4 ms·

They say on Reddit: https://old.reddit.com/r/logitech/comments/1q66q1l/just_realized_i_am_just_the_a_clown/nyeck29/?context=3 https://old.reddit.com/r/logitech/

They say on Reddit: https://old.reddit.com/r/logitech/comments/1q66q1l/just_realized_i_am_just_the_a_clown/nyeck29/?context=3 https://old.reddit.com/r/logitech/comments/1q66q1l/just_real... > There is no need for an online connection. There is some misunderstanding of what the certificate is. It has no online connection dependency. It is a developer certification that is extremely common on macOS apps. The cert only caused an issue because we let it expire. We now have strict processes in place to maintain the certification The article also says that the expired certificate breaks auto updates. What kind of certificate is this exactly?

cweagans 10mo ago
It's probably the dev cert for macOS.
heartbreak 10mo ago
The code signing certificate for macOS apps.
spondyl 10mo ago
This will be a standard Apple Developer code-signing certificate used in the signing and notarision process: https://support.apple.com/en-nz/guide/security/sec3ad8e6e53/web https://support.apple.com/en-nz/guide/security/sec3ad8e6e53/... Without a signature, Gatekeeper will throw up a dialog saying "This app could contain malware" or something to that effect. If you're using other libraries, such as the Sparkle Framework (a popular macOS Objective-C(?) library for updater logic), I believe you have to sign those as well. That said, the autoupdater may have technically been a second .app bundled within the main one and trying to launch it resulted in a failure to recognise the certificate. As far as I understand, certain compilers such as Go are signed themselves and technically fiddle with created binaries in an above-board way that they pass Apple's requirements, otherwise you would have to explicitly allow them to run every time. Having signed some open-source apps myself though, I didn't realise that certificates could retroactively expire. I haven't tried but I assumed that you would just be unable to sign new versions.
- fingerlocks 10mo ago
  This is only applies to App Store published .app bundles. Does not apply to binaries you compile yourself or non-app binaries like cli tools
  - spondyl 10mo ago
    Just to be clear, you're saying that .app bundles (and CLI tools) distributed outside of the App Store (and CLI tools) will continue to operate once the expiration date of the signing certificate has passed?
    - fingerlocks 10mo ago
      No, sorry. That's not what I'm saying. If you compile hello-world.c into a binary then it will have a placeholder (ad-hoc) signature that was signed by an "empty" key that can never expire. The Go compiler isn't doing anything special. By default all binaries are signed this way unless they were compiled with the explicit intention of App Store distribution. And the above does not apply to .app bundles.
    - lapcat 10mo ago
      Yes of course apps will continue to operate after the signing cert expires, and this is documented by Apple in several places. It would be absolutely insane if apps stopped working, because all Developer ID signing certs expire after 5 years. The valid dates for code signing certificates apply, naturally, to signing. You can't sign an app anymore with an expired certificate, but if an old app was signed with a cert that was valid at the time of signing, then the app will continue functioning forever. This issue was just a dumb screwup by Logitech. If apps stopped functioning when the signing cert expired, you'd see Mac apps dying all the time.
      - fingerlocks 10mo ago
        This only applies to distribution certificate signed apps, not true in the general sense.

cweagans 10mo ago

It's probably the dev cert for macOS.

heartbreak 10mo ago

The code signing certificate for macOS apps.

spondyl 10mo ago

This will be a standard Apple Developer code-signing certificate used in the signing and notarision process: https://support.apple.com/en-nz/guide/security/sec3ad8e6e53/web https://support.apple.com/en-nz/guide/security/sec3ad8e6e53/... Without a signature, Gatekeeper will throw up a dialog saying "This app could contain malware" or something to that effect. If you're using other libraries, such as the Sparkle Framework (a popular macOS Objective-C(?) library for updater logic), I believe you have to sign those as well. That said, the autoupdater may have technically been a second .app bundled within the main one and trying to launch it resulted in a failure to recognise the certificate. As far as I understand, certain compilers such as Go are signed themselves and technically fiddle with created binaries in an above-board way that they pass Apple's requirements, otherwise you would have to explicitly allow them to run every time. Having signed some open-source apps myself though, I didn't realise that certificates could retroactively expire. I haven't tried but I assumed that you would just be unable to sign new versions.

fingerlocks 10mo ago
This is only applies to App Store published .app bundles. Does not apply to binaries you compile yourself or non-app binaries like cli tools
- spondyl 10mo ago
  Just to be clear, you're saying that .app bundles (and CLI tools) distributed outside of the App Store (and CLI tools) will continue to operate once the expiration date of the signing certificate has passed?
  - fingerlocks 10mo ago
    No, sorry. That's not what I'm saying. If you compile hello-world.c into a binary then it will have a placeholder (ad-hoc) signature that was signed by an "empty" key that can never expire. The Go compiler isn't doing anything special. By default all binaries are signed this way unless they were compiled with the explicit intention of App Store distribution. And the above does not apply to .app bundles.
  - lapcat 10mo ago
    Yes of course apps will continue to operate after the signing cert expires, and this is documented by Apple in several places. It would be absolutely insane if apps stopped working, because all Developer ID signing certs expire after 5 years. The valid dates for code signing certificates apply, naturally, to signing. You can't sign an app anymore with an expired certificate, but if an old app was signed with a cert that was valid at the time of signing, then the app will continue functioning forever. This issue was just a dumb screwup by Logitech. If apps stopped functioning when the signing cert expired, you'd see Mac apps dying all the time.
    - fingerlocks 10mo ago
      This only applies to distribution certificate signed apps, not true in the general sense.