[moved] Signing with less capabilities

[Zven]

Hello,

Is that possible to remove some capabilities during the signing process?

My dev certs have a lots of caps and i just want to use a subset, i d'ont see any option in the signsis tools about this...

[ltomuta]

It is irrelevant what capabilities are grantable by a certificate, the only thing that maters is what capabilities are declared in the binaries themselves. You can have a certificate capable of signing applications with any capability (ALL) yet use it to sign applications that don't require any capabilities ...

Think of it as me signing a back check. If I have $500 in my account I can sign you a $1 ceck and you can cash it from the bank which is going to give you the value written in the check (i.e. $1) and not all the money in my account. The only thing that I cannot do is sign you a $501 check as that would be rejected by the back.