feat: add fix-signature subcommand for externally signed bundles

[bryan-anthropic]

Summary

Enterprise HSM signers (GaraSign, SignServer, Venafi, Azure SignTool) append PKCS#7 signatures after the ZIP EOCD without updating comment_length. Claude Desktop's adm-zip parser strictly validates this field and rejects signed bundles with:

Failed to preview extension: Failed to read or unzip file:
Invalid comment length. Expected: 2774. Found: 0.
Are there extra bytes at the end of the file?

PR #204 fixed this for mcpb sign, but external signers don't do ZIP surgery — and arguably shouldn't need to. This PR adds mcpb fix-signature as a post-signing fixup step that any enterprise can add to their pipeline.

What it does

mcpb fix-signature <bundle.mcpb> sets the ZIP EOCD comment_length field to encompass the trailing signature bytes. This makes the file a spec-valid ZIP (signature lives in the ZIP comment field) while preserving the signature intact.

• Reuses findEocdOffset() and extractSignatureBlock() from sign.ts — no new ZIP parsing code
• No-ops if the bundle was already signed by mcpb sign (comment_length already correct)
• Errors on unsigned files
• Guards against signatures exceeding the 64KB ZIP comment limit

Validation

Tested end-to-end with a GaraSign-signed MCPB:

Validator	Before fix	After fix
adm-zip (Claude Desktop)	FAIL — Invalid comment length	PASS
unzip -t	PASS (lenient)	PASS
Python zipfile	PASS (lenient)	PASS — reads comment with signature
Claude Desktop install	FAIL	PASS
Signature intact	—	Yes — MCPB_SIG_V1 + PKCS#7 + MCPB_SIG_END unchanged
Bytes changed	—	Exactly 2 (EOCD offset+20, little-endian uint16)

Prior art

No other signed-ZIP format appends after EOCD without owning the signing pipeline:

Format	Signature location	External-signer-friendly?
APK v2+	Block before central directory	Yes
Chrome CRX3	Header prepended before ZIP	Yes
VSIX	Separate .sigzip sidecar	Yes
MCPB	Appended after EOCD	No — requires this fixup

This subcommand bridges the gap until a signer-friendly format lands in Signatures V2.

Usage

# Enterprise signing pipeline:
garasign sign bundle.mcpb          # External HSM signs the bundle
mcpb fix-signature bundle.mcpb     # Fix EOCD for Claude Desktop compatibility
mcpb verify bundle.mcpb            # Verify signature (requires #212)

Test plan

• 3 new tests in sign.e2e.test.ts (222 total, all passing)
  • Fix externally-signed bundle with zeroed comment_length
  • No-op on bundle already fixed by mcpb sign
  • Error on unsigned file
• adm-zip validation of fixed bundle
• Claude Desktop install of fixed bundle
• Signature bytes verified intact after fix

Relates to #204, #21, #194

🤖 Generated with Claude Code

[claude]

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit in Settings → Usage.

Once credits are available, reopen this pull request to trigger a review.