mirror of
https://github.com/netbirdio/docs.git
synced 2026-10-17 02:59:04 +02:00
riccardom
d09e035d20
Three review findings, all correct. `productsign` signs installer packages, not configuration profiles, and an Apple Developer ID certificate cannot sign a profile at all — Apple's own guidance is that a `.mobileconfig` is a CMS signed-data message. The instruction predates this branch but the commit that fixed the malformed XML comment rewrote it, so it is fixed here rather than carried forward. It was also misleading in a second way: a profile delivered through an MDM is signed by the MDM channel, so a managed rollout has nothing to sign by hand. The step now says that, and gives `security cms -S` for the case where the profile is handed out some other way. "Every key is enforced on iOS" contradicted the list of platform-inapplicable keys three paragraphs below it; it now reads "every key that applies to the platform", and points at that list. The engine-applied group — blockInbound, wireguardPort, lazyConnection, allowRemoteJobs, debugBundleUploadURL — was stated without qualification under a table headed "iOS / tvOS", while the warning just above says the tvOS engine never receives the policy. Marked as iOS, with the tvOS case pointed back at that warning.