x509: unhandled critical extension

[jaredallard]

What happened: Attempted to sign (and attach the fullchain), which resulted in the following error:

failed to verify certificate chain: x509: unhandled critical extension

What you expected to happen: Either sign/notarization or attach-fullchain to succeed

How to reproduce it (as minimally and precisely as possible):

1. Create a Developer ID Installer certificate from https://developer.apple.com/account/resources/certificates/add
2. Import into Keychain, export by selecting top-level certificate and private key
3. Run go run github.com/anchore/quill/cmd/quill@latest p12 describe <p12> with success
4. Run go run github.com/anchore/quill/cmd/quill@latest p12 attach-chain <p12> with failure

Anything else we need to know?: It's totally possible I'm doing something wrong here...

Environment:

• Output of version command: v0.4.1 (go version go1.22.4 darwin/arm64)
• OS (e.g: cat /etc/os-release or similar): uname -a: Darwin pikachu.local 23.5.0 Darwin Kernel Version 23.5.0: Wed May 1 20:12:58 PDT 2024; root:xnu-10063.121.3~5/RELEASE_ARM64_T6000 arm64

[jaredallard]

Initial thoughts are that this could be due to extension 1.2.840.113635.100.6.1.14 being marked as critical?

[jaredallard]

Ah, okay, the issue here was a I used a Developer ID Installer certificate instead of a Developer ID Application. The docs I followed from goreleaser were wrong. Apologies for the noise!