Calendar: Certificate has been revoked

[localguru]

With OC 9.0.10 and Calendar 1.4.1, which was installed from

https://github.com/nextcloud/calendar/releases/download/v1.4.1/calendar2.tar.gz

I get the following error:

Technical information
=====================
The following list covers which files have failed the integrity check. Please read
the previous linked documentation to learn more about the errors and how to fix
them.

Results
=======
- calendar
    - EXCEPTION
        - OC\IntegrityCheck\Exceptions\InvalidSignatureException
        - Certificate has been revoked.

Raw output
==========
Array
(
    [calendar] => Array
        (
            [EXCEPTION] => Array
                (
                    [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
                    [message] => Certificate has been revoked.
                )

        )

)

Reanalysing doesn't help. Same message from others are reported here

https://apps.owncloud.com/content/show.php/Calendar?action=content&content=168707

[georgehrke]

This is the Nextcloud calendar app's repository. We only support Nextcloud.

If, for some reason, you still want to stick to owncloud report a bug in their bug tracker please.

[localguru]

This is the spirit I was looking for, Cheers!

[georgehrke]

@localguru The people over there cut my access to apps.owncloud.com and revoked my certificate to sign the calendar app.
(They revoked my certificate, but still ship the version i signed => their users will get a Certificate has been revoked error)

I have absolutely no stake in producing that error ;)

If you want to complain, complain to the right people please ;)

[localguru]

Georg, sorry to hear that. I understand. Thanks for explanation! Hmmm ... any workaround the disable the check?

[georgehrke]

You can disable the integrity-check by adding 'integrity.check.disabled' => true to your config.php.

But I would not recommend that, because that disables any integrity-check, both for the server and all apps.

[localguru]

Ah, thanks. Would it be a problem/security risk to add disable integritycheck for now and enable it again before an upgrade or installing further apps, so the code is checked once and after that check 'integrity.check.disabled' => true is add to config.php again?

[localguru]

And who on the OC team would be responsible to add your key again?

[georgehrke]

Would it be a problem/security risk to add disable integritycheck for now and enable it again before an upgrade or installing further apps

If you can ensure that nothing on your server will modify the ownCloud source and even the web server process has only read permission to the source code, it might be ok to do that.
(This information is supplied without liability and I still recommend not adding that.)

And who on the OC team would be responsible to add your key again?

I don't know who is responsible for that nowadays, but as I also no longer have the permission to update the calendar app on apps.owncloud.com, I very much doubt they will readd my cert / issue me a new one.

Users have basically two options here:

• If they want to use the calendar app I maintain, they should upgrade to Nextcloud
• If they want to stick to ownCloud, they have to hope that they release a version with a new, valid cert anytime soon.

[stefanmohl]

Could someone at ownCloud fork the Calendar and sign it?

[georgehrke]

@stefanmohl Please report this to the ownCloud folks. I doubt they are reading reports in this bug tracker.

[stefanmohl]

Sorry, I missed the meta-issues involved; I came here directly via google and didn't notice where I was. The ownCloud people have already done the fork and sign in their new app store.