rk device package

The rk package command moved to rk device package. The bare rk package command returns an error that points to rk device package. You must update any scripts that used rk package … to use rk device package … instead.

The rk device package command manages app package operations on a Roku device. You can use it to sign, rekey, delete, convert, and list packages.

Synopsis

The following syntax shows how to run the command:

rk device package <subcommand> [options]

Subcommands

The rk device package command has five subcommands: sign, rekey, delete, squashfs, and ls.

Sign

The sign subcommand signs the currently installed dev channel package on the target device and downloads the generated .pkg file:

rk device package sign [--device <id|ip|name>] [--host <ip|hostname>] [--password <pwd>] [--signing-password <pwd>] [--out <dir>] [--out-file <basename>] [--config <path>] [--json]

The command runs the following steps:

1. Sends POST /plugin_package to the device web endpoint.
2. Reads the remote package path from the signing response (pkgPath or the package link).
3. Sends GET /pkgs/<name>.pkg.
4. Saves the package to the local filesystem.

The output path behaves as follows:

• The default is ./app.pkg (project root).
• The --out <dir> flag overrides the output directory.
• The --out-file <basename> flag overrides the base filename (the command appends the .pkg extension automatically).
• If you omit --out, the command uses package.outDir from roku-config.ts when available.

In JSON mode, the command prints the following output:

{
    "success": true,
    "pkgPath": "/absolute/path/to/app.pkg"
}

The command reports an error in the following common cases:

• A dev app is not installed on the device.
• The device does not have a signing key configured.

Signing with the MCP package tool

When rk runs in server mode, the CLI and MCP package commands use the same /api/package route. In server mode, AI assistants can call the MCP package tool to sign a package.

To sign a package, use action: "sign" and provide the following required fields:

• root (absolute path to app root)
• signingPassword

You can also provide the following optional fields:

• device
• host
• password
• outDir
• outFile
• config (path to a config variant file used to resolve package.outDir fallback)

Both request styles are valid:

• Natural language: Sign package for /home/user/projects/my-app with password 1234
• JSON arguments:

{
    "action": "sign",
    "root": "/home/user/projects/my-app",
    "signingPassword": "1234",
    "device": "Work",
    "host": "192.168.0.107",
    "password": "1994",
    "outDir": "./release",
    "outFile": "my-app"
}

If you omit outDir, the CLI and MCP flows fall back to package.outDir from the resolved config file.

Rekey

The rekey subcommand rekeys a device with a signed .pkg key package and, when requested, verifies the resulting developer ID:

rk device package rekey <pkg-path> [--device <id|ip|name>] [--host <ip|hostname>] [--password <pwd>] [--signing-password <pwd>] [--dev-id <expected-id>] [--config <path>] [--json]

The <pkg-path> argument is required for the CLI rk device package rekey command. If you omit <pkg-path>, the command uses package.signingKeyPackage from roku-config.ts when available.

The command runs the following steps:

1. Sends POST /plugin_inspect with mysubmit=Rekey, the signing password, and the provided key package.
2. Parses rekey success or failure from the device response body.
3. Queries GET /query/device-info to read the resulting keyed-developer-id.
4. Asserts that the developer ID matches --dev-id (or package.devId in roku-config.ts) when you provide one.

When you omit --dev-id, the command uses package.devId as the expected developer ID.

In JSON mode, the command prints the following output:

{
    "success": true,
    "devId": "a1b2c3..."
}

The command reports an error in the following common cases:

• The rekey package path does not exist.
• The signing password is not valid.
• The device does not have a signing key configured.
• The resulting developer ID does not match the expected --dev-id.

Rekeying with the MCP package tool

When rk runs in server mode, AI assistants can call the MCP package tool to rekey a device.

To rekey a device, use action: "rekey" and provide the following required fields:

• pkgPath (path to signed key package)
• signingPassword

You can also provide the following optional fields:

• device
• host
• password
• devId
• config (path to a config variant file used to resolve package.devId fallback)

If you omit pkgPath, the CLI and MCP flows fall back to package.signingKeyPackage from the resolved config file.

Both request styles are valid:

• Natural language: Rekey package /home/user/keys/my-signing-key.pkg using password 1234
• JSON arguments:

{
    "action": "rekey",
    "pkgPath": "/home/user/keys/my-signing-key.pkg",
    "signingPassword": "1234",
    "device": "Work",
    "host": "192.168.0.107",
    "password": "1994",
    "devId": "a1b2c3",
    "config": "roku-config-perf.ts"
}

For config variants, use --config with rekey to select which config provides the package.devId fallback:

rk device package rekey /tmp/key.pkg --signing-password xxx --config roku-config-perf.ts

delete

The delete subcommand deletes the currently installed dev app:

rk device package delete [--device <id|ip|name>] [--host <ip|hostname>] [--password <pwd>] [--json]

The command sends POST /plugin_install with mysubmit=Delete.

In JSON mode, the command prints the following output:

{
    "success": true
}

Squashfs

The squashfs subcommand converts the currently installed dev channel package to squashfs:

rk device package squashfs [--device <id|ip|name>] [--host <ip|hostname>] [--password <pwd>] [--json]

The command sends POST /plugin_install with mysubmit=Convert to squashfs.

In JSON mode, the command prints the following output:

{
    "success": true
}

ls

The ls subcommand lists installed app and DCL package entries from the device web plugin endpoint:

rk device package ls [--device <id|ip|name>] [--host <ip|hostname>] [--password <pwd>] [--json]

The command sends GET /plugin_install?dcl_enabled=1.

By default, the command prints a table with the columns type, archiveFileName, fileType, and size. The table includes both channels and DCL entries.

In JSON mode, the command returns only an array of package objects. Each object includes exactly these fields: type, archiveFileName, fileType, and size.

[
    {
        "type": "channel",
        "archiveFileName": "dev.zip",
        "fileType": "zip",
        "size": "124 KB"
    }
]

Resolving the signing password

The rk device package sign and rk device package rekey commands resolve the signing password in the following order:

1. --signing-password
2. ROKU_SIGNING_PASSWORD environment variable
3. Interactive masked prompt (TTY only)

The command never stores the password in roku-config.ts.

roku-config.ts defaults

You can add an optional package block:

export default {
    app: {
        entryPoint: "src/index.ts"
    },
    package: {
        devId: "a1b2c3...",
        outDir: "./release",
        signingKeyPackage: "/path/to/key.pkg"
    }
};

The package block supports the following settings:

• The package.outDir setting is the default output directory for sign.
• The package.signingKeyPackage setting is the default package path for rekey.
• The package.devId setting is the expected developer ID fallback for rekey.

Notes

The following notes apply to all subcommands:

• Package and DCL operations use Roku developer web server endpoints on port 80.
• Authentication uses existing device-store credentials (HTTP Digest).
• You should not commit signing passwords in tracked files.

Related documentation

• rk dcl: Describes how to list and delete installed DCLs on a device.
• rk server: Describes server mode in full, including MCP endpoint details and security notes.
• AI integration via MCP: Describes the transports and editor configuration for MCP.