What It Does

Signed packaging in JCB appends a cryptographic signature to each ZIP package created during compilation. This guarantees that the package:

• Was built from an authorized source (your JCB blueprint)
• Has not been tampered with or altered post-build
• Can be verified on the receiving end (via public key, checksum, or remote validation)

How It Works

Signature Generation

During component compilation, JCB:

• Creates a SHA-256 checksum of the final ZIP
• Appends a .sig or .txt file with the signature
• Optionally includes signer metadata (author, UUID, build timestamp)

Signature File Output

Each signed package may include:

• package-name.zip — the actual extension package
• package-name.zip.sig — the accompanying digital signature
• signature.json — optional metadata file with signer details and hashes

Public Key Integration

You can optionally configure a signing certificate or include a public key that others can use to verify packages from your distribution pipeline.

Integration Options

• Enable “Signed Package” in the JCB compiler settings
• Upload private signing credentials or set environment-based key pairs
• Customize file output and signature location per build type (e.g., nightly, stable)
• Display trust indicators on your update server or extension backend

Use Cases

• 🔒 Secure Update Distribution
  Ensure that your users only install trusted, untampered packages — ideal for enterprise or multi-developer environments.
• 📦 Commercial or Licensed Extensions
  Use signature validation as part of license checking or premium package protection.
• 🧾 Audit & Compliance
  Maintain a verifiable history of component builds, ideal for ISO/ITIL compliance or security audits.
• 🌐 Joomla Update Server Trust
  Pair signed ZIPs with Joomla’s built-in update server mechanism to provide end-to-end verified extension updates.

Benefits

• ✅ Prevents tampering or man-in-the-middle delivery
• ✅ Adds trust and professionalism to your releases
• ✅ Automates signature generation during compile
• ✅ Integrates with Git, CI/CD, and update server logic

Best Practices

• Use long-lived signing keys and rotate regularly
• Keep private keys securely stored; never include them in your repository
• Validate signature presence on your update server side
• Publish signature validation documentation for your users

Conclusion

Signed packaging gives your Joomla components an extra layer of trust, especially when distributing updates over the web or offering commercial extensions. Whether for client reassurance or security best practices, this feature future-proofs your distribution workflow with minimal setup.

Summary

JCB allows you to digitally sign your compiled component ZIP files, ensuring authenticity, integrity, and trust during distribution. This is especially useful for secure deployment, commercial extensions, or compliance with trusted update channels.