Repository navigation
docs(skills): explain building and signing a HarmonyOS HAP - #1548
Conversation
Covers the CLI hvigor build, signing with the SDK's OpenHarmony test keys, and the Huawei ID routes (DevEco auto-signing, AppGallery Connect). Notes that the emulator installs any HAP, so it cannot validate signing.
Set C and L inside the code blocks, point sign-app at the build output, give verify-app its java -jar prefix and say what it does not check, and add the phone's install error codes plus the missing DevEco and AppGallery Connect steps.
|
Tested on a real phone and app, appears to work. Without this line it's been observed that agents are often unaware of their ability |
…nstall loop The build block failed with 'Unable to locate a Java Runtime' on a host without a system JDK: hvigor's PackageHap needs java. Also state the entry/default assumption, drop the DEVECO_STUDIO_HOME pointer (DevEco never sets it), say where hdc lives, and end on reinstall-app.
Without the chain, sign-app ran after a failed sign-profile, signed the HAP with the previous profile.p7b and reported success.
latekvo
left a comment
latekvo
left a comment
There was a problem hiding this comment.
[Diplomat, Opus 5.5]: Ran both blocks verbatim in env -i bash and zsh shells against a DevEco hello-world project, then installed a test-key-signed HAP on the Mate 60 through reinstall-app + launch-app (foreground per aa dump -l). Below are the minor gaps that remain after the fixes in 67396b7 and 1ef5c64.
| - DevEco Studio: sign in, connect the phone, and tick _Automatically generate signature_ under File > Project Structure > Project > Signing Configs. Tick _Support HarmonyOS_ too if it is offered; without it the signature is an OpenHarmony one. It writes `signingConfigs` into `build-profile.json5`, and the build above then emits `entry-default-signed.hap`. | ||
| - AppGallery Connect: create a `.p12` and CSR (DevEco: Build > Generate Key and CSR), then request a debug certificate (`.cer`) from the CSR, register the phone's UDID and the app, and request a debug profile (`.p7b`) for that app, that certificate and the device. Run only `sign-app` above with your `.p12`, key alias, passwords, `.cer` and `.p7b`; AppGallery Connect has already signed the profile. | ||
|
|
||
| In the signing block's shell, `java -jar $L/hap-sign-tool.jar verify-app -inFile <hap> -outCertChain c.cer -outProfile p.p7b` checks the signature on the host, but not that the profile's bundle name matches the HAP's. A phone refuses that mismatch with `9568329 verify signature failed`, so only an install proves the phone accepts a HAP. Install it with `reinstall-app` (`appPath` the HAP's absolute path, `bundleId` its bundle name), then `launch-app` it. |
There was a problem hiding this comment.
[Diplomat, Opus 5.5]: verify-app also passes a profile whose validity window is expired (the template's own 2021-2024 window) or starts in the future (e.g. milliseconds passed where step 2 wants epoch seconds). sign-profile, sign-app and verify-app all exit 0 in both cases, but the sentence names only the bundle-name mismatch as something it misses.
There was a problem hiding this comment.
Not changing this one. The phone doesn't enforce validity either, so verify-app has nothing to miss here. Reproduced your host result: an expired window (2021-2024) and one starting in the future (milliseconds where seconds belong) both pass sign-profile, sign-app and verify-app with exit 0. But on the Mate 60 (BRA-AL00), hdc install of both HAPs gives install bundle successfully, the same as a current window. The sentence names the bundle-name mismatch because the phone refuses that one (9568329) and verify-app passes it. An expired or future window has no such gap, since host and phone both accept it.
Delete the build outputs and app-signed.hap before each run so a failed build or sign-app leaves nothing to sign or install, say what a foreign signingConfigs does to the build, and warn that reinstall-app uninstalls before installing.
Agents driving HarmonyOS had no guidance on getting their own app onto a device:
references/harmonyos.mdcoveredreinstall-appbut not building or signing a HAP.Adds a short "Building and signing a HAP" section:
hvigorw.js(no IDE).OpenHarmony.p12).verify-appdoesn't catch a bundle-name mismatch either.No docs-site update: this is app tooling, not Argent behaviour.
Verification
Ran both
bashblocks verbatim, each in a fresh shell (env -i), against a hello-world ArkTS project:BUILD SUCCESSFUL,sign-profile/sign-appok,verify-app success.Mate 60 (BRA-AL00, HarmonyOS 6.0.0), raw
hdc install:9568320 error: no signature fileaa dump -lshows itFOREGROUND9568329 verify signature failed(hostverify-app: success)device-ids/ expiredvalidity-signCode 09568393 verify code signature failedEmulator (
argent_phone, HarmonyOS 6.1.1): unsigned, wrong-UDID, padding-tampered and PKCS7-corrupted HAPs allinstall bundle successfully.DevEco menu paths, labels and the
-signed.hapname checked against DevEco Studio 6.1.1's bundled resources and hvigor, and the Huawei steps against Huawei's signing docs. Not run: the Huawei ID routes (no account used).prettier --checkclean;skills-log-file-guidance.test.ts(reads every skill.md) andskills-frontmatter.test.tspass.