Adobe AIR Building Apps

BUILDING ADOBE AIR APPLICATIONS
Signing AIR applications
190
Signing an AIR intermediate file with ADT
To sign an AIR intermediate file with ADT, use the -sign command. The sign command only works with AIR
intermediate files (extension airi). An AIR file cannot be signed a second time.
To create an AIR intermediate file, use the adt -prepare command. (See “ADT prepare command” on page 165.)
Sign an AIRI file
❖ Use the ADT -sign command with following syntax:
adt -sign SIGNING_OPTIONS airi_file air_file
SIGNING_OPTIONS The signing options identify the private key and certificate with which to sign the AIR file.
These options are described in “ADT code signing options” on page 172.
airi_file The path to the unsigned AIR intermediate file to be signed.
air_file The name of the AIR file to be created.
ADT -sign command example
adt -sign -storetype pkcs12 -keystore cert.p12 unsignedMyApp.airi myApp.air
For more information, see “ADT sign command” on page 165.
Signing an updated version of an AIR application
Each time you create an updated version of an existing AIR application you sign the updated application. In the best
case you can use the same certificate to sign the updated version that you used to sign the previous version. In that case
the signing is exactly the same as signing the application for the first time.
If the certificate used to sign the previous version of the application has expired and been renewed or replaced, you can
use the renewed or new (replacement) certificate to sign the updated version. To do this, you sign the application with
the new certificate and you apply a migration signature using the original certificate. The migration signature validates
that the original certificate owner has published the update.
Before you apply a migration signature, consider the following points:
• To apply a migration signature, the original certificate must still be valid or have expired within the last 365 days.
This period is termed as the ‘grace period’ and the duration can change in the future.
Note: Until AIR 2.6, the grace period was 180 days.
• You cannot apply a migration signature after the certificate expires and the 365 days grace period elapses. In that
case, users must uninstall the existing version before installing the updated version.
• The 365-day grace period only applies to applications specifying AIR version 1.5.3 or higher in the application
descriptor namespace.
Important: Signing updates with migration signatures from expired certificates is a temporary solution. For a
comprehensive solution, create a standardized signing workflow to manage the deployment of application updates. For
example, sign each update with the latest certificate and apply a migration certificate using the certificate used to sign the
previous update (if applicable). Upload each update to its own URL from which users can download the application. For
more information, see “Signing workflow for application updates” on page 249.
The following table and figure summarize the workflow for migration signatures:
Last updated 2/22/2016