Add certificate signing request for keepiq (renamed from doriath)

[rubenvdlinde]

Hello, and thank you for looking after this repository. We know certificate requests are steady background work, and we are grateful for your time.

We are Conduction B.V. We build open source Nextcloud apps for Dutch public sector organisations, all EUPL-1.2.

Why we are asking

We renamed thirteen of our apps and we are taking them to production. We would like them signed and installable in time for the Nextcloud Conference in Berlin.

doriath is now keepiq.

• Source: https://github.com/ConductionNL/keepiq
• Product and documentation: https://keepiq.conduction.nl

Nextcloud checks that a certificate's CN matches the app id. Our doriath certificate cannot sign keepiq. So this is a new CSR rather than a reuse.

We would rather ask for a new certificate than keep signing with the old one. Signing does not check the CN, so a mismatched certificate produces a release that looks fine and fails occ integrity:check-app on the administrator's side. We would like to stop shipping that.

The old App Store entry

doriath is still published on the App Store. It is superseded now, and we would like it taken down so there are not two entries for one app. We are happy to do that ourselves if there is a self-service route. If you would rather handle it, please tell us what you need from us.

The rest of the set

Thirteen apps are moving together. We opened one PR each, following the convention here:

• Add certificate signing request for integriq (renamed from openconnector) #1204 openconnector becomes integriq
• Add certificate signing request for filinq (renamed from docudesk) #1205 docudesk becomes filinq
• Add certificate signing request for dossiq (renamed from procest) #1206 procest becomes dossiq
• Add certificate signing request for stackiq (renamed from softwarecatalog) #1207 softwarecatalog becomes stackiq
• Add certificate signing request for larpinq (renamed from larpingapp) #1208 larpingapp becomes larpinq
• Add certificate signing request for thematiq (renamed from nldesign) #1209 nldesign becomes thematiq
• Add certificate signing request for learniq (renamed from scholiq) #1197 scholiq becomes learniq
• Add certificate signing request for decidiq (renamed from decidesk) #1198 decidesk becomes decidiq
• Add certificate signing request for buildiq (renamed from openbuild) #1199 openbuild becomes buildiq
• Add certificate signing request for keepiq (renamed from doriath) #1200 doriath becomes keepiq ← this one
• Add certificate signing request for humaniq (renamed from hrmq) #1201 hrmq becomes humaniq
• Add certificate signing request for versioniq (renamed from app_versions) #1202 app_versions becomes versioniq
• Add certificate signing request for planninq (renamed from planix) #1203 planix becomes planninq

We are glad to combine them into one PR if that is less work for you.

What we need

If the CSR is in order, merging it is everything we need from you. If anything should be split, renamed or resubmitted, tell us. We will send it the way you prefer.

[mgallien]

I would need you to also remove the certificate signing request from the old name in each PR
I would also need a confirmation by the original github account that requested the certificate that this is legitimate (I also understand that this is coming from ConductionNL)
can you also please fix the failing DCO check ?
For more information, have a look at the failing DCO CI check from the PR
see also our documentation here https://nextcloudappstore.readthedocs.io/en/latest/developer.html#obtaining-a-certificate

setting the PR as needing changes for easier overview

[rubenvdlinde]

@rjzondervan could you please confirm this one?

This PR is part of the ConductionNL fleet rename: the app id doriath becomes keepiq. @mgallien asked for a confirmation from the GitHub account that originally requested the doriath certificate that this rename is legitimate. You committed doriath/doriath.csr on 2026-06-03, so that is you. A short comment here confirming that the rename to keepiq and the removal of the doriath signing request are legitimate is all that is needed.

@mgallien I have addressed the other two points of your review:

• the obsolete doriath/doriath.csr is now removed in this same PR (I left doriath/doriath.crt in place, since you indicated that the deletion of the obsolete certificates is handled by Nextcloud);
• the commit now carries a Signed-off-by line, so the DCO check is green again.

[rjzondervan]

Confirmed, I requested the original doriath certificate; the rename to keepiq and the removal of the old CSR are legitimate.

[rubenvdlinde]

Ownership of these apps should sit with our corporate app store account

One additional point while this batch is being processed, relevant to all 13 PRs.

These are corporate applications built and maintained by Conduction, not personal side projects. Today the app store entries are owned by individual accounts (rubenvdlinde, rjzondervan, MWest2020). We want the ownership of the new app ids to sit with our corporate app store account conduction instead, so that:

• ownership stays with the company rather than with individual employees, who may change role or leave;
• these apps can be offered with enterprise support, which requires the company to be the accountable owner;
• certificate renewals and any future transfer are handled through a single corporate account.

So our request is: when the certificates for the new ids are generated, please have the app store entries owned by conduction rather than by the individual accounts that requested the old ones. The 13 app ids in this batch are:

integriq, filinq, dossiq, stackiq, larpinq, thematiq, learniq, decidiq, buildiq, keepiq, humaniq, versioniq, planninq

The corresponding old ids to be retired are openconnector, docudesk, procest, softwarecatalog, larpingapp, nldesign, scholiq, decidesk, openbuild, doriath and app_versions (hrmq and planix were never published, so humaniq and planninq are first-time requests).

If anything is needed from our side to make that transfer possible, such as a confirmation from each of the current owner accounts or a different procedure entirely, please let us know and we will arrange it.

[rubenvdlinde]

@MWest2020 could you please confirm this one as well?

This is part of the same ConductionNL fleet rename batch: the app id doriath becomes keepiq. @mgallien asked for a confirmation from the GitHub account that originally requested the certificate, and you have already given it on #1204, #1205, #1206, #1208 and #1209. This PR is one of the remaining eight that still needs it.

For completeness on the other half of the request: this PR already removes doriath/doriath.csr and adds keepiq/keepiq.csr, so the old name is not left behind.

[rubenvdlinde]

@rjzondervan could you please confirm this one?

This PR is part of the ConductionNL fleet rename: the app id doriath becomes keepiq. @mgallien asked for a confirmation from the GitHub account that originally requested the doriath certificate that the rename is legitimate. You committed doriath/doriath.csr on 2026-06-03, so that is you.

A short comment here confirming that the rename to keepiq and the removal of the old CSR are legitimate is all that is needed. You have already given exactly that on #1197 for scholiq becoming learniq.

For context on where this batch stands: the old-name CSR removal @mgallien asked for is done on every PR that has a predecessor, and CI is green on all thirteen. @MWest2020 has confirmed all five of the apps they originally requested (#1204, #1205, #1206, #1208, #1209). These five are the remaining ones, and they are all yours:

• Add certificate signing request for decidiq (renamed from decidesk) #1198 decidesk to decidiq
• Add certificate signing request for buildiq (renamed from openbuild) #1199 openbuild to buildiq
• Add certificate signing request for keepiq (renamed from doriath) #1200 doriath to keepiq
• Add certificate signing request for versioniq (renamed from app_versions) #1202 app_versions to versioniq
• Add certificate signing request for stackiq (renamed from softwarecatalog) #1207 softwarecatalog to stackiq

Confirming all five in one pass would unblock the whole batch.

[rubenvdlinde]

@mgallien all three points from your review are addressed. This PR is ready.

1. Old certificate signing request removed. This PR deletes doriath/doriath.csr and adds keepiq/keepiq.csr. The diff shows 26 deletions on the old path.

2. Confirmation by the original requester. @rjzondervan filed doriath/doriath.csr on 2026-06-03. He confirmed this rename here on 2026-08-29: "Confirmed, I requested the original doriath certificate; the rename to keepiq and the removal of the old CSR are legitimate."

3. DCO check. Green.

The PR is mergeable. Your review from 2026-08-27 still stands as "changes requested", which is the only thing blocking it now. I am re-requesting your review so it leaves your queue correctly.

This is one of seven PRs in the same ConductionNL rename batch: #1197, #1198, #1199, #1200, #1201, #1202, #1203. All seven are in the same state.