From 7d80e9f586b3b317736bfe0194d7d1d396fe0551 Mon Sep 17 00:00:00 2001 From: Spencer McGuire Date: Tue, 16 Jun 2026 17:43:37 -0600 Subject: [PATCH] =?UTF-8?q?docs:=20ship=20unsigned=20=E2=80=94=20mcpb=20si?= =?UTF-8?q?gn=20corrupts=20the=20bundle=20(CLI=20bug)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 --- mcp-extension/README.md | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/mcp-extension/README.md b/mcp-extension/README.md index b65bb81..f2841c1 100644 --- a/mcp-extension/README.md +++ b/mcp-extension/README.md @@ -84,11 +84,19 @@ npx -y @anthropic-ai/mcpb validate manifest.json npx -y @anthropic-ai/mcpb info ms-todo.mcpb ``` -### Optional: sign the extension +### Signing — currently disabled -Unsigned extensions install with a "not verified" warning. You can self-sign so -the warning shows your identity (full removal of the warning needs a CA-issued -cert your org trusts): +Unsigned extensions install with a "not verified" warning, which is fine for +internal distribution (just click through it). + +> ⚠️ **Do not sign with `mcpb sign` right now.** As of `@anthropic-ai/mcpb` 2.1.2 +> (and 2.0.x/2.1.x), `sign` corrupts the bundle: it writes an invalid ZIP EOCD +> comment length, so Claude Desktop fails to open it ("Invalid comment length … +> extra bytes at the end of the file") and `mcpb verify` reports it as unsigned. +> Ship the **unsigned** bundle until this is fixed upstream. + +When signing works again (or with a CA-trusted cert deployed to your fleet), the +command is: ```bash npx -y @anthropic-ai/mcpb sign ms-todo.mcpb --cert cert.pem --key key.pem