Add certificate signing request for larpinq (renamed from larpingapp)

[rubenvdlinde]

Hello, and thank you for looking after this repository. We know certificate requests are steady background work, and we are grateful for your time.

We are Conduction B.V. We build open source Nextcloud apps for Dutch public sector organisations, all EUPL-1.2.

Why we are asking

We renamed thirteen of our apps and we are taking them to production. We would like them signed and installable in time for the Nextcloud Conference in Berlin.

larpingapp is now larpinq.

• Source: https://github.com/ConductionNL/larpinq
• Product and documentation: https://larpinq.conduction.nl

Nextcloud checks that a certificate's CN matches the app id. Our larpingapp certificate cannot sign larpinq. So this is a new CSR rather than a reuse.

We would rather ask for a new certificate than keep signing with the old one. Signing does not check the CN, so a mismatched certificate produces a release that looks fine and fails occ integrity:check-app on the administrator's side. We would like to stop shipping that.

The old App Store entry

larpingapp is still published on the App Store. It is superseded now, and we would like it taken down so there are not two entries for one app. We are happy to do that ourselves if there is a self-service route. If you would rather handle it, please tell us what you need from us.

The rest of the set

Thirteen apps are moving together. We opened one PR each, following the convention here:

• Add certificate signing request for integriq (renamed from openconnector) #1204 openconnector becomes integriq
• Add certificate signing request for filinq (renamed from docudesk) #1205 docudesk becomes filinq
• Add certificate signing request for dossiq (renamed from procest) #1206 procest becomes dossiq
• Add certificate signing request for stackiq (renamed from softwarecatalog) #1207 softwarecatalog becomes stackiq
• Add certificate signing request for larpinq (renamed from larpingapp) #1208 larpingapp becomes larpinq ← this one
• Add certificate signing request for thematiq (renamed from nldesign) #1209 nldesign becomes thematiq
• Add certificate signing request for learniq (renamed from scholiq) #1197 scholiq becomes learniq
• Add certificate signing request for decidiq (renamed from decidesk) #1198 decidesk becomes decidiq
• Add certificate signing request for buildiq (renamed from openbuild) #1199 openbuild becomes buildiq
• Add certificate signing request for keepiq (renamed from doriath) #1200 doriath becomes keepiq
• Add certificate signing request for humaniq (renamed from hrmq) #1201 hrmq becomes humaniq
• Add certificate signing request for versioniq (renamed from app_versions) #1202 app_versions becomes versioniq
• Add certificate signing request for planninq (renamed from planix) #1203 planix becomes planninq

We are glad to combine them into one PR if that is less work for you.

What we need

If the CSR is in order, merging it is everything we need from you. If anything should be split, renamed or resubmitted, tell us. We will send it the way you prefer.

[mgallien]

I would need you to also remove the certificate signing request from the old name in each PR
I would also need a confirmation by the original github account that requested the certificate that this is legitimate (I also understand that this is coming from ConductionNL)
can you also please fix the failing DCO check ?
For more information, have a look at the failing DCO CI check from the PR
see also our documentation here https://nextcloudappstore.readthedocs.io/en/latest/developer.html#obtaining-a-certificate

setting the PR as needing changes for easier overview

[rubenvdlinde]

@MWest2020 could you please confirm this one?

This PR is part of the ConductionNL fleet rename: the app id larpingapp becomes larpinq. @mgallien asked for a confirmation from the GitHub account that originally requested the larpingapp certificate that this rename is legitimate. You committed larpingapp/larpingapp.csr on 2024-08-31, so that is you. A short comment here confirming that the rename to larpinq and the removal of the larpingapp signing request are legitimate is all that is needed.

@mgallien I have addressed the other two points of your review:

• the obsolete larpingapp/larpingapp.csr is now removed in this same PR (I left larpingapp/larpingapp.crt in place, since you indicated that the deletion of the obsolete certificates is handled by Nextcloud);
• the commit now carries a Signed-off-by line, so the DCO check is green again.

[MWest2020]

@mgallien this is absolutely legit. Ruben is the owner of the Conduction company. I did the certification signing requests for the first two years.

[rubenvdlinde]

Ownership of these apps should sit with our corporate app store account

One additional point while this batch is being processed, relevant to all 13 PRs.

These are corporate applications built and maintained by Conduction, not personal side projects. Today the app store entries are owned by individual accounts (rubenvdlinde, rjzondervan, MWest2020). We want the ownership of the new app ids to sit with our corporate app store account conduction instead, so that:

• ownership stays with the company rather than with individual employees, who may change role or leave;
• these apps can be offered with enterprise support, which requires the company to be the accountable owner;
• certificate renewals and any future transfer are handled through a single corporate account.

So our request is: when the certificates for the new ids are generated, please have the app store entries owned by conduction rather than by the individual accounts that requested the old ones. The 13 app ids in this batch are:

integriq, filinq, dossiq, stackiq, larpinq, thematiq, learniq, decidiq, buildiq, keepiq, humaniq, versioniq, planninq

The corresponding old ids to be retired are openconnector, docudesk, procest, softwarecatalog, larpingapp, nldesign, scholiq, decidesk, openbuild, doriath and app_versions (hrmq and planix were never published, so humaniq and planninq are first-time requests).

If anything is needed from our side to make that transfer possible, such as a confirmation from each of the current owner accounts or a different procedure entirely, please let us know and we will arrange it.