Tutorial

May 2007

Releasing an Applicationfor mobile applications in Sony Ericsson phones

Tutorial | Releasing an Application

Preface

About this tutorial

This tutorial has been written by Simon Judge, a freelance mobile developer who develops for Symbian, Java ME and Windows Mobile. This document describes the steps required to build and release an appli-cation suitable for use on the phone.

Any opinions in this document are those of Simon Judge and not necessarily those of Sony Ericsson.

2 May 2007

This document is published by Sony Ericsson Mobile Communications AB, without any warranty*. Improvements and changes to this text necessitated by typographical errors, inaccuracies of current information or improvements to programs and/or equipment, may be made by Sony Ericsson Mobile Communications AB at any time and without notice. Such changes will, however, be incorporated into new editions of this document. Printed versions are to be regarded as temporary reference copies only.

*All implied warranties, including without limitation the implied warranties of merchantability or fitness for a particular purpose, are excluded. In no event shall Sony Ericsson or its licensors be liable for incidental or consequential damages of any nature, including but not limited to lost profits or commercial loss, arising out of the use of the information in this document.

This tutorial is published by:

Sony Ericsson Mobile Communications AB, SE-221 88 Lund, Sweden

Phone: +46 46 19 40 00Fax: +46 46 19 41 00www.sonyericsson.com/

© Sony Ericsson Mobile Communications AB, 2007. All rights reserved. You are hereby granted a license to download and/or print a copy of this document.Any rights not expressly granted herein are reserved.

First edition (May 2007)Publication number: EN/LZT 108 9363/5 R1A

Tutorial | Releasing an Application

Sony Ericsson Developer World

On www.sonyericsson.com/developer, developers will find documentation and tools such as phone White papers, Developers guidelines for different technologies, SDKs (Software Development Kits) and relevant APIs (Application Programming Interfaces). The Web site also contains discussion forums monitored by the Sony Ericsson Developer Support team, an extensive Knowledge base, Tips and tricks, example code and news.

Sony Ericsson also offers technical support services to professional developers. For more information about these professional services, visit the Sony Ericsson Developer World Web site.

Document conventions

Terminology

Typographical conventions

Code is written in Courier font:

on (keyPress "<Up>") {gotoAndPlay("subscribe");

}

ACS Authenticated Content Signing

SDK Software Development Kit

3 May 2007

Tutorial | Releasing an Application

Trademarks and acknowledgements

Symbian, Symbian OS and other Symbian marks are all trademarks of Symbian Ltd.

Other product and company names mentioned herein may be the trademarks of their respective owners.

Document history

Change history

2007-05-23 Version R1A First version

4 May 2007

Tutorial | Releasing an Application

5 May 2007

Contents

Introduction ...............................................................................................................6Customizing the installation ......................................................................................6Publishing an unsigned application ..........................................................................7Application signing ....................................................................................................7

Using Verisign ACS Publisher ID Certificates .....................................................7Using Developer Certificates ............................................................................13Signing for freeware ..........................................................................................18

Documentation and further reading ........................................................................18

Tutorial | Releasing an Application

Introduction

This document explains how to release your first Symbian based UIQ application. It describes how to cus-tomise the installation and, if necessary, sign your application using the Symbian Signed process.

This document forms part 5 of the Getting Started series. This document assumes you have read the fol-lowing documents available on the Sony Ericsson Developer World web site:

• Part 1: The UIQ Platform• Part 2: UIQ SDK and Tools Setup• Part 3: Application Integrity and Security• Part 4: Working with Code

Tutorial 6 will explore ways of distributing your UIQ application.

Customizing the installation

The previous tutorial, Working with Code, explained how the final install .sis file is defined using a .pkg file that is usually in the project group directory. Prior to release, this file should always be customized.

:"Vendor"

Change Vendor to either your own name or your company name.

#{"MyApp"}, (0xE0000002), 1, 2, 3, TYPE=SA

Change MyApp to be your application name, 0xE0000002 to be your application UID, 1 to be your major build number, 2 to be your minor version number and 3 to be your build number. The Type=SA just indi-cated it is a normal application install as opposed to a patch (SP) or upgrade (PU).

Most applications have a readme or license type message that is shown to the user prior to install:

"readme.txt"-"", FT, TA

This is actually the same as installing an extra file except that no destination is specified (destination is "") because the file is not installed. FT indicates that the file contains text to be displayed during installation and TA (text abort) specifies that dialog will contain an option to abort the installation. If TA is not speci-fied, the dialog will just have a Continue button.

Tip: The PKG format also supports advanced features such as multiple language installs, optional installa-tion and dependencies on other software components. Please see the UIQ SDK for further information.

6 May 2007

Tutorial | Releasing an Application

Publishing an unsigned application

It is very easy to publish an unsigned application. Just run makesis from the command line or within car-bide.c++ as mentioned in the previous tutorial Working with Code.

Tip: The UIQ platform allows unsigned applications to be installed. Hence, unlike S60, there is no need to self sign an application.

Application signing

The signing of applications was explained in the previous tutorial Application Integrity and Security. This section explains some of the more practical aspects.

It is important to realize that it is the .sis installation file that is signed, not the contained .exe. If anything within the .sis file has to be changed then the new install has to be re-signed.

There are two scenarios where the .sis is signed:

1. Signing with a certificate obtained from Verisign, prior it being sent to a 3rd party test house for Sym-bian Signed testing.

Signing just allows the test house to know the .sis came from you and has not been tampered with. Once the application has passed testing it will be re-signed with a Symbian Signed certificate that matches that within every end-user phone.

2. Signing with a temporary developer certificate (DevCert) obtained from Symbian that allows you to test on a restricted number of phones without having tested and Symbian Signed the application.

Using Verisign ACS Publisher ID CertificatesObtaining and using a publisher ID certificate is a lengthy process. It involves enrolling and having your identity checked by Verisign. Once verified, you download a certificate to your web browser. You then export it to a file and process the file with a Symbian command line application to produce .cer and .key files. These files can be used by the Symbian signsis to sign a .sis file.

Here is the process step by step:

1. Apply for an ACS Publisher ID at http://www.verisign.com/products-services/security-services/code-signing/symbian-content-signing/index.html.

Tip: Take care what you enter when you enroll. Verisign will use this information to verify your company exists. Ideally, use the telephone number that is publicly listed on your web site / 3rd party directories. People used as contacts should be made aware that they are likely to be checked by Verisign.

Once your identity has been validated you will receive an email asking you to pick up your ACS Pub-lisher ID.

2. Go to https://securitycenter.verisign.com/celp/enroll/acsPickup?application_locale=VRSN_US.

7 May 2007

Tutorial | Releasing an Application

3. Enter the Personal Identification Number (PIN) from your email and challenge phrase from your enrol-ment, and click Continue.

4. Accept the default settings in the Pick Up Certificate page. You may get a Potential Scripting Violation message that you should ignore. Just click on Yes.

8 May 2007

Tutorial | Releasing an Application

5. You may get another Potential Scripting Violation that again you should ignore. Just click Yes.The certificates will be added to your web browser.

6. Select Tools > Internet Options in your web browser and select Content > Certificates to open the Cer-tificates dialog window:

7. Click on the Export button. The Certificate Export Wizard starts.

9 May 2007

Tutorial | Releasing an Application

8. Ensure that the option to export the key is selected. Click Next.

9. Mark the check box to enable strong protection. Click Next.

10 May 2007

Tutorial | Releasing an Application

10. You can optionally enter a password to protect the private key. The fields were left empty in this exam-ple. Click Next.

11. Type a unique name for this key. The company name, surerange, was used in this example.

11 May 2007

Tutorial | Releasing an Application

12. Click Next to view the specified settings.

You will have a .pfx file in the directory specified by the File Name in the above dialog.

13. Click Finish to complete the Certificate Export Wizard.

14. Download the Symbian Key Export Utility: http://www.verisign.com/products-services/security-serv-ices/code-signing/symbian-content-signing/page_002759.html.

15. Extract the contents of the vs_pkcs.zip to a known directory. Copy the previously exported .pfx file to this directory.

16. From the command line, run vs_pkcs specifying the name of the .pfx file:

12 May 2007

Tutorial | Releasing an Application

17. You can now place the output .cer and .key files into the group directory of your project and use sign-sis to sign your .sis file:

where myapp.sis is the sis to be signed and myapp_signed.sis is a new filename for the signed sis file.

Tip: When generating SIS within carbide.c++, you can specify the certificate and key files in project properties. Go to Project Properties > Tool Settings tab, then Createsis > General options. However, in practice you tend to need to specify more options than provided by Carbide and may need to use the command line.

Tip: It is also possible to specify the certificate and key filenames in the .pkg file so that they do not have to be specified on the signsis command line. See UIQ SDK for further information.

Using Developer CertificatesDeveloper Certificates (DevCerts) allow testing of applications on real devices before submitting them for Symbian Signing. Here is the process step by step:

1. You need to register on www.symbiansigned.com in order to obtain developer certificates.

2. Once registered, download, install and run the tool called DevCertRequest that will allow you to create a .csr developer certificate request file.

13 May 2007

Tutorial | Releasing an Application

3. Choose a filename for the file you will eventually upload to SymbianSigned.com.

4. Click Next.

14 May 2007

Tutorial | Releasing an Application

5. Click Next.

You do not need an ACS publisher ID to get a DevCert. However, if you have one you will be able to use the DevCert on up to 100 specified phones (IMEIs) rather than just one.

Tip: Remember the Private key file password in the above dialog. You will need it later when signing your application.

15 May 2007

Tutorial | Releasing an Application

6. Fill in your personal information as the example below illustrates:

7. Click Next.

16 May 2007

Tutorial | Releasing an Application

8. Enter IMEI(s) and click Next.

Tip: There is also a Symbian Developer Certificate Request Wizard Plug-in for Carbide.c++ available to download from the symbiansigned.com web site.

9. When you have a .csr certificate request file, go back to the symbiansigned web site and click on Request under Developer Certificates.

17 May 2007

Tutorial | Releasing an Application

10. Enter the .csr filename and click send to upload the request. The certificate will be created automati-cally and can be downloaded immediately.

11. To sign the sis file, download the certificate (.cer) file and put it in your project group directory. You will also need the key (.key) file that was created by the certificate request tool.

Note: myapp.sis is the sis to be signed, myapp_signed_devcert.sis is a new filename for the signed sis file and test is the password you used in the certificate request tool.

Signing for freewareThere is process, run by Cellmania, that offers free Symbian Signed testing for freeware developers. Cell-mania currently provides this service.

While you may need a DevCert to test your application, it does not have to be signed in any way prior to being sent to Cellmania. Cellmania takes applications from third parties, signs them with their own Cell-mania ACS, tests them and if they pass Symbian Signs them.

Documentation and further reading

Signing applications for Sony Ericsson UIQ 3 phones:

http://developer.sonyericsson.com/getDocument.do?docId=84686

18 May 2007

Tutorial | Releasing an Application

Verisign Content Signing:

http://www.verisign.com/products-services/security-services/code-signing/symbian-content-signing/index.html.

Freeware Route to Market:

https://www.symbiansigned.com/app/page/overview/freewareFaq

Sony Ericsson Channel Certification Form:

http://developer.sonyericsson.com/surveys/channel_cert_app_form.jsp

19 May 2007