From 44d2373ae2076ec1e2d5c0dacf42acbc49f1da3b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Wed, 23 Sep 2026 11:09:41 +0200 Subject: [PATCH] ci: remove the release workflow from 4.2, it cannot sign for oc10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reverts the workflow added in #640. That was my mistake: this branch ships to ownCloud 10, and the release pipeline cannot produce an artifact oc10 accepts. oc10 and oc11 do not share a signing generation: oc10 {hashes, signature, certificate} legacy G1, single root.crt oc11 {v, alg, hashes, signature, certificates} G2, roots/ + intermediates/ `lib/private/IntegrityCheck/Checker.php` on 10.16 reads `certificate` in the singular and verifies against the one `resources/codesigning/root.crt`. It has no code path for a `v`/`certificates` envelope, nor for the ECDSA P-384 signature G2 uses. oc11's verifier accepts both generations, which is why the same workflow is correct on master and wrong here. The reusable release workflow signs with `ocsign`, overriding the Makefile's `occ integrity:sign-app`. ocsign emits G2 only - its flags are --path --key --cert --chain --core --allow-vcs --out --dry-run, with no legacy mode - and the repository's signing secrets hold a G2 key. So a tag on this branch would have published a tarball that fails `occ integrity:check-app` on every oc10 server, with admins seeing a tamper warning. Confirmed against the real artifacts rather than the docs: the marketplace tarball for 4.2.3, which is what oc10 admins install, carries a legacy G1 envelope signed by a CN=richdocuments leaf issued by "ownCloud Code Signing Intermediate Authority", while v4.3.0 and v4.3.1 carry G2. Releases on this branch therefore stay manual, signed with the legacy G1 key by whoever holds it, and uploaded to the marketplace - exactly how 4.2.1, 4.2.2 and 4.2.3 shipped. The version bump from #640 stands; only the workflow goes. Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> Co-authored-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) --- .github/workflows/release.yml | 22 ---------------------- 1 file changed, 22 deletions(-) delete mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml deleted file mode 100644 index 31a74d2e9..000000000 --- a/.github/workflows/release.yml +++ /dev/null @@ -1,22 +0,0 @@ -name: Release - -on: - push: - tags: - - 'v*' - -permissions: - contents: read - -jobs: - release: - permissions: - contents: write - uses: owncloud/reusable-workflows/.github/workflows/release.yml@main - with: - app-name: richdocuments - artifact-glob: build/dist/richdocuments.tar.gz - secrets: - SIGNING_KEY: ${{ secrets.SIGNING_KEY }} - SIGNING_CERT: ${{ secrets.SIGNING_CERT }} - SIGNING_CHAIN: ${{ secrets.SIGNING_CHAIN }}