I'm not an expert on the code signing tools, but I looked at the build results for one of our signed apps and the command line went as follows...
PrcSign foo.prc -o foo.prc -keyfile PrcSignKey.pem -passphrase password -cert PrcSignCert.der The thing that I see is missing from your command line is the -o parameter for the output file name. It's the same as the input file in this case, which means the sign resource is added back to the original file. The file that is signed in my example has a 'sign' resource but not a 'cert'. Apparently there are command line parameters that control which resources are added. The docs on PRCSign and PRCCert are at http://www.palmos.com/dev/support/docs/dev_suite/ResourceTools/ResourceT ools_Security.html#608590 -- Join us at the PalmSource Mobile Summit & DevCon 2005 San Jose, California - May 24-26, 2005 www.palmsource.com/events > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Dr. > Vesselin Bontchev > Sent: Monday, May 09, 2005 6:41 AM > To: Palm Developer Forum > Subject: Digitally signed code in Cobalt > > Hello folks, > > I'm trying to figure out how to use digitally signed code... > > OK, so I used PRCCert to create a keypair and a self-signed > certificate: > > prccert -keygen -passphrase Test > prccert -certgen -passphrase Test -keyfile Priv_Key.pem > -configfile PRCCert.conf > > This resulted in the creation of the files > > Priv_Key.pem > Publ_Key.pem > Crt_File.der > > Then I tried to sign a PRC file: > > prcsign -keyfile Priv_Key.pem -passphrase Test -cert > Crt_File.der MyApp.prc > > If I have understood the documentation correctly, this should > add two resources to MyApp.prc - 'sign', containing the > digital signature of the application's resources and 'cert', > containing the certificate for the key with which this > signature has been taken. In practice, however, only the > 'sign' resource was added to the application. > > Now, how do I ensure the integrity of the application? The > documentation suggests that the operating system itself > (PalmOS Cobalt) should verify the integrity of the digitally > signed applications - and, presumably, issue a warning if the > verification fails. I started the Cobalt simulator, set the > Current Security to Medium from the Security applet of the > system preferences, then modified a single character in the > signed application and loaded it into the simulator. The > application ran just fine - no warnings whatsoever. > > Presumably, this is because of the missing 'cert' resource? > Why wasn't it created - what did I do wrong? > > Or have I misunderstood and the OS isn't checking the > integrity of the applications it runs - and the applications > have to do it themselves with SignVerifySignatureByIndex or something? > > Regards, > Vesselin > -- > For information on using the Palm Developer Forums, or to > unsubscribe, please see http://www.palmos.com/dev/support/forums/ > -- For information on using the Palm Developer Forums, or to unsubscribe, please see http://www.palmos.com/dev/support/forums/
