Code Signing: Windows

Below link provides straight foraward, easy steps for cab file signing for windows application.

Windows signing by verisign

Code Signing: Java application Part-1

First of all sorry for the format of this document.
Each of the mobile platform has a code signing process that will verify that the mobile application is authentic. The objective of code signing is to ensure that mobile applications is well trusted, virus-free, and traceable to the company.

Verisign ACS (Authenticated Content Signing) Portal issues certificates for various mobile platforms. It has a good diagram on how mobile code signing works:

These instructions provide an overview of obtaining and using Sun Java signing and a
VeriSign Digital Certificate. The steps covered here are using the command promt utility. Other way around is to used J2ME's Utility for MIDLet signing if you are signing an j2me application.

1. Download the Java 2 SDK.
   The Java2 SDK for all platforms is available free of charge from java.sun.com.
   
   We will be using the following tools to apply for your VeriSign Code Signing Digital Certificate and sign your code: keytool, jar, and jarsigner.



2. Generate a public/private key pair.
   If you are novice (like i was before starting my first code signing task), i recommend you read my another blog entry to get know how of security terms like keypair, keystore and etc. Enter the following code, specifying an alias for your keystore, to generate a public/private key pair:
   
   C:\> C:\jdk1.3\bin\keytool -genkey -keyalg rsa -alias MyCert
   
   In this string, the keystore alias is MyCert and algorithm used is RSA.
   Keytool responds with prompts to enter a password for your keystore and your name,
   organization, and address information. The public/private key pair generated by keytool is saved to your keystore and will be used to sign Java applets and applications.
   
   Note: Your private key is never sent to VeriSign, so if you lose it, you will be unable to sign code. If your private key is lost or stolen, please contact VeriSign to cancel your certificate.



3. Generate a certificate signing request (CSR).
   Enter the following code to generate a CSR:
   
   C:\>C:\jdk1.3\bin\keytool -certreq -alias MyCert
   
   In this string, keytool is requested to create a CSR for the key pair in the keystore MyCert.
   After prompting you to enter the password for your keystore, keytool will generate a CSR
   similar to the following:
   
   -----BEGIN NEW CODE SIGNING ID REQUEST-----
   
   MIIBtjCCAR8CAQAwdjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRIwEAYDVQQHE
   wlDdXBlcnRpbm8xGTAXBgNVBAoTEFN1biBNaWNyb3N5c3RlbXMxFjAUBgNVBAsTDU
   phdmEgU29mdHdhcmUxEzARBgNVBAMTClN0YW5sZXkgSG8wgZ8wDQYJKoZIhvcNAQE
   BBQADgY0AMIGJAoGBALTgU8PovA4y59eboPjY65BwCSc/zPqtOZKJlaW4WP+Uhmeb
   E+T2Mho7P5zXjGf7elo3tV5uI3vzgGfnhgpf73EoMow8EJhly4/YsXKqeJEqqvNog
   zAD+qUv7Ld6dLOv0CO5qvpmBAO6mfaI1XAgx/4xU/6i6u6TLLOvgv9pMNUo6v1qB0
   xly1faizjimVYBwLhOenkA3Bw7S8UIVfdv84cO9dFUGcr/Pfrl3GtQ==
   
   
   -----END NEW CODE SIGNING ID REQUEST-----
   
   
   This string is an example of a CSR generated using keytool. A CSR contains a copy of the requestor’s public key and a hash of the data entered in step 2 signed with the requestor’s private key.
   
   Copy the CSR and paste it into the VeriSign Sun Java Code Signing Digital Certificate application form, accessible at
   http://www.verisign.com/products/signing/index.html.
   
   When your request is approved, VeriSign attaches your Sun Java Code Signing Digital
   Certificate to your confirmation email.
   
   Upon receipt, the attached certificate is saved to a file on your computer.
   A digital certificate is a “trust path” or “chain” back to the VeriSign root certificate. This trust path enables your code to be validated on any standard JRE without installing any additional files. Note: VeriSign takes a number of steps to verify your identity. For commercial publishers, VeriSign does a considerable amount of background checking. As a result, it will take approximately 3-5 business days to verify your information and issue a certificate.



4. Import your Digital Certificate.
   Enter the following code, with the path to your certificate, to import the chain into
   your keystore.
   
   C:\>C:\jdk1.3\bin\keytool -import -alias MyCert -file ABhiNew.cer
   
   In this string, keytool is requested to import the Digital ID “ABhiNew.cer” into the
   keystore MyCert.



5. Bundle your applet into a Java Application Resource (JAR) file.
   Use jar to bundle your applets or applications as a JAR file.
   C:>C:\jdk1.3\bin\jar cvf C:\TestApplet.jar
   This string creates a JAR file “C:\TestApplet.jar.” The JAR file contains all the files under the current directory and its subdirectories.
   JAR responds with:
   
   added manifest
   adding: TestApplet.class (in = 94208) (out= 20103)(deflated 78%)
   adding: TestHelper.class (in = 16384) (out= 779)(deflated 95%)



6. Sign your applet.
   Use jarsigner to sign the JAR file, using the private key you saved in your keystore.
   
   C:\>C:\jdk1.3\bin\jarsigner C:\TestApplet.jar MyCert
   
   At the prompt, enter the password to your keystore. Jarsigner hashes your applet or application and stores the hash in the JAR file created in step 5 with a copy of your certificate.
   Verify the output of your signed JAR file.
   
   C:>C:\jdk1.3\bin\jarsigner -verify -verbose -certs d:\TestApplet.jar
   
   This string verifies that the files have been saved to the JAR file and that the signature is correct.When the signed JAR file is downloaded, the JRE displays your VeriSign Digital Certificate to the user. If the file is tampered with in any way after it has been signed, the user will be notified and given the option of refusing installation.

Some of the really good links i would like to share here are:

http://java.sun.com/javame/reference/docs/sjwc-2.0-web/docs/ToolsGuide-html/jadtool.html

http://www.spindriftpages.net/blog/dave/2006/06/18/midlet-jar-signing-a-tutorial-revised/

Object Orientation (Chap-2) goes smoothly as well.

Object Orientation goes smoothly as well.

Cool. It didn't take much time to complete the chapter. It was

interesting. Nothing new was there, but was testing the awareness

around java world. Exam was good i think for chapter 2. I scored 11

out of 14. Chapter 3 looks lenghty but got a week to do it. So

chill out.

Chap1: Declaration and access control

Many of my new book kick off lasted for first chapter only. For example when I started reading “hibernate in action“, “webwork in action“, “ejb in action”, I was hardly able to close first chapter. But this time I’m firm. More determinant than ever. My other blog (http://abhi-java.blogspot.com) is also starving of new article.

As the names suggest the whole chapter was about pretty simple basic java stuff. But guess what? My test was horrible. I could solve only 5 out of 10 questions correctly. Anyways next chapter is due by coming Monday. So I got 2.5 days to finish the chapter. By finish I don’t mean to go through all pages but going through them from top to bottom At least next exam should score at least 80%.

Getting Started With the PIM APIs

Getting Started With the PIM APIs

Java refactoring Part-3

The creation of a good mental model is one of the key challenges in developing software. One way to build this model is by giving good names to your code. People should code not only for themselves but also for others as well.

I took interview yesterday for placement in my compnay. A saw the an answer given by a candidate as "Understanding code of others" in reply to the question " what do you hate most about software industry?".

Can you believe it how disgusting it feels when you read a bad code. Anyways not going further i've discussed some smells related names and refactoring for them in below presentation.

Click here to start presentation --> Measured Smells & Names

Java refactoring Part-2

The smells in this chapter are similar. They're dead easy to detect. They're
objective (once you decide on a way to count and a maximum acceptable score).
They're odious.

Click here to start presentation --> Measured Smells

Java Refactoring Part-1

Refactoring-the art of improving the design of existing code safely-provides an
efficient, reliable system for bringing order to the chaos, and one that keeps
the surprises to a minimum!

Click Here to start with first Presentation

HSQLDB and Ant

Wohh!! It’s been a long time with my application. I must say i’m too lazy for all these stuff. First think I really hate right now is that I missed my deadlines for Agile Project. But that’s because of some deadlines at office and some at home ;-).

Anyways, getting back to work. I’ve started to realize the power of ANT after starting my database with it as well as creating all tables with it as well. And guess what I was as easy as putting knife on butter.

An Overview of Object-Relational Mapping (ORM)
Majority of software application uses database to store application related information. One way to perform this storage related task is writing EJBs for storage where we map object with our Bean class. But this will only be the choice if I’m asked to work in distributed environment or I need more secure way of storing data.

ORM basically map database field with simple POJO. Although I have to still provide mapping between POJO and database field. This is typically done out side in xml file. Hibernate is one such ORM, which will be used for this project.

HSQLDB
HSQLDB is lightweight java database engine.

I’ve installed db on my workstation and copied hsqldb.jar in my lib folder. Next think

1. I would be doing is to start server.








classname="${hclass}" classpath="${hjar}"
args="${hfile} -dbname.0 ${halias} -port ${hport}"/>


This is from where my view about ANT started getting credited. The execution of above script will start my server on port 9005, which is default port for hsqldb server engine.

2. Now let’s create DB and insert some records with ANT script. I’ve not covered or questioned about DB design as I’m just trying going through sam’s application. I’ll cover all things in my Next application that will be designed and developed by only me.
Below is how my executeddl script looks like,


driver="org.hsqldb.jdbcDriver"
url="jdbc:hsqldb:hsql://localhost:${hport}/${halias}"
userid="sa" password=""
print="yes">
-- SQL script for TimeX
-- Step 1: Drop objects if they exist
DROP TABLE Department IF EXISTS;
DROP TABLE Employee IF EXISTS;
DROP TABLE Timesheet IF EXISTS;
DROP INDEX TimesheetIndex IF EXISTS;
DROP INDEX DepartmentCodeIndex IF EXISTS;
DROP INDEX EmployeeIdIndex IF EXISTS;

-- Step 2: Create tables
CREATE TABLE Department
(
departmentCode CHAR(2) NOT NULL,
name VARCHAR(255) NOT NULL
);

CREATE TABLE Employee
(
employeeId INT NOT NULL,
name VARCHAR(100) NOT NULL,
email VARCHAR(255) NOT NULL,
employeeCode CHAR(1) NOT NULL,
password VARCHAR(10) NOT NULL,
managerEmployeeId INT NULL
);

CREATE TABLE Timesheet
(
timesheetId IDENTITY NOT NULL,
employeeId INT NOT NULL,
statusCode CHAR(1) NOT NULL,
periodEndingDate DATE NOT NULL,
departmentCode CHAR(4) NOT NULL,
minutesMon INT NULL,
minutesTue INT NULL,
minutesWed INT NULL,
minutesThu INT NULL,
minutesFri INT NULL,
minutesSat INT NULL,
minutesSun INT NULL
);

-- Step 3: Create indexes
CREATE UNIQUE INDEX TimesheetIndex ON Timesheet (employeeId, periodEndingDate);
CREATE UNIQUE INDEX DepartmentCodeIndex ON Department (departmentCode);
CREATE UNIQUE INDEX EmployeeIdIndex ON Employee (employeeId);

-- Step 4: Insert some reference and test data
INSERT INTO Department (departmentCode, name)
VALUES ('AC', 'Accounting');
INSERT INTO Department (departmentCode, name)
VALUES ('CS', 'Customer Support');
INSERT INTO Department (departmentCode, name)
VALUES ('HR', 'Human Resources');
INSERT INTO Department (departmentCode, name) VALUES ('IT', 'Information Technology');

INSERT INTO Employee (employeeId, name, employeeCode,
password, email, managerEmployeeId)
VALUES (1, 'Mike Dover', 'H', 'rapidjava', 'mdover@acme.com', 3);
INSERT INTO Employee (employeeId, name, employeeCode,
password, email, managerEmployeeId)
VALUES (2, 'Ajay Kumar', 'H', 'visualpatterns', 'akumar@acme.com', 3);
INSERT INTO Employee (employeeId, name, employeeCode,
password, email, managerEmployeeId)
VALUES (3, 'Teresa Walker', 'M', 'agilestuff', 'twalker@acme.com', 4);
INSERT INTO Employee (employeeId, name, employeeCode,
password, email)
VALUES (4, 'Tom Brady', 'E', 'superbowl', 'tbrady@acme.com');

INSERT INTO Timesheet(timesheetId, employeeId, statusCode, periodEndingDate,
departmentCode, minutesMon, minutesTue, minutesWed,
minutesThu, minutesFri, minutesSat, minutesSun)
VALUES (1, 2, 'P', '2006-08-19', 'IT', 480, 480, 360, 480, 480, 0, 0);
INSERT INTO Timesheet(timesheetId, employeeId, statusCode, periodEndingDate,
departmentCode, minutesMon, minutesTue, minutesWed,
minutesThu, minutesFri, minutesSat, minutesSun)
VALUES (2, 1, 'A', '2006-08-19', 'HR', 0, 0, 480, 480, 480, 0, 0);

-- Step 5: Verify tables and test data look ok
SELECT * FROM Department;
SELECT * FROM Employee;
SELECT * FROM Timesheet;



Damn!!! Can you believe it all these steps were straight forward! I got hurdle going thought them. And ya my database is created successfully. How do I know? Good question and the answer are verifying it by opening database UI.

Ya but when I tried writing the above Ant script with some changes in DB name for my own student storage program. I went red.


args="${hfile} -dbname.0 ${halias} -port ${hport}">


Server started successfully with above target.
But

driver="org.hsqldb.jdbcDriver"
password=""
url="jdbc:hsqldb:hsql://localhost:${hport}/${halias}}"
userid="sa"
print="yes">
DROP TABLE student IF EXISTS;
CREATE TABLE student
(
rollNo INT NOT NULL,
name VARCHAR(255) NOT NULL
);



This was really a headache for me.
I was getting error below.

BUILD FAILED
C:\Users\ABhi\workspace\Practice\Agile\Hibernate\build.xml:26: java.sql.SQLException: Database does not exists in statement [hibernatedbalias}]

After making changes in above script my script looked like something below and now it was working. I don’t see any changes between both of these but just for the record I’m writing it below.



DROP TABLE student IF EXISTS;
CREATE TABLE student
(
rollNo INT NOT NULL,
name VARCHAR(255) NOT NULL
);


3. Open UI Navigator for our DB.


classname="org.hsqldb.util.DatabaseManagerSwing" />

if you are some geek like our network admin(who actually loves to type everything manually rather than using ready made UI for the same task), I’ve other script for that.


classname="org.hsqldb.util.SqlTool" args="localhost-sa"/>


If you are facing any problem till this point please mail me at
abhishek.gondalia@gmail.com
So that I can reproduce the same problem(Just for sake of solving it.)

Sam’s Agile Application. MP & ANT

Sam’s Agile Application.

First thing I needed to decide was whether how many hours from my day life I would be able to spend after this application (Along with my busy schedule at office)?

I just realized not more than 2 and not less than 1. So there it goes.

Microsoft Project

I installed Microsoft Project today. Just going through estimation of chapters. I like the some of its features like

1. Creating project based on your own calendar. In my case I needed something just like that. My working times are not as per some office times so it allowed me to properly estimate them based on hours.

2. Other feature is Task and subtasks dependency. I can directly drag and drop task behind each other to set them up in proper order.

I still need to see some of the areas where I can use in it pair programming and how it helps in assigning project task to different people. Because on that bases only I can estimate task for team. Right now with only one member in project (that me) it was easy to finish of the Project estimation phase. But believe me it wasn’t that easy as it sounds here. Even Microsoft was bad at documenting every aspect of project. I find its Help content very poor. Ya but I won’t be better person to judge it here.

Anyways moving along.

ANT

I started working with Ant. I have eclipse IDE which comes with in built support for Ant features. But as I wanted to avoid the ready made programming with IDE for time being. I installed Ant on my PC. Things went well, especially documentation. I read through some of its basic tutorial pages. After messing with my Environment variable and PATH variable I finally managed to run in from my application folder. I created a simple java file and was able to build it as jar at the end of the day.

I wonder what it would have been without Ant before rise of IDEs. Believe me it would have been chaos. Ant makes life a simple. I remember my organization using this Ant build file when I was new to IT world. Still I’ve not created build.xml file on my own. My tomorrow’s target would be to create one which builds and application for me.