Add make sign target and optional envelope signing in publish workflow#2
Merged
Conversation
- scripts/sign.sh: sign dist/*.mcpb in place and regenerate .sha256 (signature is appended to the bundle, so checksums must be recomputed); soft-skips when no signing material is configured so CI can call it unconditionally - publish.yml: sign bundles before upload when MCPB_SIGNING_CERT / MCPB_SIGNING_KEY (PEM content) secrets are set - work around broken 'mcpb verify' (upstream CLI calls node-forge p7.verify which is unimplemented, so every signed bundle reports as unsigned): treat verify as advisory, assert the MCPB_SIG_END block Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wires up MCPB envelope signing as an optional publish step.
Tested locally: self-signed sign -> signature block present -> sha256 regenerated -> smoke test passes on the signed bundle (zip extraction tolerates the appended signature) -> unsign restores. Soft-skip path verified with no env set.
🤖 Generated with Claude Code