CPKs, CPBs, and CPIs management in Corda 5

[JB Beni]

Hello, I am new to the Java/Kotlin world and have just started working with Corda 5. I am trying to understand how CPKs, CPBs, and CPIs are managed, but I’m having some difficulty. I have been looking at package documentation and how Graddle tasks work on the CSDE. The following questions arise.

• CPKs generation: On tutorials, when CPBs need to be generated, “jar” task is being executed, followed by the “cpb” task (./gradlew cpb). As I understand cpb task generates CPKs from Jars, but, how can I manually generate these CPKs?
• CPIs generation: On CSDE example templates, I have seen that when “graddle cpb” is executed, a “cpb” for the “contracts” submodule and another one for “workflows” submodule are generated. However, the “3-buildCPIs” script only uses the CPB from “workflows” submodule. So, what is the other CPB for?
• Package signing: As I understand from the documentation, packages are always signed with one of the generated keys. Is it necessary to always use the same key? On the CSDE, the “3-buildCPIs” task signs with the key stored in the “workspace” directory. However, what key is using “cpb” task (./gradlew cpb) to sign? can i add a path to my keys?
• Multiple CPBs: Is it possible to pass multiple CPBs in CPI generation commands?

I hope these are not too obvious questions. I find the CSDE very useful, but I would like to understand how to generate/organize my CPKs, CPBs, and CPIs and what strategies I should follow to correctly manage these files in a production environment, taking advantage of the decoupling offered by Corda 5

Any help or additional information you can provide would be greatly appreciated.

I also wanted to take this opportunity to congratulate Corda team to the work done in Corda 5. The proposed architecture seems to be very promising.

Thank you!

Topic

[Divya Taori]

Hi , Thanks for your question.

• The order for packaging is CPK -> CPB -> CPI. You can include multiple CPKs in a CPB.
  ./gradlew jar -> builds the CPK
  ./gradlew cpb -> builds the CPB
  You can find more details here and here
• If you take the CPB created by the workflows module, you should see something from the contracts module inside it. So, while deploying your cordapp you only need the cpb created under workflows module.
• the Corda-cli could be used for this. You can use the tag “–key”.
•  You could pass multiple CPKs in a CPB. you cannot add multiple CPBs to a CPI.

  In a production environment, once you have the CPI generated you would use the Corda-cli for mgm setup, vnode setup, cordapp deployement.

[JB Beni]

Thanks for the answers! I hace two more questions:

• On the CSDE, can i sign cpk/cpbs generation modifying cordapp DSL(adding signing option)? Should this signing key be the same as CPI signing key?

signing {
enabled = (true | false)</p>
// These options presumably mirror Ant's signJar task options.
options {
 alias = '??'
 storePassword = '??'
 keyStore = file('/path/to/keystore')
 storeType= ('PKCS12' | 'JKS')
 keyPassword = '$storePassword'
 signatureFileName = '$alias'
 verbose = (true | false)
 strict = (true | false)
 internalSF = (true | false)
 sectionsOnly = (true | false)
 lazy = (true | false)
 maxMemory = '??'
 preserveLastModified = (true | false)
 tsaUrl = '??'
 tsaCert = '??'
 tsaProxyHost = '??'
 tsaProxyPort = '??'
 executable = file('/path/to/alternate/jarsigner')
 force = (true | false)
 signatureAlgorithm = '??'
 digestAlgorithm = '??'
 tsaDigestAlgorithm = '??'
}
}

sealing = (true | false)

hashAlgorithm = 'SHA-256'
}

• Is Corda CPK Gradle Pluging documentation going to be updated in the future(corda-gradle-plugins/blob/master/cordapp-cpk2/README.md)? It would be great to add more usage examples

[Author]

Replies