4 Replies Latest reply on Jan 4, 2010 7:05 PM by tedalde2

    App will only install using AIR 1.5.3

    tedalde2 Level 2

      I recently packaged and signed an application using the AIR 1.5.3 SDK. The app will now only install if the user has AIR 1.5.3, and fails with 1.5.2, 1.5.1, etc. The application namespace is AIR 1.5, not 1.5.3.

       

      This is an application update, though it also fails on a <1.5.3 system without a previous install. I logged the error during app install:

      failed while unpackaging: [ErrorEvent type="error" bubbles=false cancelable=false eventPhase=2 text="invalid package signature" errorID=5022]

       

      The certificate used to sign this app has recently expired. Is that the problem?

       

      This is really frustrating. I intentionally signed the app update BEFORE the cert expired to avoid all this crazy s#%^# about migration signatures, botched publisher ids, requiring users to have AIR 1.5.3 etc (or at least kick it down the road 6 months; AIR 1.5.3 had just come out). Now it looks like all users who try to install this app will need AIR 1.5.3 anyway.

       

      I suppose that since users need (certain) admin rights to install the app anyway, updating to 1.5.3 won't be a barrier. But it's still an added aggrevation and yet another thing we need to QA. The client won't be happy.

       

      So is this a bug or a feature? If I signed using the AIR 1.5.2 SDK would the thing still work?

        • 1. Re: App will only install using AIR 1.5.3
          tzeng Adobe Employee

          If your original cert has expired, you need to use namespace 1.5.3.

          When an user tries to install the 1.5.3 app, AIR Runtime will download and install AIR Runtime 1.5.3 automatically.

          • 2. Re: App will only install using AIR 1.5.3
            tedalde2 Level 2

            I understand that I should (need to) use AIR 1.5.3 to update an app _after_ a cert expires.

             

            However this particular issue should be noted in the documentation, at least after some testing and clarification. Here's the best succinct description of this problem I can think of:

             

            If you sign an application update with a valid certificate using ADT 1.5.3 and:

            -- your certificate subsequently expires and

            -- it does not define the 1.5.3 namespace then

            you will need to resign your application defining the namespace as AIR 1.5.3 and use the 1.5.3 certificatemigration procedure. Users of your application will be required to update to AIR 1.5.3.

             

            I haven't yet tested the original application install on a non-1.5.3 system since the certificate expired. However I would _assume_ it still installs, since documentation states that an application signed with a valid certificate (and a timestamp) that subsequently expires will install any time in the future.

             

            So it seems using ADT 1.5.3 for signing REQUIRES end users to use 1.5.3 because of this problem, since once the cert expires (almost guaranteed to occur during any 12 month period) users with <1.5.3 will see the installation error if the app namespace is not 1.5.3.  This is a fundamental problem since preparing/signing an app with a particular ADT version should not require that version for the end user.

             

            I'll try to test the original signed app on a <1.5.3 system:

            -- If it works that means this issue should be flagged in the AIR documentation somewhere.

            -- If it fails, that means this post is wrong, and it also means that any AIR app whose cert expires will fail to install.

             

            So I'll need to re-prepare my app update using the AIR 1.5.3 certificate migration procedure.

            • 3. Re: App will only install using AIR 1.5.3
              tzeng Adobe Employee

              Thanks for letting us know your concen. We did notice this problem.

              We will clarify this issue after holiday.

               

              For now, you should use namespace 1.5.3 for expired certificate migration.

              In fact, you should not use ADT 1.5.3 to package namespaces other than 1.5.3 for now.

              1 person found this helpful
              • 4. Re: App will only install using AIR 1.5.3
                tedalde2 Level 2

                Thanks. I packaged the app again, this time with a migration signature using ADT 1.5.3. And since the app now requires 1.5.3 it looks like users with 1.5.2 will get "silently" updated to AIR 1.5.3; that's better. I'm still concerned about users who may have rights to update the app, but not AIR itself. But that's probably a minor concern.