Digitally signing Adobe AIR applications

Signing an AIR application with the Flex 3 SDK

Geeky developers may shun all rich development tools for creating their AIR applications, in which case, they've opted to use the Flex 3 SDK with their favorite text editor (Emacs, VI, TextMate, and so on) and the Flex SDK command line compiler (mxmlc.exe) to make applications happen. Or, maybe you have a build server that manages your code, compilation, and deployments and need it to automatically sign your AIR application before posting to a network share. When using the Flex SDK or having your build server manage builds, you'll need to use the ADT application to package and sign your AIR application. Being a command line guru, I'll assume you've already read Creating your first AIR application with the Flex SDK in Adobe LiveDocs, which should get you up to speed on creating your first AIR application that will need to be signed with the raw SDK.

To sign an AIR application written with the Flex SDK, you'll need to acquire a certificate from a CA as documented above. However, for testing purposes, you can create a self-signed certificate from the command-line by using the ADT application which can be found in the Flex 3 SDK/bin directory. Make sure the Flex SDK/bin directory is in your system path so the applications there can be found when you execute them from other locations, like where your source code is for your application.

Let's create a self-signed certificate from the command line:

1. Open a command window (Windows) or an Application shell (OS X) and type in:

   adt -certificate -cn AnythingHere 1024-RSA test_cert.pfx password

   Substitute your own common name for AnythingHere, your own name for the certificate file test_cert.pfx (making sure to keep the file name with a PFX extension), and a password of your choice. Don't forget the password.

   A certificate was created in the directory where you ran the ADT application with a name of test_cert.pfx. Remember the path to this file.

2. Now that you have a certificate, whether self-signed or acquired from Thawte according to the directions above, you're ready to sign your AIR application.

3. From a command line, type:

   adt -package -storetype pkcs12 -keystore test_cert.pfx -storepass
   password TestApp.air TestApp-app.xml TestApp.swf

   Where test_cert.pfx is your certificate that you either created above or exported from Firefox. TestApp-app.xml is the descriptor file that describes your application to the AIR runtime, and TestApp.swf is the application file that you created when you used the mxmlc application from the command line to compile your SWF. TestApp.air is the name of the AIR package that you're creating which will be distributed to your end users. The value you pass into the storepass is the password that you used when you either exported your certificate from Firefox, or the self-signed certificate that you created above.

4. Press Enter to begin the packaging and signing process.
5. If all goes well, an AIR package titled TestApp.air will have been created and is ready to distribute to your users.

That's it. You've packaged and signed an AIR application from the command line. Skip ahead and read Testing the AIR installation.

Page 4 of 7

Previous Page

Next Page