MIDP Application Signing

Part 2 of 2

For details on the background of this project, and details about the overall Java Verified process, see part 1 of this article. This post will exclusively deal with signing MIDP applications, irrespective of whether you’ll also be going through the Java Verified process.

Why sign your MIDP application?

• Some devices might restrict certain functionality to those applications with valid signatures.
• Some security policies reject the installation of any unsigned application.
• Other devices will warn users about an application being “untrusted” if it’s not signed.
• Security pop-ups on phones can get really annoying, and these can be lessened with signed applications.
• Ensures that no one but you can distribute his or her applications or updates to your application under your name.

In short, you want your application signed.

[Read more]

Java Verified: What it is, and how you do it

Part 1 of 2

I’m putting the finishing touches on a little side project (to be announced in a few days) I’ve been working on for the past couple of weeks. The purpose of this project is to exercise the new J2ME Polish 1.3 beta release and get an application listed on mobile.java.com at the same time. To keep things simple, I decided to port a bluepulse widget (Amazon-OnTheGo) for this purpose.

I also promised to post my experiences with the listing process here. And apparently, at least one of you (one of the scant few readers of this blog) is looking forward to the outcome of this project.

The biggest hurdle is really the signing process, and while this is not overly difficult to do, there are such a large number of considerations, that application signing appears more difficult than it is. Of course, signing is one of the prerequisites of getting Java Verified, so I thought I’d break down my experience / research into two posts: one covering Java Verified and one covering signing MIDP applications (Part 2).

Java Verified Process

What is Java Verified?

It essentially boils down to a testing process that results in a widely accepted digital signature. The intent behind this initiative is to eliminate as much redundant J2ME application testing as possible, relying instead on unified testing done for Java Verification. The certification process ensures that applications being distributed via carriers, vendors, and other channels are of a consistent quality.

[Read more]