Signing of packages from command line possible?

Robs_1976 over 8 years ago

Since the last update from Garmin the signing feature of the IQ package seems to be mandatory.

For resource reasons I create a IQ file for each watch type seperately and merge the manifest file afterwards. This is possible as an IQ file is simple a zip file.

Since the introdocution of the signing feature this is not possible anymore as it seems that the signature is calculated over all watch-specific PRG-files.

Is there a possibility to sign an IQ-package from command line?

travis.vitek over 8 years ago

C:\Development\Garmin\connectiq-sdk-win-2.1.1\bin>monkeyc -?
ERROR: Unrecognized option: -?
usage: monkeyc [-a <arg>] [-b] [-d <arg>] [-e] [-g] [-i <arg>] [-k] [-m
               <arg>]
               [-n <arg>] [-o <arg>] [-p <arg>] [-q] [-r] [-t] [-u <arg>]
               [-v] [-w] [-x
               <arg>] [-y <arg>] [-z <arg>]
 -a,--apidb <arg>          API import file
 -b,--buildapi             Build API output files
 -d,--device <arg>         Target device (default: square_watch_sim)
 -e,--package-app          Create an application package.
 -g,--debug                Print debug output
 -i,--import-dbg <arg>     Import api.debug.xml
 -k,--write-db             Write out the api.db file
 -m,--manifest <arg>       Manifest file
 -n,--api-version <arg>    The new API version
 -o,--output <arg>         Output file to create
 -p,--project-info <arg>   projectInfo.xml file to use when compiling
 -q,--carray               Write output as a C array (deprecated)
 -r,--release              Strip debug information
 -t,--unit-test            Enables compilation of unit tests
 -u,--devices <arg>        devices.xml file to use when compiling
 -v,--version              Prints the compiler version
 -w,--warn                 Show compiler warnings
 -x,--excludes <arg>       Add annotations to the exclude list
 -y,--private-key <arg>    Private key to sign builds with
 -z,--rez <arg>            Resource file

The -y command-line argument can be used to sign individual .prg files, and if I understand correctly, the final .iq file is signed by Garmin when it is uploaded.

Travis

Petr.Koula over 8 years ago

The packager is also signing the manifest file for the .iq file.

Robs_1976 over 8 years ago

Signing

Thanks a lot for the fast replies. For me and other users as well as for Garmin it would be a big pitty if it is not possible to optimize apps to its maximum by only including what is necessary for a watch as the memory with 64kB is more than callenging. If this is not possible anymore then I have to make out of one app which supports all watches up to 7 apps which is more effort for me and creates a mess on the Garmin App Store if all developers are forced to do that.

I´m working at Infineon and have to do a lot with cryptography. So I know that signing things could be an independent post-processing step after all PRG-files are generated in their sub-folders. I would not have a problem that the manifest file is included in the signature process as this is anyway the same and includes all devices.

Please help me with hints to solve this issue.

Thanks in advance,

Robert

Robs_1976 over 8 years ago

Issue is solved. Refer to following description:
https://forums.garmin.com/showthread.php?360228-Confusion-about-SDK-version-in-CIQ-2-1-3&p=897351#post897351

jim_m_58 over 8 years ago

Issue is solved. Refer to following description:
https://forums.garmin.com/showthread.php?360228-Confusion-about-SDK-version-in-CIQ-2-1-3&p=897351#post897351

I wouldn't call it solved (when it comes to conditional compiles), but a big step forward.

One thing people have requested when it comes to conditionals, is the ability to automatically include or remove code based on a release build vs a debug build. For example, if you have a bunch of logging or alternate displays for debug purposes, it would be nice to automatically not include that code for a release build, but still make it easy to send to a user debug build to collect more info.

Also, it may be helpful for conditional compiles based on the VM version of the target. Say you have something that needs to work one way with a 1.2.x VM and can do it in a better way on a 1.3.x VM (This could be something like a 230 and 230j). Granted you can use "has" for this (and I do), but you include both ways to do it in all .prgs for that device, or at least the code for something in 1.3.x that's just wasted space on 1.2.x.