A 3rd party has developed an App for private use in our enterprise environment. Now its come time to distribute it and they don’t want to send us their code. I have a feeling this will cause an issue because the distribution profile and certificate would have to be sent to them compromising our private key which we couldn’t allow.
Is this correct or can this be done without compromising our private key.
Edit: as a side note, I’m ok with sending them a private key if it only is useable per App, ie only with that App bundle ID and we can have different Apps with different private keys under the one enterprise licence.
You had to share your developer certificate (Distribution with your private key (.p12)) with the third party in order to use your provisioning profile. But as you mentioned you could use complete qualifier like com.yourcompany.appname as a bundle identifier to restrict the provisioning profile. But it does not mean that they can’t use the provisioning file, they could update bundle identifier to test their app.
Developer certificate and provisioning profile are comes with the expiry date which could be your final hope.
If I may suggest, I suggest you to trust your developers. I do manage couple of clients with certificate and I don’t misuse.
I also suggest you to add a clause in your contract not to misuse your provisioning or distribution certificates. Clever developers don’t need certificate as we know how to patch xcode to run on device without code signing.