×

Discussion Board

Results 1 to 5 of 5
  1. #1
    Registered User
    Join Date
    Apr 2005
    Location
    Barcelona
    Posts
    1,678

    Symbian Signed woes

    Imagine the following use case:

    - I developed an application which only requires "Self Signing". For this I use an allocated UID in the unprotected range, sign the app myself and distribute it through usual means (web, etc)

    - Now either because I've added some new features (which require System Capabilities) or decided to publish through Ovi Store or whatever (ie. don't like the user getting the typical warning dialog shown in self signed apps) I'd need a new UID, given that "Express Signed" would require me to use an UID in the protected range. This would even apply should I decide to publish my app through Ovi Store (regardless the use or System Capabilities) from what I understand.

    - Now for some reason I decide to offer the app through alternative channels besides Ovi Store. As I don't own the UID, I'd need to request a new one in order to "Express Sign" the application. A similar case would happen should my application require Restricted Capabilities (and thus Certified Signing, which Ovi Store currently doesn't support) even though this is a more special case, I admit.

    How many UIDs changes have we had? I've lost count.

    IMHO, this is completely unacceptable and unneeded. Specially now that Nokia literally owns Symbian (including Symbian Signed) I'd really expect a more flexible approach. I've been listening for months / years about changes and improvements, but have to say the current situation is far from ideal (and practical)

    Let me stress that I completely understand Ovi keeping the signed file to themselves for the case they sign it (after all, they're "paying" for it), but I don't see why the developer wouldn't own the UIDs allocated to him. This would at least alleviate the pain to be switching UIDs here and there.

    If you think switching UIDs is just changing a number, think better. It makes application updates completely unusable and in cases where the application stores data (in private folders for example) it forces the use of unorthodox techniques to save the user of this added hassle. Symbian already poses some "complications" just to add one like this..

    David.-

  2. #2
    Registered User
    Join Date
    Dec 2006
    Posts
    2,280

    Re: Symbian Signed woes

    I agree with all you said, but...

    There are actually still (delayed) Symbian Signed improvements in the works and a nice chap called Simon Pope is staying on at the Symbian Foundation until they're done.

    I guess the problem with Ovi allocating UIDs that belong to them is that they didn't own the Symbian Signed portal and as far as I know never even asked for the ability to add UIDs to other people's accounts (which would have required changes to the portal, which would have been rolled up into the "big changes" that are currently being made anyway) - so there was a practical barrier there.

    From a practical perspective the way to avoid all this pain for now is to get your own protected range UID and request a developer certificate from the start (and yes, I know that makes distribution tricky - and I've been pretty vocal about how hard that makes beta testing) then pay for your own Express Signing...

    Of course that means you need to shell out for a publisher ID but unless something goes wrong, I don't think we'll have to worry about that for much longer. I can't promise anything of course but it might be worth seeing how the land lies in another couple of months (and yes, I can't believe how long it's taken either... some management at the Symbian Foundation mistakenly thought that the now-dead Horizon was a much higher priority than this vital link in the development and distribution chain).

    Mark

  3. #3
    Nokia Developer Moderator
    Join Date
    Sep 2004
    Location
    Tampere, Finland
    Posts
    11,355

    Re: Symbian Signed woes

    Indeed, Ovi Publishing acts as any other "Symbian Signed" customer. They send files to signing therefore they must own the UIDs used in those files. Since the overall process is not designed with this concept of middleman publisher in mind, there are clearly problems (as correctly described by David) and the solution requires proper planning and some expenses (as suggested by Mark).

    There is little to be done in short term, but this is valid input for whatever future plans.

    Btw, I would say that Ovi is by far the main distribution channel and that the alternatives, although they exist, are more like exceptions. You may want to contact Ovi Publishing and ask for permission to distribute the Ovi Signed application through other channels as well. I am confident that as long as this solution path it is not abused, Ovi Publishing will prove to be supportive. Well, give it a try, it costs nothing.
    -- Lucian

    If you are not yet a DVLUP member it is time to correct that mistake :) Click here to join: http://www.dvlup.com/lucian/Invite

  4. #4
    Registered User
    Join Date
    Apr 2005
    Location
    Barcelona
    Posts
    1,678

    Re: Symbian Signed woes

    Thanks for the replies guys. I admit that blaming onto something that didn't happen at that time (Symbian becoming part of Nokia) is not fair, neither is about these delays considering that most of the people involved were losing their jobs at Symbian Foundation. My "rant" mostly comes on the fact that for one reason or another it's been a long while since things haven't changed for the better. I still recall attending SEE09 and hearing about future improvements. It's 2011 now and I really hope that for once and all things get sorted out in this regard. Competing platforms offer far simpler approaches and this is the goal Nokia should aim at. Sometimes I feel that all the attention is going towards frameworks that eases development, but please note that this is also a very important part of the overall process and as such shouldn't be ignored.

    That said, I completely agree with Mark's concern about how hard this makes it for beta applications, as well as other situations like open source projects which often involve fast iterations and are mantained by individuals. Personally if you asked me, I'd also drop this Self - Express signed separation and would merge both categories, thus removing the need to use separate UIDs ranges which just add more (unneeded) complexity to the issue. I'm sure people at SF and Nokia had probably thought about these issues already, so it's just a matter of making this happen.

    I also agree that in practice Ovi Store is the place to go, so again such use case is not the norm. That said, I'd feel more confident to know that my (Ovi, SS) account owns the UIDs and thus allows me to follow other paths should I want to, instead of having to be begging for signed binaries :-)

    David.-

  5. #5
    Registered User
    Join Date
    Oct 2007
    Posts
    5

    Re: Symbian Signed woes

    Quote Originally Posted by ltomuta View Post
    . You may want to contact Ovi Publishing and ask for permission to distribute the Ovi Signed application through other channels as well. I am confident that as long as this solution path it is not abused, Ovi Publishing will prove to be supportive. Well, give it a try, it costs nothing.
    I tried. I tried three times . So far zero replies.

    The situation is utterly and completely ridiculous.

    Ovi Store doesn't support updates. Not asking for automatic notifications of app updates here. Sure you can send an updated version of your asset to the store and it will become downloadable. But not for the customers who have already downloaded the old version! When they go to the app's page in the store client, they'll see that "Launch" button there. Fine, I'll do it myself. Check for updates during the app startup, download a file over http and start the installer. No biggie with Qt. But what the !"¤@$ am I supposed to install when they won't give me the signed update? It can't be money because they still pay for the signing of those updated versions people send to the store. So in order to serve existing customers Symbian signed gets paid twice (once by Ovi and once by the developer)?

    I'm used to hacking around most of the broken things, but this is just idiotic. If someone starts pimping Ovi signed apps to other app stores (don't really understand why people would do that, because clearly Ovi gives the best exposure of your app to consumers), update the T&C and sue them.

    Lucian, do us all a favor and please contact someone inside Ovi and explain them the situation. As a quick remedy they should just give away the signed SIS files for self-serving updates and then come up with the update support in the client pretty damn fast.

Similar Threads

  1. Will my get signed by Symbian Signed ?
    By srivatsan.d in forum Symbian Signed Support, Application Packaging and Distribution and Security
    Replies: 6
    Last Post: 2009-04-20, 15:15
  2. Self-signed to symbian signed
    By jascco in forum Symbian Signed Support, Application Packaging and Distribution and Security
    Replies: 8
    Last Post: 2008-02-27, 12:23
  3. Symbian Signed recognizer with self signed exe?
    By vonolsson in forum Symbian C++
    Replies: 2
    Last Post: 2007-02-23, 10:10
  4. More Symbian SDK woes
    By deepakprabhakara in forum Symbian Tools & SDKs
    Replies: 1
    Last Post: 2006-05-20, 18:00
  5. Symbian 9 SDK woes
    By deepakprabhakara in forum Symbian Tools & SDKs
    Replies: 4
    Last Post: 2006-05-11, 08:25

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •