Changing code signing identity

[vyunikov]

We have recently changed out code signing identity on Mac.
Our previous updates have always been signed just with Apple Developer ID certificate and have never been signed them with DSA or edDSA keys. Unfortunately releasing another update with the old identity is no longer possible.
Is there a way to make auto updates work for our app if the new update will be signed with a different identity?

[zorgiepoo]

Unfortunately releasing another update with the old identity is no longer possible

If you can't ship another update using your old Developer ID certificate, then you can't rotate keys and you can't ship a regular update (there's no chain of trust). One of the reasons not using EdDSA keys was deprecated is for this kind of scenario. (Another reason is stronger integrity checking. I'm pondering on changing the policy but I still need to give it more thought).

The best you can do here is post an informational only update. The update with release notes will still show to the user but they will have a "Learn More.." button once clicked, will redirect them to your product's website.

[vyunikov]

Thanks @zorgiepoo