Introduction to air code signature and publisher identifier

Use a certificate issued by a recognized certification authority (CA) The code signing certificate issued is for your AIR Digitally signing installation files can provide important assurance to your users , That is, the application they are installing has not been accidentally or maliciously changed , And identify you as the signer （ Publisher ）.

One 、 About AIR code signing

Yes AIR When signing a document , The installation file will contain a digital signature . The signature includes a summary of the package , Used to verify AIR Whether the document has not been changed since it was signed , It includes information about the signing certificate , Used to verify the identity of the publisher .

AIR Use the public key infrastructure supported by the certificate store of the operating system (PKI) To determine whether the certificate is trusted . install AIR The application's computer must be trusted directly for signing AIR Certificate for application , Or you must trust the certificate chain that links the certificate to a trusted certification authority , To verify publisher information .

If AIR The certificate used by the file is not linked to one of the trusted root certificates （ Typically this includes all self signed certificates ）, The publisher information cannot be verified . although AIR Can be determined AIR The package has not been changed since it was signed , But it's impossible to know who actually created and signed the document .

So be sure to choose credible Code signing certificate brand , Such as Comodo、DigiCert etc. .

Two 、 About AIR Publisher identifier

Important note ： from AIR1.5.3 Start , Publisher ID Have been abandoned , No longer calculate based on code signing certificate . New applications do not need and should not use publishers ID. When updating an existing application , You must specify the original publisher in the application descriptor file ID.

stay AIR1.5.3 Before ,AIR The application installer will install AIR Generate publisher during file ID. This is for signing AIR Unique identifier of the certificate for the file . If you are more than one AIR Applications reuse the same certificate , They will receive the same publisher ID. Sign application updates with different certificates , Sometimes even updating the original certificate instance changes the publisher ID.

stay AIR 1.5.3 And later , Publisher ID Not by AIR The distribution of . Use AIR 1.5.3 The published application can specify the publisher in the application descriptor ID character string . You should only start with 1.5.3 Previous AIR When an application with a version release releases an update, specify the publisher ID. If you do not specify the original in the application descriptor ID, It's new AIR Packages are not considered updates to existing applications .

To determine the original publisher ID, Please find the publisher number where the original application was installed META-INF/AIR Files in subdirectories . The string in this file is the publisher ID. Your application descriptor must be specified in the namespace declaration of the application descriptor file AIR 1.5.3 Runtime （ Or later ）, To manually specify the publisher ID.

Publisher ID（ If there is ） For the following purposes ：

As part of the encryption key stored locally

As part of the application storage directory path

As part of the connection string of the local connection

As part of the identity string , Used by AIR In browser API Call the application

As OSID Part of （ Before creating a custom installation / Use... When uninstalling the program ）

When the publisher ID When changes , rely on ID Any of the AIR The behavior of the function will also change . for example , Data in existing encrypted local storage can no longer be accessed , And any that creates a local connection to the application Flash or AIR All instances must use the new... In the connection string ID. Publisher of installed application ID stay AIR1.5.3 Cannot be changed in or later versions . If you're publishing AIR Use different publishers for packages ID, The installer will treat the new package as a different application rather than an update .