Blackberry - application signing

Question

From what little is available on the Internet for signing BB apps, I can guess that we just need the .cod file for signing an app and don't need the source code.

Can someone please confirm this?

Answer 1

Slight correction to @Fermin. If you don't have the source code, you need the .cod file and the .csl file (and optionally the .cso file) - all of which are generated by RAPC (usually invoked through the JDE, or the Eclipse Plug-In).

The .cod is what will be loaded onto the device, the .csl and .cso are files for the BlackBerry signature tool that tell it which signatures are needed (respectively, they list the required and optional keys needed for your app). If you don't have those 2 files, the signature tool will think no signatures are needed and won't sign the .cod, which will then fail to run on your device.

If no .csl file was generated, it means that there are no required signatures for your .cod, and you can run on the device without signing.

EDIT: Also the code signing keys are only $20 USD, and it's a quick process.

Answer 2

Your .cod file is generated automatically when you compile your code. You'll only need to sign it if you use any of the controlled API's: Runtime API, Blackberry Apps API and Crypto API.

You then register with Blackberry (which is free, but requires a credit card), they issue you with a signing key which you then use to sign all future cod files.

I use Eclipse with Blackberry JDE plugin and by navigating to the Blackberry -> Request Signatures.. dialog you will see if any of your .cod files need signed.

Answer 3

I wrote an article in Feb 2009 about this and it seems to have helped quite a few people:
BlackBerry Code Signing Help, Part II