Certificate is not valid

[pbek]

Hello my friends at NC. 😸

Steps to reproduce

1. install NC 12 from git master branch
2. install ownbackup (or qownnotesapi) from NC app store
3. execute php occ integrity:check-app ownbackup

Expected behaviour

No error should be thrown. :)

Actual behaviour

  - EXCEPTION:
    - class: OC\IntegrityCheck\Exceptions\InvalidSignatureException
    - message: Certificate is not valid.

If you repeat the same test with NC 11, no error will be shown.

I got the certificate for signing the app with occ integrity:sign-app from ownCloud back in the days where NC was not "born" and I still need that certificate for signing the app for ownCloud. I think it is not very desirable to maintain two different releases of an app for oC and NC because of a certificate.

Was it really necessary to disallow the oC certificate in 5a6e29e (if that was the point when it happend)?

Happy weekend and kind regards from Graz.

[MorrisJobke]

cc @LukasReschke

[LukasReschke]

For security reasons, we had to stop shipping another root authority not under our control. If you want to use the OCC code signing tool you need to either use the Nextcloud issued certificate or none at all. (updates from the Nextcloud app store are protected using a more secure approach than the integrity checker, we check the whole TAR file)

Sorry that I don't have better news here. The easiest would probably be to have two bundles one with code integrity check file in /appinfo/signatures.json and one without code integrity check file.

[pbek]

@LukasReschke, so in future all app developers have to maintain a release with an /appinfo/signatures.json, that was signed by ownCloud and a 2nd release without /appinfo/signatures.json for Nextcloud. Is that correct? That also means installs from git directly will not work any more...

When I remove remove the /appinfo/signatures.json and execute php occ integrity:check-app ownbackup I get:

  - EXCEPTION:
    - class: OC\IntegrityCheck\Exceptions\InvalidSignatureException
    - message: Signature data not found.

[pbek]

...or is a the integrity check not mandatory in NC 12 when the app was downloaded from the NC store?

[pbek]

ping @LukasReschke