crypto/x509: code signing certificates fail to verify in macOS Ventura and later

[sinukus]

What version of Go are you using (go version)?

 go1.22 (darwin/arm64)

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
macOS Ventura 13.6.1, M1 Max

What did you do?

When trying to validate a code signing certificate chain with a public certificate authority. The OS responds with "certificate is not standards compliant" on Ventura or later. Earlier versions of mac OS do not fail.

This is due to go assuming all certificates are SSL certificate, and use a SSL policy when validating the chain

What did you expect to see?

I expected the chain to validate with signature is valid, signing date: ..etc

What did you see instead?

"certificate is not standards compliant"

[mauri870]

If possible could you share a minimal code that reproduces the issue? Thanks

[gopherbot]

Change https://go.dev/cl/540695 mentions this issue: X509: fix codesigning on macOS Ventura

[gopherbot]

Timed out in state WaitingForInfo. Closing.

(I am just a bot, though. Please speak up if this is a mistake or you have the requested information.)