Signing Packages Using Corda CLI

You can sign the CPK, CPB, and CPI packages using Corda CLI A command line tool that supports various Corda-related tasks, including Corda Package Installer (CPI) creation and Corda cluster management. . Corda CLI is particularly useful for CorDapp Corda Distributed Application. A Java (or any JVM targeting language) application built using the Corda build toolchain and CorDapp API to solve some problem that is best solved in a decentralized manner. developers or CorDapp distributors who need to sign their files after the QA process, when they are ready to release. The following steps will guide you through the process of removing existing (development) signatures and applying new ones.

1. Remove the existing signatures and apply new ones:

./corda-cli.sh package sign \
mycpb.cpb \
--file signed.cpb \
--keystore signingkeys.pfx \
--storepass "keystore password" \
--key "signing key 1"

2. Build a CPI (version 2). You can supply the group policy file into the CPI by either passing it to the CLI package command parameters as a file or by piping it to the CLI package command as shown below:

   • Use a command:

   ./corda-cli.sh package create-cpi \
   --cpb mycpb.cpb \
   --group-policy TestGroupPolicy.json \
   --cpi-name "cpi name" \
   --cpi-version "1.0.0.0-SNAPSHOT" \
   --file output.cpi \
   --keystore signingkeys.pfx \
   --storepass "keystore password" \
   --key "signing key 1"
   

   • Or pipe the group policy:

   ./corda-cli.sh mgm groupPolicy | ./corda-cli.sh package create-cpi \
   --cpb mycpb.cpb \
   --group-policy - \
   --cpi-name "cpi name" \
   --cpi-version "1.0.0.0-SNAPSHOT" \
   --file output.cpi \
   --keystore signingkeys.pfx \
   --storepass "keystore password" \
   --key "signing key 1"
   

3. Check signatures using jarsigner:

jarsigner -keystore signingkeys.pfx -storepass "keystore password" -verbose -certs  -verify output.cpi