foreach ($f in $files) {
+            # Authoritative Authenticode check: validity + trust chain + any RFC3161 timestamp.
+            $out = & $signtool.FullName verify /pa /v $f.FullName 2>&1 | Out-String
+            Write-Host $out
+            if ($LASTEXITCODE -ne 0) { Write-Host "::error::signtool verify failed for $($f.Name)"; $failed = $true; continue }
+            # Signer must be us, not a stray or test certificate.
+            $sig = Get-AuthenticodeSignature -FilePath $f.FullName
+            $signer = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { '(none)' }
+            if ($signer -notmatch 'Scratch Foundation') { Write-Host "::error::$($f.Name) signed by unexpected certificate: $signer"; $failed = $true; continue }
+            # A timestamp lets the signature outlive the cert. RFC3161 timestamps don't always populate
+            # TimeStamperCertificate, so warn (not fail) if neither it nor signtool's output shows one.
+            if (-not $sig.TimeStamperCertificate -and $out -notmatch 'imestamp') { Write-Host "::warning::$($f.Name) may not be timestamped" }
+            Write-Host "OK: $($f.Name) verified (signer=$signer)"
+          }
+          if ($failed) { exit 1 }
+      - name: Verify AppX is unsigned
+        if: matrix.target == 'appx'
+        shell: pwsh
+        run: |
+          $files = Get-ChildItem -Path dist -Filter 'Scratch *.appx'
+          if (-not $files) { Write-Host '::error::No AppX packages found to verify'; exit 1 }
+          $failed = $false
+          foreach ($f in $files) {
+            # AppX must stay unsigned: the Microsoft Store re-signs during certification, and a
+            # build-time signature here would mean signExts/our wrapper gating regressed.
+            $sig = Get-AuthenticodeSignature -FilePath $f.FullName
+            if ($sig.Status -ne 'NotSigned') { Write-Host "::error::$($f.Name) is unexpectedly signed (status=$($sig.Status))"; $failed = $true }
+            else { Write-Host "OK: $($f.Name) is unsigned as expected" }
+          }
+          if ($failed) { exit 1 }
+      - name: Verify macOS notarization
+        if: matrix.target == 'dmg'
+        run: |
+          DMG="`ls dist/Scratch*.dmg | head -n1`"
+          if [ -z "$DMG" ]; then echo "::error::No dmg found to verify"; exit 1; fi
+          echo "Verifying $DMG"
+          # electron-builder notarizes and staples the .app, then builds the DMG from it; the DMG
+          # container itself is not stapled (and never has been in our releases). So verify the .app
+          # inside — that's what Gatekeeper checks when a user launches, and what carries the ticket.
+          MOUNT="`hdiutil attach "$DMG" -nobrowse -readonly | tail -n1 | sed 's|.*\(/Volumes/\)|\1|'`"
+          if [ -z "$MOUNT" ]; then echo "::error::Failed to mount $DMG"; exit 1; fi
+          trap 'hdiutil detach "$MOUNT" -quiet || true' EXIT
+          APP="`ls -d "$MOUNT"/*.app | head -n1`"
+          if [ -z "$APP" ]; then echo "::error::No .app found inside $DMG"; exit 1; fi
+          echo "Verifying $APP"
+          # Notarization ticket must be stapled so Gatekeeper passes without a network round-trip.
+          xcrun stapler validate "$APP"
+          # Gatekeeper assessment: would a user's Mac allow launching this app?
+          spctl --assess --type execute --verbose=2 "$APP"
+      - name: Verify MAS signature
+        if: matrix.target == 'mas'
+        run: |
+          PKG="`ls dist/mas-universal/Scratch*.pkg 2>/dev/null | head -n1`"
+          if [ -z "$PKG" ]; then echo "::error::No MAS pkg found to verify"; exit 1; fi
+          echo "Verifying $PKG"
+          # MAS builds ARE signed at build time, with Apple App Store distribution certs — unlike
+          # AppX, which ships unsigned for the Microsoft Store. Confirm the pkg is signed here, where
+          # a broken signing/match setup is fixable, rather than letting it surface only at App Store
+          # Connect upload. spctl --assess is intentionally not used: MAS distribution certs are not
+          # Gatekeeper-valid for direct execution, so a correct MAS build fails spctl by design.
+          SIG="`pkgutil --check-signature "$PKG" 2>&1 || true`"
+          echo "$SIG"
+          echo "$SIG" | grep -q "Status: signed" || { echo "::error::$PKG is not validly signed"; exit 1; }
+      - name: Verify mas-dev signature
+        if: matrix.target == 'mas-dev'
+        run: |
+          APP="`ls -d dist/mas-dev-universal/Scratch*.app 2>/dev/null | head -n1`"
+          if [ -z "$APP" ]; then echo "::error::No mas-dev .app found to verify"; exit 1; fi
+          echo "Verifying $APP"
+          # A Mac App Store build is sandboxed: it only launches with a valid signature AND an
+          # embedded development provisioning profile authorizing the test device. If either is
+          # missing the .app won't run locally — and macOS reports only an opaque "damaged" error,
+          # so the cause is far easier to find here than after download. (No spctl/notarization
+          # check: mas-dev is signed with a development cert, not notarized, so it never passes
+          # Gatekeeper assessment — running it requires a registered device, not this gate.)
+          codesign --verify --deep --strict --verbose=2 "$APP"
+          codesign -dvv "$APP" 2>&1 | grep -i authority || true
+          test -f "$APP/Contents/embedded.provisionprofile" \
+            || { echo "::error::$APP has no embedded provisioning profile; it will not launch on a test device"; exit 1; }
       # One artifact per build output, so each cell uploads only what it produced.
       # The 'installers' cell builds NSIS x3 + MSI in one pass and uploads them as four
       # separate artifacts; the 'appx' cell builds three AppX archs and uploads three.