Skip to main content

Authorize fins:// link installation

Starting with HERE Core RVM 20, you can request that your application be cryptographically authorized to install via fins:// links on desktops where the desktop owner has opted into Trusted App Config (TAC) enforcement for protocol-link installation.

This feature works by adding a trustedAppConfigs object to your application manifest. You provide your manifest URL(s) to HERE, and HERE provides you with a signed trustedAppConfigs definition that grants the enableFinsProtocolInstallation feature for those URLs. For a more detailed explanation of TACs, see Trusted application configurations.

When this feature is needed​

The desktop owner controls fins:// link installation with two Desktop Owner Settings (see General settings):

  • desktopSettings.enableFinsProtocolInstallation (default true) — a kill switch that blocks all new installs via fin:// or fins:// links when set to false. Already-installed apps continue to launch normally.

  • desktopSettings.requireTacForFinsProtocolInstallation (default false) — when set to true, new fins:// installs require an enableFinsProtocolInstallation TAC grant on the manifest. fin:// installs are blocked entirely while this setting is on, because a fin:// URL cannot be cryptographically verified over plain HTTP.

If a desktop owner sets requireTacForFinsProtocolInstallation to true and your application does not carry an enableFinsProtocolInstallation TAC grant, end users on that desktop see an "Unable to open app" dialog when they click a fins:// link that would install your app.

Request this feature ahead of time so that your fins:// install links keep working when customers enable TAC enforcement.

How it works​

  1. You provide the following information to HERE:

    • A list of manifest URLs (or match patterns) that identify the applications you want authorized for fins:// installation.

    • A request that those URLs be granted the enableFinsProtocolInstallation TAC feature.

  2. HERE provides you with a trustedAppConfigs property definition, which contains an embedded digital certificate, includes platform-specific signatures, and grants the requested feature for the requested URLs.

  3. You include this trustedAppConfigs verbatim in your application manifest.

  4. When an end user clicks a fins:// link that targets your manifest URL on a desktop with requireTacForFinsProtocolInstallation set to true, the HERE Core RVM does the following:

    • Verifies the trustedAppConfigs signature.

    • Checks that the manifest URL matches the URLs/match patterns granted in your trustedAppConfigs.

    • Confirms that the granted features include enableFinsProtocolInstallation.

    • If all three checks pass, allows the new installation to proceed.

Already-installed apps re-launch successfully regardless of this gate — only new installations are subject to the check.

If you authorize multiple applications, the configuration information for all of them is encoded in a single value property. Use the same trustedAppConfigs definition in each of the application manifests.

How to do it​

The trustedAppConfigs definition as provided by HERE has the structure shown in the following example. You add this object as a top-level property of the application manifest:

"trustedAppConfigs": {
  "value": "BASE64-ENCODING-OF-CONFIGURATION",
  "signature": {
    "win": "BASE64-ENCODED-SIGNATURE-FOR-WINDOWS",
    "mac": "BASE64-ENCODED-SIGNATURE-FOR-MACOS"
  }
}

The encoded value declares the enableFinsProtocolInstallation feature for the manifest URLs you requested. If you already use a trustedAppConfigs definition for other TAC features (such as licensed media codecs or extension server URLs), HERE issues a single, combined definition that covers all your requested features.

Limitations​

  • Internet access is required to validate certificates; there is no option for fully offline mode.

  • fin:// (HTTP) installations cannot be TAC-authorized, because the manifest cannot be cryptographically verified over a plain HTTP connection. Migrate to fins:// over HTTPS for any application you want to remain installable when a desktop owner enables requireTacForFinsProtocolInstallation.

Table of Contents