[rudycelekli]

The Windows release checker currently treats a nonzero certificate-table size as proof that the table is present, ignoring its file offset. A table entry with offset zero or a range extending beyond EOF can therefore produce all executables signed even though its declared certificate bytes are absent.

Check that the entry has a nonzero file offset and that its entire declared range fits inside the executable before reporting a nonzero table size. This remains a certificate-table presence check; it does not validate Authenticode signatures, trust chains, PE structure, or certificate contents.

Validation: python3 -m unittest discover -s .github/tests -v passes two methods covering 10 PE32/PE32+ fixture cases via the actual checker subprocess over ZIP archives. Six invalid fixture cases are accepted by the unchanged upstream script and rejected with the fix. The accepted fixtures contain synthetic certificate bytes and establish only range-presence behavior.

Hosted validation at exact head 69b18a2bfe4296ff5abbfcad76039d817f018d23: the required Linux, macOS, Windows, and fast-check jobs passed (17 successful check runs, 20 skipped; pre-commit.ci also successful). The local cargo run -- hook pre-merge --yes hook was not validated in the minimal checkout. Focused Python checker tests passed locally as described above. This remains a certificate-table byte-presence check, not signature or trust validation.

AI disclosure: implementation, regression tests, and this description were prepared with Codex and reviewed by a separate Codex agent. No human-authorship or human-review claim is made.
Review follow-up: run .github/tests with standard-library unittest discovery in the required PR fast-checks job, immediately after checkout. This makes the checker regressions continuous; workflow triggers, permissions, environment gates, and other steps are unchanged. The exact CI command passes locally (2 methods / 10 fixture cases), and PyYAML 6.0.3 validates the workflow. Hosted checks for the new head are pending; the successful hosted results above refer to the explicitly named earlier head.

[worktrunk-bot]

The new regression tests are only run by the manual unittest discover command. The repository's CI and pre-merge commands do not invoke .github/tests, so a later change could restore the false-green certificate check while PR checks still pass. Please run this suite in a PR CI job so the regression cases protect the checker continuously.