BlackBerry Code Signing Tips
So you’ve written the perfect BlackBerry application. It runs great in the device simulator and now you want to run it on a real device. You install it, but it won’t run — because you’re using controlled APIs. That’s right, a lot of the interesting APIs on the BlackBerry — for example, the persistent store — are protected by a security layer. To get past that layer you have to sign your application using certificates provided by RIM. Here’s a quick guide to the realities of BlackBerry code signing.
Applying for Code Signing Privileges
RIM is very security conscious, which is why developers must apply for code signing privileges. You do this by filling out this form. Note that there’s a US$100 charge for each application. You may need to apply more than once — see the gotchas below for the reason.
Once you’ve submitted the application, RIM will do some investigation to ensure themselves that you’re a legitimate developer. If you’re approved, you’ll receive the code signing certificates within 4 or 5 business days.
ISV Alliance partners can have the application fees waived, mail your ISV technical contact for the details. The turnaround time for ISV partners is quicker since RIM has already established a relationship with your company.
Code Signing Gotchas
Here are some interesting facts about code signing that won’t necessarily be obvious until you go through the process:
- There are three sets of controlled APIs, each of which requires its own certificate. RIM will therefore deliver you a certificate set. You must install all three certificates in the set in order to get full coverage of the controlled APIs.
- Each certificate set is per developer — or, more precisely, per machine. Either you’ll need certificates for each developer and each build machine or you’ll use one machine (the build machine) as a central signing machine that all developers use.
- Code signing requires an active Internet connection back to RIM’s certificate servers. No connection, no signing. If RIM’s servers are offline, you’ll also be stuck.
- Whenever code is signed with a certificate, the person who applied for the certificate set gets email from RIM’s servers with the status of the signature request and how many signings remain on the certificate. If you use the same email account and you’ve got a lot of developers doing code signing, the email account will get flooded with emails.
In other words, it’s not a good idea to apply using your CEO’s email address…
No Automated Code Signing!
Here’s the one that really annoys me the most, though:
- Code signing cannot be automated. The code signing tool pops up a dialog that prompts you for a secret key in order to access the necessary certificates. There’s no way to pass the key in from the command line. So if you automate your builds using Ant or makefiles, you’ll need to use some kind of tool that looks for the dialog and simulates the user entering the key via the keyboard.
I don’t know why they’re so hard-headed about this. When I’ve complained, the answer’s been that they do this for security, and that there’s no need to sign the code until you’re ready to deploy, at which point a developer can sit there and manually enter the signing key to prepare the final version. They think this is good enough because the application can run in the device simulator without being signed.
But those of us who use automated build processes with nightly builds and regression testing don’t want a separate manual signing step — the point is to automate everything and to test the actual version of the software that will be deployed. After all, the size of the .cod files changes because of the signing, and that can affect other things like the .jad files used for over-the-air (OTA) deployment (which, unfortunately, don’t get updated automatically by the signing tool, so you have to create your own tool/process to re-build the .jad files after the code signing is done).
If more people can complain to RIM about this, perhaps they’ll change their minds about this “security feature”.
Technorati Tags: BlackBerry, security, code signing, J2ME, Java ME
I work at BoxTone and we ran into the same problem with our automated build and the code signing dialog box. I used AspectJ to solve get around the dialog box. It’s been a while since I did it but I might still have the code laying around somewhere. Want me to try to dig it up?
Sure, why not? I’m sure many companies have developed tools to get around it, but probably can’t release….
I will appreciate it if you can send it to annaehr@gmail,com as well. Thank you very much.
Could you send the AspectJ code to mirko.seifert %at% tu-dresden %dot% de too?
Thanks a lot!
May be it’s interesting to note that one can copy the files “sigtool.csk” and “sigtool.db” from the bin folder of the JDE to another machine to sign code on more than one machine.
Since no one replies to my last entry I had to do it myself. See http://www.cive.de/projects/signaturetoolrunner/ to get the solution.
Is it possible to show an application’s demo (screen shots & few functionality) on Blackberry device (say 7290) without code-signing. Or If I sign the code at this(developing) stage, then will I need to sign it again when the application is developed completely? can anybody help me out?
I got mine from the blackberry unlock code server here http://www.newmobilefreedom.com/blackberry-imei-unlock-p-99.html
got in less than a day. not sure if thats what you meant but hope it helps -
[…] we know it is possible to autostart an application in jde by before building the project we need to go to the project properties and check that the Auto-run on start up is checked.is possible in netbeans?? only signed application can be able to autostart while bootup…for more details about signing blackberry application check out following link BlackBerry Code Signing Tips | Eric Giguere’s BlackBerry Developers At Work! __________________ cheers Aman […]
[…] BlackBerry Code Signing Tips | Eric Giguere’s BlackBerry Developers At Work! Symbian Certificates. Nokia, Sony Ericsson, NTT DoCoMo, and other Symbian partners, which collectively make up the vast majority of phones sold worldwide, are bound together by the Symbian Signed program, which went into effect with phones using Symbian OS 9.1 or later. There are several levels to the program. […]
[…] from: BlackBerry Code Signing Tips "So you?ve written the perfect BlackBerry application. It runs great in the device simulator […]
Hello,
Want to know that what is the actual need of signing build for the devices where as in simulater it work properly.
Regards,
Neev.
Because on the simulator security it turned off by default, meaning unsigned applications can use all APIs with no trouble. But on a real device those APIs are protected. You can actually run the simulator with security enabled, by the way, but you have to explicitly turn it on.
[…] from: BlackBerry Code Signing Tips "So you?ve written the perfect BlackBerry application. It runs great in the device simulator […]
[…] from: BlackBerry Code Signing Tips "So you?ve written the perfect BlackBerry application. It runs great in the device simulator […]
If anyone is interested, I posted info on how to get the BlackBerry signing tool to work, including how to get it run on Mac and Linux (I work on a Mac :)).
You can find it on my blog:
http://blog.lightvoid.net/2008/04/28/automated-blackberry-sign-tool-mac-linux-windows/
Hope its useful. I had a hard time finding any information on running BlackBerry stuff on anything other than Windows.
The new 4.3 SignatureTool allows you to pass a password on the command line. For example:
$ java -jar SignatureTool.jar -c -a -p C:\dev\application.cod
Hope that helps.
The complete command should be:
$ java -jar SignatureTool.jar -c -a -p PASSWORD C:\dev\application.cod
Yeah, thankfully… it only took them a few years to figure out that developers wanted this feature!