multiple problems trying to sign and deploy for PlayBook - submit

Question

I have spent days trying to submit my app on the RIM Vendor Portal.
I can build it. I can run it on my device using debugtoken.bar.
When I try to submit it to the Vendor Portal I get the dreaded "Some files are missing signatures" error.
I built my application.bar file (actually named QuoteUnquote.bar), then signed it with:
"C:\Program Files (x86)\Research In Motion\BlackBerry WebWorks SDK for TabletOS 2.1.0.6\bbwp\blackberry-tablet-sdk\bin\blackberry-signer" -verbose -cskpass ******** -keystore sigtool.p12 -storepass ******** "C:\work\word\quotes\platform_airplay\build_smartquotes-airplay_vc10\deployments\default\playbook\release\QuoteUnquote.bar" RDK
"C:\Program Files (x86)\Research In Motion\BlackBerry WebWorks SDK for TabletOS 2.1.0.6\bbwp\blackberry-tablet-sdk\bin\blackberry-signer" -keystore sigtool.p12 -storepass ******** "C:\work\word\quotes\platform_airplay\build_smartquotes-airplay_vc10\deployments\default\playbook\release\QuoteUnquote.bar" author
I confirm that there are the required five files inside the META-INF folder in the signed .bar file.
When I verify it without the -verbose option, it just says ".bar verified". When I verify it with the -verbose option, the verify tool appears to crash:
C:\work\word\quotes\platform_airplay\PlayBook>"C:\Program Files (x86)\Research In Motion\BlackBerry WebWorks SDK for TabletOS 2.1.0.6\bbwp\blackberry-tablet-sdk\bin\blackberry-signer" -verify -keystore sigtool.p12 -verbose "C:\work\word\quotes\platform_airplay\build_smartquotes-airplay_vc10\deployments\default\playbook\release\QuoteUnquote.bar"
2240 Sat Jun 30 00:31:16 PDT 2012 META-INF/MANIFEST.MF
1287 Sat Jun 30 00:31:16 PDT 2012 META-INF/AUTHOR.SF
710 Sat Jun 30 00:31:16 PDT 2012 META-INF/AUTHOR.EC
1287 Sat Jun 30 00:31:02 PDT 2012 META-INF/RDK.SF
280 Sat Jun 30 00:31:02 PDT 2012 META-INF/RDK.EC
0 Tue Jan 01 00:00:00 PST 1980 META-INF/
0 Tue Jan 01 00:00:00 PST 1980 native/
barsigner error: java.lang.NullPointerException
So that's not very helpful. I don't know if the -verify tool is just flaky, or if some problem with the .bar file is making it crash, or what.
This is all very frustrating because I've successfully signed and submitted .bar files in the past. I don't know what I'm doing differently now.
As I say, I've been stuck on this for days. If you can give me pointers, that would be great. If I can send you my .bar file and you can tell me what's wrong with it, that would be better.
Any help greatly appreciated.

Answer 1

My little hack to get around this was to sign the .bar as usual (RDK and Author) then rename the .bar file to .zip and extract all files into an temporary directory.
Using 7Zip I then RE-ZIP all files using this command:
7z a -tzip <AppName>.bar *.* -r
Which will re-zip all files back and remove the entries for directory names.
Run a verify on it:
blackberry-signer -verbose -verify <AppName>.bar
So long as you properly signed the app, you should see the lovely message:
Info: Bar verified.
Submit it and off you go!

Answer 2

I have figure out what was going on here. The problem is that there are two kinds of .zip files in the world, those where the directories get their own entry in the .zip file's directory, and those where they don't. This is a difficult issue because (as I understand it) most tools for viewing .zip files don't give an indication of whether the directories have their own entries -- they just show the directories using GUI folder icons like in Windows Explorer or whatever.
The solution was given here: http://supportforums.blackberry.com/t5/Native-Development/Error-while-uploading-Invalid-signature-file-digest-for-Manifest/td-p/1623873
It gives a java program to rebuild the .zip from the extracted contents, and using that particular java library to rebuild the .zip does not include the folders as their own entries.
This problem arose for two reasons:
(1) The RIM Vendor Portal submission tool checks to see if each item in the file is properly signed, and it apparently sees those two directory entries in the contents directory and freaks out because they are not signed, hence "Some files (sic) are missing signatures." In fact, it seems like it could just notice that those are zero-length directory entries and that there's nothing to sign anyway, and just let it go. That would avoid the whole mess in the first place.
(2) The Marmalade tool that makes the .bar file creates a zip that includes those directory entries. What's tricky is that, best as I can tell, it doesn't create those entries on everyone's system, just on some. There are other Marmalade users who apparently don't get this problem. I don't know if it has to do with the underlying .zip library that the Marmalade tool is using, whether that's part of the .jdk, part of the python system Marmalade uses, or what. But it definitely seems to behave differently on different systems.
So, both RIM and Marmalade should include information about this. When RIM gives the error that "some items are missing signatures" it should specify that it's these zero-length directory entries that are missing signatures (or it could just not treat it as an error at all, as mentioned above). Marmalade should tell all users who are working on PlayBook submissions about this issue.

Answer 3

Ok don't use this method.... it verifies and allows you to submit BUT on RIM's side they will complain about the fact that you modified the .bar file AFTER it was signed! !