2 ms·

Judging from the script linked here (https://github.com/docker/for-mac/issues/7527 https://github.com/docker/for-mac/issues/7527), Docker’s Developer ID cert wa

Judging from the script linked here (https://github.com/docker/for-mac/issues/7527 https://github.com/docker/for-mac/issues/7527), Docker’s Developer ID cert was revoked by Apple. Are…they going to explain why/how that happened?

js2 2y ago
It's also possible someone with access to the Docker team account on the Apple developer portal revoked it by accident. The access controls on the Apple developer portal are not particularly fine grained, there is no audit trail, and many actions cannot be undone.
- agsnu 2y ago
  That’s what I thought at first, but actually this seems to be not the case for Developer ID certificates? https://developer.apple.com/help/account/reference/revoking-privileges/ https://developer.apple.com/help/account/reference/revoking-...
  - mrpippy 2y ago
    Correct. Developer ID certs cannot be revoked self-service, you have to email Apple.
- joshstrange 2y ago
  Gets out soapbox App Store Developer portal is a mess. I manage 10+ accounts and I hate using it so much (Google Play isn’t better, just sucks in different ways). I also have access to an enterprise account and “nerve racking” does not even begin to describe what interacting with the portal is like. A single click with a badly worded confirmation step is the ONLY thing keeping your released app in the field from shutting down until you get a new version out. Let me say that again: if you delete your signing cert then your app will not open on devices anymore. No way to communicate to users to update or let them know anything at all. Just dead. Even if you avoid making that mistake, the cert rotation dance is horrible and terrifying, it doesn’t help that Apple’s docs and help text are completely useless. It doesn’t help that most info you find online is for AppStore certs/signing and not Enterprise certs/signing (the _massive_ difference being you can revoke a cert for an App Store app and it keeps working). There is no wording about max certs on their webpage so in most cases you just have to try something in the portal and see if it fails. It’s even more fun because every click in the cert rotation process is a gamble and so after you’ve worked yourself up to finally clicking the button you then run right into an error and you have to rethink your strategy. Again, your entire business potentially hangs in the balance if you pick wrong, have fun! I understand what Apple is trying to accomplish and that’s fine but they need better messaging. They need to make it clear what the effects of revoking/deleting certs/profiles is. They need to make the connections between certs and profiles more obvious. The whole UI is horrible and flakey on top of that.

js2 2y ago

It's also possible someone with access to the Docker team account on the Apple developer portal revoked it by accident. The access controls on the Apple developer portal are not particularly fine grained, there is no audit trail, and many actions cannot be undone.

agsnu 2y ago
That’s what I thought at first, but actually this seems to be not the case for Developer ID certificates? https://developer.apple.com/help/account/reference/revoking-privileges/ https://developer.apple.com/help/account/reference/revoking-...
- mrpippy 2y ago
  Correct. Developer ID certs cannot be revoked self-service, you have to email Apple.
joshstrange 2y ago
Gets out soapbox App Store Developer portal is a mess. I manage 10+ accounts and I hate using it so much (Google Play isn’t better, just sucks in different ways). I also have access to an enterprise account and “nerve racking” does not even begin to describe what interacting with the portal is like. A single click with a badly worded confirmation step is the ONLY thing keeping your released app in the field from shutting down until you get a new version out. Let me say that again: if you delete your signing cert then your app will not open on devices anymore. No way to communicate to users to update or let them know anything at all. Just dead. Even if you avoid making that mistake, the cert rotation dance is horrible and terrifying, it doesn’t help that Apple’s docs and help text are completely useless. It doesn’t help that most info you find online is for AppStore certs/signing and not Enterprise certs/signing (the _massive_ difference being you can revoke a cert for an App Store app and it keeps working). There is no wording about max certs on their webpage so in most cases you just have to try something in the portal and see if it fails. It’s even more fun because every click in the cert rotation process is a gamble and so after you’ve worked yourself up to finally clicking the button you then run right into an error and you have to rethink your strategy. Again, your entire business potentially hangs in the balance if you pick wrong, have fun! I understand what Apple is trying to accomplish and that’s fine but they need better messaging. They need to make it clear what the effects of revoking/deleting certs/profiles is. They need to make the connections between certs and profiles more obvious. The whole UI is horrible and flakey on top of that.