Release 4.2.4 for the ownCloud 10.16.5 line (needs legacy G1 signing)

[oc-tmueller]

@timar — a 4.2.4 release is necessary for the ownCloud 10.16.5 line, and it needs the legacy
G1 signing key, which we do not hold. Could Collabora cut and sign it?

Why it is needed

PR #621 on the 4.2 branch makes the editor only navigate to a validated absolute http(s)
return URL, and narrows the origin WOPI post messages are exchanged with. It is in no released
version: v4.2.3 was tagged 2026-05-18 and #621 landed after it. ownCloud 10.16.5 is upcoming,
so the 4.2 line needs a release to carry it.

What is already prepared

• chore: release 4.2.4 #640 is merged: appinfo/info.xml on 4.2 reads 4.2.4 and CHANGELOG.md has its
  [4.2.4] section (the fix above plus the dependency, test-harness and build work since 4.2.3).
• The branch is green, and no v4.2.4 tag exists yet.
• ci: remove the release workflow from 4.2, it cannot sign for oc10 #642 removes the release workflow from 4.2 — see below for why — so a tag on this branch will
  not produce a wrong artifact.

Why we cannot cut it ourselves

ownCloud 10 and 11 use different code-signing generations, and we only have a G2 key:

	envelope	trust store
oc10	{hashes, signature, certificate} — legacy G1	single resources/codesigning/root.crt
oc11	{v, alg, hashes, signature, certificates} — G2	roots/root-g{1,2}.crt + intermediates/

10.16's lib/private/IntegrityCheck/Checker.php reads certificate in the singular and has no
code path for a v/certificates envelope, nor for the ECDSA P-384 signature G2 uses. Our CI
release workflow signs with ocsign, which emits G2 only (--path --key --cert --chain --core --allow-vcs --out --dry-run — no legacy mode).

Demonstrated with a controlled pair rather than a single data point — same command, two
envelope generations, two servers:

artifact	oc10 server:10.16.4	oc11 server:11.0.0
4.2.3 marketplace build — G1 envelope, max-version="10"	exit 0, no findings	exit 0, no findings
4.3.1 release build — G2 envelope, min/max-version="11"	exit 1 (below)	exit 0, no findings

$ php occ integrity:check-app richdocuments     # G2 artifact, oc10 10.16.4
Undefined index: certificate at /var/www/owncloud/lib/private/IntegrityCheck/Checker.php#353
  - EXCEPTION:
    - class: OC\IntegrityCheck\Exceptions\InvalidSignatureException
    - message: App Certificate is not valid.
exit=1

The top row matters: an app declaring max-version="10" verifies fine on 11.0.0, so
integrity:check-app does not consult platform compatibility — the failure is the envelope
format, not a version rejection. The failing cell is the only one, and it fails at the line that
reads certificate.

For reference, the marketplace
tarball for 4.2.3 carries a legacy G1 envelope signed by a CN=richdocuments leaf issued by
ownCloud Code Signing Intermediate Authority, valid until 2027-04-24 — that is the key needed
here.

The ask

From the current 4.2 tip:

1. make dist — produces build/dist/richdocuments.tar.gz (167 entries; builds cleanly in
   owncloudci/php:8.3, composer install --no-dev honours the config.platform.php: 7.3 lock)
2. sign it with the legacy G1 richdocuments key — the Makefile's own path,
   occ integrity:sign-app --privateKey=… --certificate=… --path=…
3. upload to the marketplace, where the app is published as "Collabora Online" (currently 4.2.3)

The v4.2.4 tag is yours to push, or we can push it once the artifact exists — whichever you
prefer. Happy to help with anything on the ownCloud side.

/cc @DeepDiver1975