[jstar0]

Summary

Fixes #277 by verifying detached CMS signatures with platform tooling instead of node-forge's unimplemented PKCS#7 verification method.

Changes

• Verify CMS signatures with .NET SignedCms on Windows and OpenSSL on macOS/Linux.
• Update the ZIP EOCD comment length before signing new bundles.
• Verify legacy bundles by checking both the stored bytes and the pre-patch EOCD length used by earlier signers.
• Return distinct unsigned, invalid, and untrusted statuses while preserving signed and self-signed; verifier launch and runtime errors remain verification errors.
• Show invalid signatures and untrusted signer certificates separately in mcpb verify and mcpb info.

Compatibility

The signature block format is unchanged, and bundles produced by the previous EOCD update order remain verifiable. McpbSignatureInfoSchema now includes invalid and untrusted; callers that exhaustively handle status should handle these additional values.

Verification

• yarn test --runInBand --silent — 8 suites, 126 tests passed
• yarn lint — passed
• yarn build — passed
• git diff --check — passed

Verification was run on macOS. The Windows SignedCms branch still needs Windows CI.

Related work

PR #255 also addresses signature verification for #277 with a different CMS verification approach.

[jstar0]

Could a maintainer approve the Test workflow run for head df14718? GitHub reports run 37171676235 as action_required with no jobs started. The local macOS suite, lint, and build pass, but the Windows SignedCms implementation still needs the repository's Windows job. This PR overlaps #255; it also preserves bundles created by the previous signer and returns distinct invalid and untrusted statuses. I’m happy to consolidate if maintainers prefer one implementation.