分发iPhone证书私钥？
我工作的公司已将 iPhone 应用程序的开发外包给另一家公司。他们希望用我们的证书对二进制文件进行签名以便分发，但他们要求我将用于创建我们的证书的私钥 (certificates.p12) 传递给另一家公司。我非常担心将我们签署申请的能力移交给另一家公司。
我怎样才能说服我的老板这是一个非常糟糕的主意？我可以向他建议哪些替代解决方案？我已经要求他从他们那里获取源代码，以便我们可以自己签名并提交，但由于无法最终表明向他们提供证书是一个坏主意，我有点陷入了“只需调查一下”我”的困境。
The company I work for has outsourced development of an iPhone app to another company. They want the binary to be signed with our certificate for distribution, but they've asked me to pass the private key (certificates.p12) used to create our certificate on to the other company. I am extremely concerned about handing the ability to sign applications as us over to another company.
How can I convince my boss this is a really bad idea? What alternative solutions can I suggest to him? I have already asked him to get the source from them so we can sign and submit it ourselves, but without the ability to conclusively state that giving them the certificate is a bad idea, I'm kinda stuck in the "just look into it for me" limbo.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
你不需要来源。您只需要编译后的二进制文件（确保它是 ARM，而不是 x86）即可使用
codesign进行签名。You don't need the source. You just need the compiled binary (make sure it's ARM, not x86) to sign with
codesign.外包公司可以使用自己的证书构建并签署应用程序。然后，您可以在提交之前使用您公司的证书退出应用程序（使用协同设计）。
如果没有团队代理的 iTunes Connect 登录凭据，顾问无法仅使用应用程序商店分发证书的私钥做太多事情，因为 Apple 的审核团队是唯一可以运行使用您的分发证书签名的应用程序的团队，并且您如果没有与证书匹配的登录名，则无法将应用程序提交到 iTunes Connect (AFAIK)。
The outsource company can just build and sign the app with their own certificate. You can then resign the app with your company's certificate before submission (use codesign).
There's not too much a consultant can do with the private key to just an App store Distribution certificate but without the team agent's iTunes Connect login credentials, as Apple's review team are the only ones who can run an app signed with your Distribution certificate, and you can't submit an app to iTunes Connect without the login matching the certificate (AFAIK).