12-06-2011 05:55 AM - edited 12-06-2011 06:05 AM
Hi there !
Seriously, I'm starting to freaking about trying to understand the whole process of signing applications in Playbook.
I've got so many questions that I don't know which one to start ...
Trying to summarize some of them:
i) Why do I need both of the CSJ files ?
Looking at them they just look like regular files without any asymmetric key: I know they are of two types - one to generate debug tokens and the other one is to sign and deploy an application.
ii) Now comes the part that we need a keystore or a CSK file. What is the purpose of this file and why we need them? I know that this process doesn't require internet connection... Also which kind of encryption does it use?
#Do not edit manually. Generated automatically by RIM tools.
#Tue Nov 22 15:50:47 GMT 2011
iii) Using blackberry-signer seems to register both those files (CSJ and CSK) into Blackberry CA. Am I correct? That means that now I registered my ID and now I'm able to deploy and sign (!) applications ?
iv) Does the process of generating a debug token communicates with Blackberry servers ?
v) Inside dt.bar (my debug token name) exists a folder META-INF which contains 5 files:
What they contain and what are their purpose? I'm asking because some of them are not readable.
vi) When we are ready to deploy an application, we need to generate another certificate, this time a p12. Looking into the documentation:
batchbar-signer <input_files> <developer_certificate> <keystore_password> [<csk_password>] [-t <output_folder>]
so why do we need another certificate if we already have a CSK which contains a private key?
I think this could be better documented ... Just saying ; )
Anyway ... any information is more than welcome.
Thank you very much,
12-08-2011 10:17 AM
The two CSJ files are for the 2 key types. One key is used to sign your application for deployment, the other is used to create debug tokens.
When you install/register these CSJ files on your computer, the CSK file is created. The CSK file is what is used to sign your applications and create debug tokens.
The process of creating a debug token requires communication with RIM servers. Installing and using a debug token does not. So you'll need to be online to create the debug token, but can then test and debug offline after that.
The manifest.mf is a text file that describes your application. The other files you list are the signatures for your application.
You only need to create the .p12 file once. After which the same p12 file is used to sign all of your applications.
You applications are signed using your Developer Certificate (the p12) and your BlackBerry Tablet OS Code signing key (the one issued from RIM).
I hope that covered all of your questions.