Signing: macOS removed CRL support

[dtivel]

NuGet Product Used

dotnet.exe

Product Version

.NET 5 SDK and later

Worked before?

No response

Impact

Other

Repro Steps & Context

In March 2022, I confirmed with Apple developer technical support that Apple removed CRL support from macOS starting with 10.15 (Catalina). See https://github.com/dtivel/x509-revocation-check-macos for repro steps.

NuGet packages that are author- or repository-signed with certificates without OCSP support will have permanently unavailable revocation status on macOS 10.15+.

Microsoft's current author-signing certificate and NuGet.org's current repository-signing certificate are both DigiCert certificates. Publicly trusted, commercial code signing certificates typically have both CRL and OCSP support, so as long as OCSP checks continue to work, the lack of CRL support on macOS is a non-issue.

Verbose Logs

No response

[nkolev92]

@dtivel Is there a proposal for an action that we're going to take on this?

[dtivel]

@nkolev92, no, not at this time.

[nkolev92]

Team Triage: Closing this for now.
@dtivel please feel free to reopen if needed.