与第三方开发者共享iOS分发证书是否安全？

Question

We have an enterprise developer account and for an app we are working with an external developer.

External developer needs to be able to build ipa files for us.

From a security point of view, is it safe/recommended for us to share the distribution certificate (and the private key) and a provisioning profile so they can build ipa files?

If we share distribution certificate (and the private key) will there be any problem ?

Answer 1

You should not be sharing your private key. This is not safe. Please read through this article. https://developer.apple.com/library/ios/documentation/IDEs/Conceptual/AppDistributionGuide/MaintainingCertificates/MaintainingCertificates.html

It clearly states "Worse, if someone else has your private key, that person may be able to impersonate you. In the wrong hands, someone might attempt to distribute an app that contains malicious code. Not only could that cause the app to be rejected, it could also mean your developer credentials could be revoked by Apple. Private keys are stored only in the keychain and can't be retrieved if lost."