<?xml version="1.0" encoding="utf-8"?>

<!-- Copyright (c) 2007-2010 Nokia Corporation and/or its subsidiary(-ies) All rights reserved. -->

<!-- This component and the accompanying materials are made available under the terms of the License 

"Eclipse Public License v1.0" which accompanies this distribution, 

and is available at the URL "http://www.eclipse.org/legal/epl-v10.html". -->

<!-- Initial Contributors:

    Nokia Corporation - initial contribution.

Contributors: 

-->

<!DOCTYPE concept

  PUBLIC "-//OASIS//DTD DITA Concept//EN" "concept.dtd">

<concept id="GUID-AFBD4ED6-9588-531C-8EDF-566DB1D03088" xml:lang="en"><title>Signing

SIS Files</title><prolog><metadata><keywords/></metadata></prolog><conbody>

<p>An installation (SIS) file must be signed with a digital signature, which

helps in verifying the identity of the vendor. This ensures that the file

has not been tampered with since it was signed. </p>

<p>Software install package files can be signed multiple times. However, it

is not required to sign the file with multiple signatures at the same time.

Signatures can be added and removed from a package file at any time if the

relevant keys are available. <xref href="GUID-B20EE8A3-D7B2-5872-AF43-001A88C1A46E.dita">SignSIS</xref> supports

the signing of SIS files with self-signed certificates or Symbian developer

certificates. </p>

<section id="GUID-52029821-0FA4-58C7-94B9-C6B845C42098"><title>Self-signed

certificates</title> <p>The term <i>self-signed</i> means that the SIS file

is signed by the creator of the SIS file. A SIS file is <i>self-signed</i> if

it signed by a certificate that has been self generated. For example, using <xref href="GUID-557BF1DA-B6E8-521B-89F0-15C84E3BCB1A.dita">MakeKeys</xref>. </p> <p>SIS

files can be signed by Symbian application developers for programs that: </p> <ul>

<li id="GUID-E2CB54EA-B638-5589-88FF-36DDA57E3388"><p>do not use any APIs

protected by capability checks. </p> </li>

<li id="GUID-717FBB11-F58A-5DE5-855A-F41A0CC9AF1B"><p>only require platform

security capabilities that belong to the "user" or "basic" capabilities group.

If the Software Installer is required to install a program with these capabilities,

it can display capability information to the Symbian device user and provide

an option to continue or cancel the installation. </p> <p>As long as the application

requests no system capabilities, self-signed SIS files can be installed depending

on how the installation policy has been configured by the device creator. </p> </li>

</ul> <p> <b>Note</b>: Self-signed SIS files are not associated with a root

certificate present on the device. </p> </section>

<section id="GUID-95FEC08E-0E38-5F88-9FE5-D2DE16BE08FD"><title>Symbian developer

certificates</title> <p>To test applications on Symbian devices, the SIS file

can be signed with a Symbian developer certificate. This allows the application

to be installed without the need for an external testing and signing process.

Symbian developer certificates can be obtained through <xref href="http://www.symbiansigned.com" scope="external">www.symbiansigned.com</xref>. </p> <p>The usage of Symbian

developer certificates is restricted to the following: </p> <ul>

<li id="GUID-01E1055E-C77B-5C42-B54F-EF7A396669BD"><p>Usage with one or more

listed phones only (through the IMEI/ESN number). </p> </li>

<li id="GUID-D78F1294-5BB2-52BE-BA31-C06D72261B28"><p>Validity until a specific

date, after which the certificate expires. </p> </li>

<li id="GUID-676EB812-5C9B-5291-8746-6FA50B41F651"><p>An agreed set of capabilities

that the certificate can grant. </p> </li>

<li id="GUID-8C79AB5F-6708-538E-A0EA-71D493D3D576"><p>A set of SIDs of executables

that can be installed by the SIS file. If the SIS file package UID is in the

protected range then it must be included in the list of UIDs in the certificate. </p> </li>

</ul> <p> <b>Note</b>: A Symbian developer certificate is indirectly signed

against one of the Symbian root certificates, which are present on the Symbian

device by default. </p> </section>

<section id="GUID-C35BB441-E849-5CC4-B1B8-C50C6F250129"><title>Symbian signed

program</title> <p>Some applications require platform security capabilities

that cannot be granted by the Symbian application developer. These programs

must be tested externally and signed with a certificate, which the Software

Installer recognizes as provided by a trusted entity. </p> <p>This process

is done through the Symbian Signed programme. For details on ACS Publisher

ID certificates, Symbian developer certificates and the signing process, see <xref href="http://www.symbiansigned.com" scope="external">www.symbiansigned.com</xref>. </p> </section>

<section id="GUID-D04B60BA-59A7-59FF-824F-2DC27CE01B74"><title> MANDATORY

certificates </title> <p>If a certificate is marked as <codeph>MANDATORY</codeph> then

any package certificate presented during the software installation, must have

a certificate chain that resolves to this certificate (and any other certificates

marked as <codeph>MANDATORY</codeph>). If the certificate chain does not resolve

to a mandatory certificate, the installation fails. This feature prevents

any unauthorized applications from being installed on the device. </p> <p> <b>Note</b>:

Unsigned or self-signed applications cannot be installed, if a <codeph>MANDATORY</codeph> certificate

is present. </p> </section>

</conbody><related-links>

<link href="GUID-03BBEA31-3266-5B1C-9017-4EE7EA4AF1A8.dita"><linktext>Creating

and Signing an Installation File</linktext></link>

<link href="GUID-B20EE8A3-D7B2-5872-AF43-001A88C1A46E.dita"><linktext>SignSIS</linktext>

</link>

<link href="GUID-557BF1DA-B6E8-521B-89F0-15C84E3BCB1A.dita"><linktext>MakeKeys</linktext>

</link>

</related-links></concept>