diff --git a/core/common/ccpackage/ccpackage.go b/core/common/ccpackage/ccpackage.go
new file mode 100644
index 00000000000..4b3702e5698
--- /dev/null
+++ b/core/common/ccpackage/ccpackage.go
@@ -0,0 +1,187 @@
+/*
+Copyright IBM Corp. 2016-2017 All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+		 http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ccpackage
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+
+	"github.com/golang/protobuf/proto"
+	"github.com/hyperledger/fabric/msp"
+	"github.com/hyperledger/fabric/protos/common"
+	"github.com/hyperledger/fabric/protos/peer"
+	"github.com/hyperledger/fabric/protos/utils"
+)
+
+// This file provides functions for helping with the chaincode install
+// package workflow. In particular
+//     OwnerCreateSignedCCDepSpec - each owner creates signs the package using the same deploy
+//     CreateSignedCCDepSpecForInstall - an admin or owner creates the package to be installed
+//                                       using the packages from OwnerCreateSignedCCDepSpec
+
+// ValidateCip validate the endorsed package against the base package
+func ValidateCip(baseCip, otherCip *peer.SignedChaincodeDeploymentSpec) error {
+	if baseCip == nil || otherCip == nil {
+		panic("do not call with nil parameters")
+	}
+
+	if (baseCip.OwnerEndorsements == nil && otherCip.OwnerEndorsements != nil) || (baseCip.OwnerEndorsements != nil && otherCip.OwnerEndorsements == nil) {
+		return fmt.Errorf("endorsements should either be both nil or not nil")
+	}
+
+	bN := len(baseCip.OwnerEndorsements)
+	oN := len(otherCip.OwnerEndorsements)
+	if bN > 1 || oN > 1 {
+		return fmt.Errorf("expect utmost 1 endorsement from a owner")
+	}
+
+	if bN != oN {
+		return fmt.Errorf("Rule-all packages should be endorsed or none should be endorsed failed for (%d, %d)", bN, oN)
+	}
+
+	if !bytes.Equal(baseCip.ChaincodeDeploymentSpec, otherCip.ChaincodeDeploymentSpec) {
+		return fmt.Errorf("Rule-all deployment specs should match(%d, %d)", len(baseCip.ChaincodeDeploymentSpec), len(otherCip.ChaincodeDeploymentSpec))
+	}
+
+	if !bytes.Equal(baseCip.InstantiationPolicy, otherCip.InstantiationPolicy) {
+		return fmt.Errorf("Rule-all instantiation policies should match(%d, %d)", len(baseCip.InstantiationPolicy), len(otherCip.InstantiationPolicy))
+	}
+
+	return nil
+}
+
+func createSignedCCDepSpec(cdsbytes []byte, instpolicybytes []byte, endorsements []*peer.Endorsement) (*common.Envelope, error) {
+	if cdsbytes == nil {
+		return nil, fmt.Errorf("nil chaincode deployment spec")
+	}
+
+	if instpolicybytes == nil {
+		return nil, fmt.Errorf("nil instantiation policy")
+	}
+
+	// create SignedChaincodeDeploymentSpec...
+	cip := &peer.SignedChaincodeDeploymentSpec{ChaincodeDeploymentSpec: cdsbytes, InstantiationPolicy: instpolicybytes, OwnerEndorsements: endorsements}
+
+	//...and marshal it
+	cipbytes := utils.MarshalOrPanic(cip)
+
+	//use defaults (this is definitely ok for install package)
+	msgVersion := int32(0)
+	epoch := uint64(0)
+	chdr := utils.MakeChannelHeader(common.HeaderType_CHAINCODE_PACKAGE, msgVersion, "", epoch)
+
+	// create the payload
+	payl := &common.Payload{Header: &common.Header{ChannelHeader: utils.MarshalOrPanic(chdr)}, Data: cipbytes}
+	paylBytes, err := utils.GetBytesPayload(payl)
+	if err != nil {
+		return nil, err
+	}
+
+	// here's the unsigned  envelope. The install package is endorsed if signingEntity != nil
+	return &common.Envelope{Payload: paylBytes}, nil
+}
+
+// CreateSignedCCDepSpecForInstall creates the final package from a set of packages signed by
+// owners.  This is similar to how the SDK assembles a TX from various proposal
+// responses from the signatures.
+func CreateSignedCCDepSpecForInstall(pack []*common.Envelope) (*common.Envelope, error) {
+	if len(pack) == 0 {
+		return nil, errors.New("no packages provided to collate")
+	}
+
+	//rules...
+	//   all packages must be endorsed or all packages should not be endorsed
+	//   the chaincode deployment spec should be same
+	var baseCip *peer.SignedChaincodeDeploymentSpec
+	var err error
+	var endorsementExists bool
+	var endorsements []*peer.Endorsement
+	for n, r := range pack {
+		p := &common.Payload{}
+		if err = proto.Unmarshal(r.Payload, p); err != nil {
+			return nil, err
+		}
+
+		cip := &peer.SignedChaincodeDeploymentSpec{}
+		if err = proto.Unmarshal(p.Data, cip); err != nil {
+			return nil, err
+		}
+
+		//if its the first element, check if it has endorsement so we can
+		//enforce endorsement rules
+		if n == 0 {
+			baseCip = cip
+			//if it has endorsement, all other owners should have signed too
+			if len(cip.OwnerEndorsements) > 0 {
+				endorsements = make([]*peer.Endorsement, len(pack))
+			}
+
+		} else if err = ValidateCip(baseCip, cip); err != nil {
+			return nil, err
+		}
+
+		if endorsementExists {
+			endorsements[n] = cip.OwnerEndorsements[0]
+		}
+	}
+
+	return createSignedCCDepSpec(baseCip.ChaincodeDeploymentSpec, baseCip.InstantiationPolicy, endorsements)
+}
+
+// OwnerCreateSignedCCDepSpec creates a package from a ChaincodeDeploymentSpec and
+// optionally endorses it
+func OwnerCreateSignedCCDepSpec(cds *peer.ChaincodeDeploymentSpec, instPolicy *common.SignaturePolicyEnvelope, owner msp.SigningIdentity) (*common.Envelope, error) {
+	if cds == nil {
+		return nil, fmt.Errorf("invalid chaincode deployment spec")
+	}
+
+	if instPolicy == nil {
+		return nil, fmt.Errorf("must provide an instantiation policy")
+	}
+
+	cdsbytes := utils.MarshalOrPanic(cds)
+
+	instpolicybytes := utils.MarshalOrPanic(instPolicy)
+
+	var endorsements []*peer.Endorsement
+	//it is not mandatory (at this utils level) to have a signature
+	//this is especially convenient during dev/test
+	//it may be necessary to enforce it via a policy at a higher level
+	if owner != nil {
+		// serialize the signing identity
+		endorser, err := owner.Serialize()
+		if err != nil {
+			return nil, fmt.Errorf("Could not serialize the signing identity for %s, err %s", owner.GetIdentifier(), err)
+		}
+
+		// sign the concatenation of cds, instpolicy and the serialized endorser identity with this endorser's key
+		signature, err := owner.Sign(append(cdsbytes, append(instpolicybytes, endorser...)...))
+		if err != nil {
+			return nil, fmt.Errorf("Could not sign the ccpackage, err %s", err)
+		}
+
+		// each owner starts off the endorsements with one element. All such endorsed
+		// packages will be collected in a final package by CreateSignedCCDepSpecForInstall
+		// when endorsements will have all the entries
+		endorsements = make([]*peer.Endorsement, 1)
+
+		endorsements[0] = &peer.Endorsement{Signature: signature, Endorser: endorser}
+	}
+
+	return createSignedCCDepSpec(cdsbytes, instpolicybytes, endorsements)
+}
diff --git a/core/common/ccpackage/ccpackage_test.go b/core/common/ccpackage/ccpackage_test.go
new file mode 100644
index 00000000000..1faa44d4196
--- /dev/null
+++ b/core/common/ccpackage/ccpackage_test.go
@@ -0,0 +1,231 @@
+/*
+Copyright IBM Corp. 2016 All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+		 http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ccpackage
+
+import (
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/golang/protobuf/proto"
+	"github.com/hyperledger/fabric/common/cauthdsl"
+	"github.com/hyperledger/fabric/msp"
+	mspmgmt "github.com/hyperledger/fabric/msp/mgmt"
+	"github.com/hyperledger/fabric/msp/mgmt/testtools"
+	"github.com/hyperledger/fabric/protos/common"
+	mspprotos "github.com/hyperledger/fabric/protos/msp"
+	"github.com/hyperledger/fabric/protos/peer"
+	"github.com/hyperledger/fabric/protos/utils"
+)
+
+func ownerCreateCCDepSpec(codepackage []byte, sigpolicy *common.SignaturePolicyEnvelope, owner msp.SigningIdentity) (*common.Envelope, error) {
+	cds := &peer.ChaincodeDeploymentSpec{CodePackage: codepackage}
+	return OwnerCreateSignedCCDepSpec(cds, sigpolicy, owner)
+}
+
+// create an instantiation policy with just the local msp admin
+func createInstantiationPolicy(mspid string, role mspprotos.MSPRole_MSPRoleType) *common.SignaturePolicyEnvelope {
+	principals := []*mspprotos.MSPPrincipal{&mspprotos.MSPPrincipal{
+		PrincipalClassification: mspprotos.MSPPrincipal_ROLE,
+		Principal:               utils.MarshalOrPanic(&mspprotos.MSPRole{Role: role, MspIdentifier: mspid})}}
+	sigspolicy := []*common.SignaturePolicy{cauthdsl.SignedBy(int32(0))}
+
+	// create the policy: it requires exactly 1 signature from any of the principals
+	p := &common.SignaturePolicyEnvelope{
+		Version:    0,
+		Policy:     cauthdsl.NOutOf(1, sigspolicy),
+		Identities: principals,
+	}
+
+	return p
+}
+
+func TestOwnerCreateSignedCCDepSpec(t *testing.T) {
+	mspid, _ := localmsp.GetIdentifier()
+	sigpolicy := createInstantiationPolicy(mspid, mspprotos.MSPRole_ADMIN)
+	env, err := ownerCreateCCDepSpec([]byte("codepackage"), sigpolicy, signer)
+	if err != nil || env == nil {
+		t.Fatalf("error owner creating package %s", err)
+		return
+	}
+}
+
+func TestMissingSigaturePolicy(t *testing.T) {
+	env, err := ownerCreateCCDepSpec([]byte("codepackage"), nil, signer)
+	if err == nil || env != nil {
+		t.Fatalf("expected error on missing signature policy")
+		return
+	}
+}
+
+func TestCreateSignedCCDepSpecForInstall(t *testing.T) {
+	mspid, _ := localmsp.GetIdentifier()
+	sigpolicy := createInstantiationPolicy(mspid, mspprotos.MSPRole_ADMIN)
+	env1, err := ownerCreateCCDepSpec([]byte("codepackage"), sigpolicy, nil)
+	if err != nil || env1 == nil {
+		t.Fatalf("error owner creating package %s", err)
+		return
+	}
+
+	env2, err := ownerCreateCCDepSpec([]byte("codepackage"), sigpolicy, nil)
+	if err != nil || env2 == nil {
+		t.Fatalf("error owner creating package %s", err)
+		return
+	}
+
+	pack := []*common.Envelope{env1, env2}
+	env, err := CreateSignedCCDepSpecForInstall(pack)
+	if err != nil || env == nil {
+		t.Fatalf("error creating install package %s", err)
+		return
+	}
+
+	p := &common.Payload{}
+	if err = proto.Unmarshal(env.Payload, p); err != nil {
+		t.Fatalf("fatal error unmarshal payload")
+		return
+	}
+
+	cip2 := &peer.SignedChaincodeDeploymentSpec{}
+	if err = proto.Unmarshal(p.Data, cip2); err != nil {
+		t.Fatalf("fatal error unmarshal cip")
+		return
+	}
+
+	p = &common.Payload{}
+	if err = proto.Unmarshal(env1.Payload, p); err != nil {
+		t.Fatalf("fatal error unmarshal payload")
+		return
+	}
+
+	cip1 := &peer.SignedChaincodeDeploymentSpec{}
+	if err = proto.Unmarshal(p.Data, cip1); err != nil {
+		t.Fatalf("fatal error unmarshal cip")
+		return
+	}
+
+	if err = ValidateCip(cip1, cip2); err != nil {
+		t.Fatalf("fatal error validating cip1 (%v) against cip2(%v)", cip1, cip2)
+		return
+	}
+}
+
+func TestMismatchedCodePackages(t *testing.T) {
+	mspid, _ := localmsp.GetIdentifier()
+	sigpolicy := createInstantiationPolicy(mspid, mspprotos.MSPRole_ADMIN)
+	env1, err := ownerCreateCCDepSpec([]byte("codepackage1"), sigpolicy, nil)
+	if err != nil || env1 == nil {
+		t.Fatalf("error owner creating package %s", err)
+		return
+	}
+
+	env2, err := ownerCreateCCDepSpec([]byte("codepackage2"), sigpolicy, nil)
+	if err != nil || env2 == nil {
+		t.Fatalf("error owner creating package %s", err)
+		return
+	}
+	pack := []*common.Envelope{env1, env2}
+	env, err := CreateSignedCCDepSpecForInstall(pack)
+	if err == nil || env != nil {
+		t.Fatalf("expected error creating install from mismatched code package but succeeded")
+		return
+	}
+}
+
+func TestMismatchedEndorsements(t *testing.T) {
+	mspid, _ := localmsp.GetIdentifier()
+	sigpolicy := createInstantiationPolicy(mspid, mspprotos.MSPRole_ADMIN)
+	env1, err := ownerCreateCCDepSpec([]byte("codepackage"), sigpolicy, signer)
+	if err != nil || env1 == nil {
+		t.Fatalf("error owner creating package %s", err)
+		return
+	}
+
+	env2, err := ownerCreateCCDepSpec([]byte("codepackage"), sigpolicy, nil)
+	if err != nil || env2 == nil {
+		t.Fatalf("error owner creating package %s", err)
+		return
+	}
+	pack := []*common.Envelope{env1, env2}
+	env, err := CreateSignedCCDepSpecForInstall(pack)
+	if err == nil || env != nil {
+		t.Fatalf("expected error creating install from mismatched endorsed package but succeeded")
+		return
+	}
+}
+
+func TestMismatchedSigPolicy(t *testing.T) {
+	sigpolicy1 := createInstantiationPolicy("mspid1", mspprotos.MSPRole_ADMIN)
+	env1, err := ownerCreateCCDepSpec([]byte("codepackage"), sigpolicy1, signer)
+	if err != nil || env1 == nil {
+		t.Fatalf("error owner creating package %s", err)
+		return
+	}
+
+	sigpolicy2 := createInstantiationPolicy("mspid2", mspprotos.MSPRole_ADMIN)
+	env2, err := ownerCreateCCDepSpec([]byte("codepackage"), sigpolicy2, signer)
+	if err != nil || env2 == nil {
+		t.Fatalf("error owner creating package %s", err)
+		return
+	}
+	pack := []*common.Envelope{env1, env2}
+	env, err := CreateSignedCCDepSpecForInstall(pack)
+	if err == nil || env != nil {
+		t.Fatalf("expected error creating install from mismatched signature policies but succeeded")
+		return
+	}
+}
+
+var localmsp msp.MSP
+var signer msp.SigningIdentity
+var signerSerialized []byte
+
+func TestMain(m *testing.M) {
+	// setup the MSP manager so that we can sign/verify
+	mspMgrConfigFile := "../../msp/sampleconfig/"
+	err := msptesttools.LoadMSPSetupForTesting(mspMgrConfigFile)
+	if err != nil {
+		//be docker friendly
+		mspMgrConfigFile = "/etc/hyperledger/fabric/msp/sampleconfig"
+		if err = msptesttools.LoadMSPSetupForTesting(mspMgrConfigFile); err != nil {
+			os.Exit(-1)
+			fmt.Printf("Could not initialize msp")
+			return
+		}
+	}
+	localmsp = mspmgmt.GetLocalMSP()
+	if localmsp == nil {
+		os.Exit(-1)
+		fmt.Printf("Could not get msp")
+		return
+	}
+	signer, err = localmsp.GetDefaultSigningIdentity()
+	if err != nil {
+		os.Exit(-1)
+		fmt.Printf("Could not get signer")
+		return
+	}
+
+	signerSerialized, err = signer.Serialize()
+	if err != nil {
+		os.Exit(-1)
+		fmt.Printf("Could not serialize identity")
+		return
+	}
+
+	os.Exit(m.Run())
+}
diff --git a/protos/common/common.pb.go b/protos/common/common.pb.go
index 2405a651bd5..30b22e70d09 100644
--- a/protos/common/common.pb.go
+++ b/protos/common/common.pb.go
@@ -112,6 +112,7 @@ const (
 	HeaderType_ENDORSER_TRANSACTION HeaderType = 3
 	HeaderType_ORDERER_TRANSACTION  HeaderType = 4
 	HeaderType_DELIVER_SEEK_INFO    HeaderType = 5
+	HeaderType_CHAINCODE_PACKAGE    HeaderType = 6
 )
 
 var HeaderType_name = map[int32]string{
@@ -121,6 +122,7 @@ var HeaderType_name = map[int32]string{
 	3: "ENDORSER_TRANSACTION",
 	4: "ORDERER_TRANSACTION",
 	5: "DELIVER_SEEK_INFO",
+	6: "CHAINCODE_PACKAGE",
 }
 var HeaderType_value = map[string]int32{
 	"MESSAGE":              0,
@@ -129,6 +131,7 @@ var HeaderType_value = map[string]int32{
 	"ENDORSER_TRANSACTION": 3,
 	"ORDERER_TRANSACTION":  4,
 	"DELIVER_SEEK_INFO":    5,
+	"CHAINCODE_PACKAGE":    6,
 }
 
 func (x HeaderType) String() string {
@@ -387,61 +390,62 @@ func init() {
 func init() { proto.RegisterFile("common/common.proto", fileDescriptor0) }
 
 var fileDescriptor0 = []byte{
-	// 884 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x84, 0x55, 0xdd, 0x6e, 0xe3, 0x44,
-	0x14, 0xae, 0xeb, 0xfc, 0x34, 0x27, 0x4d, 0x3b, 0x9d, 0x6c, 0x59, 0x53, 0x58, 0x6d, 0x64, 0x58,
-	0x54, 0x5a, 0x29, 0x11, 0xe5, 0x06, 0x2e, 0x9d, 0x64, 0xd2, 0xb5, 0x36, 0x6b, 0x2f, 0x33, 0xce,
-	0x22, 0x76, 0x91, 0xac, 0x49, 0x32, 0x4d, 0x22, 0x12, 0x3b, 0xb2, 0x9d, 0xaa, 0xbd, 0xe5, 0x01,
-	0x10, 0x12, 0xdc, 0xf2, 0x02, 0x3c, 0x09, 0x6f, 0xc1, 0x4b, 0x20, 0x71, 0x8b, 0xec, 0x19, 0x7b,
-	0x93, 0xb2, 0xd2, 0x5e, 0x65, 0xbe, 0x73, 0x3e, 0x9f, 0xf3, 0xcd, 0x77, 0x4e, 0x6c, 0x68, 0x4e,
-	0xc2, 0xd5, 0x2a, 0x0c, 0x3a, 0xf2, 0xa7, 0xbd, 0x8e, 0xc2, 0x24, 0xc4, 0x15, 0x89, 0xce, 0x9e,
-	0xce, 0xc2, 0x70, 0xb6, 0x14, 0x9d, 0x2c, 0x3a, 0xde, 0xdc, 0x74, 0x92, 0xc5, 0x4a, 0xc4, 0x09,
-	0x5f, 0xad, 0x25, 0xd1, 0x34, 0x01, 0x86, 0x3c, 0x4e, 0x7a, 0x61, 0x70, 0xb3, 0x98, 0xe1, 0x47,
-	0x50, 0x5e, 0x04, 0x53, 0x71, 0x67, 0x68, 0x2d, 0xed, 0xbc, 0x44, 0x25, 0x30, 0xdf, 0xc2, 0xc1,
-	0x4b, 0x91, 0xf0, 0x29, 0x4f, 0x78, 0xca, 0xb8, 0xe5, 0xcb, 0x8d, 0xc8, 0x18, 0x87, 0x54, 0x02,
-	0xfc, 0x2d, 0x40, 0xbc, 0x98, 0x05, 0x3c, 0xd9, 0x44, 0x22, 0x36, 0xf6, 0x5b, 0xfa, 0x79, 0xfd,
-	0xea, 0xe3, 0xb6, 0x52, 0x94, 0x3f, 0xcb, 0x72, 0x06, 0xdd, 0x22, 0x9b, 0x3f, 0xc2, 0xc9, 0xff,
-	0x08, 0xf8, 0x4b, 0x40, 0x05, 0xc5, 0x9f, 0x0b, 0x3e, 0x15, 0x91, 0x6a, 0x78, 0x5c, 0xc4, 0x9f,
-	0x67, 0x61, 0xfc, 0x29, 0xd4, 0x8a, 0x90, 0xb1, 0x9f, 0x71, 0xde, 0x05, 0xcc, 0x37, 0x50, 0x51,
-	0xbc, 0x67, 0x70, 0x34, 0x99, 0xf3, 0x20, 0x10, 0xcb, 0xdd, 0x82, 0x0d, 0x15, 0x55, 0xb4, 0xf7,
-	0x75, 0xde, 0x7f, 0x6f, 0x67, 0xf3, 0x6f, 0x0d, 0x1a, 0xbd, 0x9d, 0x87, 0x31, 0x94, 0x92, 0xfb,
-	0xb5, 0xf4, 0xa6, 0x4c, 0xb3, 0x33, 0x36, 0xa0, 0x7a, 0x2b, 0xa2, 0x78, 0x11, 0x06, 0x59, 0x9d,
-	0x32, 0xcd, 0x21, 0xfe, 0x06, 0x6a, 0xc5, 0x34, 0x0c, 0xbd, 0xa5, 0x9d, 0xd7, 0xaf, 0xce, 0xda,
-	0x72, 0x5e, 0xed, 0x7c, 0x5e, 0x6d, 0x2f, 0x67, 0xd0, 0x77, 0x64, 0xfc, 0x04, 0x20, 0xbf, 0xcb,
-	0x62, 0x6a, 0x94, 0x5a, 0xda, 0x79, 0x8d, 0xd6, 0x54, 0xc4, 0x9e, 0xe2, 0x26, 0x94, 0x93, 0xbb,
-	0x34, 0x53, 0xce, 0x32, 0xa5, 0xe4, 0xce, 0x9e, 0xa6, 0x83, 0x13, 0xeb, 0x70, 0x32, 0x37, 0x2a,
-	0x72, 0xb4, 0x19, 0x48, 0xdd, 0x13, 0x77, 0x89, 0x08, 0x32, 0x7d, 0x55, 0xe9, 0x5e, 0x11, 0x30,
-	0x2d, 0x38, 0x66, 0x0f, 0xec, 0x36, 0xa0, 0x3a, 0x89, 0x04, 0x4f, 0xc2, 0xdc, 0xbf, 0x1c, 0xa6,
-	0x0d, 0x82, 0x30, 0x98, 0xe4, 0x43, 0x90, 0xc0, 0x24, 0x50, 0x7d, 0xc5, 0xef, 0x97, 0x21, 0x9f,
-	0xe2, 0x2f, 0xa0, 0xb2, 0xe5, 0x7c, 0xfd, 0xea, 0x28, 0x5f, 0x10, 0x59, 0x9a, 0xaa, 0x6c, 0xea,
-	0x62, 0xba, 0x0d, 0xaa, 0x4e, 0x76, 0x36, 0xbb, 0x70, 0x40, 0x82, 0x5b, 0xb1, 0x0c, 0xa5, 0xa3,
-	0x6b, 0x59, 0x32, 0x97, 0xa0, 0xe0, 0x07, 0x76, 0xe1, 0x17, 0x0d, 0xca, 0xdd, 0x65, 0x38, 0xf9,
-	0x09, 0x5f, 0x3e, 0x50, 0xd2, 0xcc, 0x95, 0x64, 0xe9, 0x07, 0x72, 0x9e, 0x6d, 0xc9, 0xa9, 0x5f,
-	0x9d, 0xec, 0x50, 0xfb, 0x3c, 0xe1, 0x52, 0x21, 0xfe, 0x0a, 0x0e, 0x56, 0x6a, 0x8f, 0xd5, 0x30,
-	0x4f, 0x77, 0xa8, 0xf9, 0x92, 0xd3, 0x82, 0x66, 0xce, 0xa0, 0xbe, 0xd5, 0x10, 0x7f, 0x04, 0x95,
-	0x60, 0xb3, 0x1a, 0x2b, 0x55, 0x25, 0xaa, 0x10, 0xfe, 0x0c, 0x1a, 0xeb, 0x48, 0xdc, 0x2e, 0xc2,
-	0x4d, 0xec, 0xcf, 0x79, 0x3c, 0x57, 0x37, 0x3b, 0xcc, 0x83, 0xcf, 0x79, 0x3c, 0xc7, 0x9f, 0x40,
-	0x2d, 0xad, 0x29, 0x09, 0x7a, 0x46, 0x38, 0x48, 0x03, 0x69, 0xd2, 0x7c, 0x0a, 0xb5, 0x42, 0x6e,
-	0x61, 0xaf, 0xd6, 0xd2, 0x0b, 0x7b, 0x2f, 0xa1, 0xb1, 0x23, 0x12, 0x9f, 0x6d, 0xdd, 0x46, 0x12,
-	0x0b, 0x7c, 0xf1, 0xa7, 0x06, 0x15, 0x96, 0xf0, 0x64, 0x13, 0xe3, 0x3a, 0x54, 0x47, 0xce, 0x0b,
-	0xc7, 0xfd, 0xde, 0x41, 0x7b, 0xf8, 0x10, 0xaa, 0x6c, 0xd4, 0xeb, 0x11, 0xc6, 0xd0, 0x5f, 0x1a,
-	0x46, 0x50, 0xef, 0x5a, 0x7d, 0x9f, 0x92, 0xef, 0x46, 0x84, 0x79, 0xe8, 0x57, 0x1d, 0x1f, 0x41,
-	0x6d, 0xe0, 0xd2, 0xae, 0xdd, 0xef, 0x13, 0x07, 0xfd, 0x96, 0x61, 0xc7, 0xf5, 0xfc, 0x81, 0x3b,
-	0x72, 0xfa, 0xe8, 0x77, 0x1d, 0x3f, 0x01, 0x43, 0xb1, 0x7d, 0xe2, 0x78, 0xb6, 0xf7, 0x83, 0xef,
-	0xb9, 0xae, 0x3f, 0xb4, 0xe8, 0x35, 0x41, 0x7f, 0xe8, 0xf8, 0x0c, 0x4e, 0x6d, 0xc7, 0x23, 0xd4,
-	0xb1, 0x86, 0x3e, 0x23, 0xf4, 0x35, 0xa1, 0x3e, 0xa1, 0xd4, 0xa5, 0xe8, 0x1f, 0x1d, 0x1b, 0xd0,
-	0x4c, 0x43, 0x76, 0x8f, 0xf8, 0x23, 0xc7, 0x7a, 0x6d, 0xd9, 0x43, 0xab, 0x3b, 0x24, 0xe8, 0x5f,
-	0xfd, 0xe2, 0x67, 0x0d, 0x40, 0xfa, 0xeb, 0xa5, 0xff, 0xc6, 0x3a, 0x54, 0x5f, 0x12, 0xc6, 0xac,
-	0x6b, 0x82, 0xf6, 0x30, 0x40, 0xa5, 0xe7, 0x3a, 0x03, 0xfb, 0x1a, 0x69, 0xf8, 0x04, 0x1a, 0xf2,
-	0xec, 0x8f, 0x5e, 0xf5, 0x2d, 0x8f, 0xa0, 0x7d, 0x6c, 0xc0, 0x23, 0xe2, 0xf4, 0x5d, 0xca, 0x08,
-	0xf5, 0x3d, 0x6a, 0x39, 0xcc, 0xea, 0x79, 0xb6, 0xeb, 0x20, 0x1d, 0x3f, 0x86, 0xa6, 0x4b, 0xfb,
-	0x84, 0x3e, 0x48, 0x94, 0xf0, 0x29, 0x9c, 0xf4, 0xc9, 0xd0, 0x4e, 0xb5, 0x31, 0x42, 0x5e, 0xf8,
-	0xb6, 0x33, 0x70, 0x51, 0xf9, 0xe2, 0x2d, 0xe0, 0x1d, 0x7b, 0xed, 0xf4, 0xb5, 0x8a, 0x8f, 0x00,
-	0x98, 0x7d, 0xed, 0x58, 0xde, 0x88, 0x12, 0x86, 0xf6, 0xf0, 0x31, 0xd4, 0x87, 0x16, 0xf3, 0xfc,
-	0x42, 0xd3, 0x63, 0x68, 0x6e, 0x95, 0x67, 0xfe, 0xc0, 0x1e, 0x7a, 0x84, 0xa2, 0xfd, 0xf4, 0x16,
-	0xaa, 0x3f, 0xd2, 0xbb, 0x0c, 0x3e, 0x0f, 0xa3, 0x59, 0x7b, 0x7e, 0xbf, 0x16, 0xd1, 0x52, 0x4c,
-	0x67, 0x22, 0x6a, 0xdf, 0xf0, 0x71, 0xb4, 0x98, 0xc8, 0x97, 0x48, 0xac, 0xb6, 0xf0, 0xcd, 0xe5,
-	0x6c, 0x91, 0xcc, 0x37, 0xe3, 0x14, 0x76, 0xb6, 0xc8, 0x1d, 0x49, 0x96, 0x5f, 0x88, 0x58, 0x7d,
-	0x45, 0xc6, 0x95, 0x0c, 0x7e, 0xfd, 0x5f, 0x00, 0x00, 0x00, 0xff, 0xff, 0xed, 0x43, 0x62, 0xd7,
-	0x5d, 0x06, 0x00, 0x00,
+	// 900 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x84, 0x55, 0xdf, 0x6e, 0xe3, 0xc4,
+	0x1b, 0xad, 0xe3, 0xfc, 0x69, 0xbe, 0x34, 0xad, 0x3b, 0xd9, 0xfe, 0xd6, 0xbf, 0xc2, 0x6a, 0x23,
+	0xc3, 0xa2, 0xd2, 0x4a, 0x89, 0x28, 0x37, 0x70, 0xe9, 0xd8, 0x93, 0xd6, 0x6a, 0xd6, 0x2e, 0x63,
+	0x67, 0x11, 0xbb, 0x48, 0x96, 0x93, 0x4c, 0x13, 0x8b, 0xc4, 0x8e, 0x6c, 0xa7, 0x6a, 0x5f, 0x02,
+	0x21, 0xc1, 0x0d, 0x17, 0xbc, 0x00, 0x4f, 0xc2, 0x5b, 0xf0, 0x12, 0x48, 0xdc, 0xa2, 0xf1, 0x8c,
+	0xbd, 0x49, 0x59, 0x89, 0xab, 0xcc, 0x39, 0x73, 0x3c, 0xdf, 0x99, 0xf3, 0x7d, 0xb1, 0xa1, 0x33,
+	0x8d, 0x57, 0xab, 0x38, 0xea, 0xf3, 0x9f, 0xde, 0x3a, 0x89, 0xb3, 0x18, 0xd5, 0x39, 0x3a, 0x7d,
+	0x39, 0x8f, 0xe3, 0xf9, 0x92, 0xf6, 0x73, 0x76, 0xb2, 0xb9, 0xeb, 0x67, 0xe1, 0x8a, 0xa6, 0x59,
+	0xb0, 0x5a, 0x73, 0xa1, 0xa6, 0x01, 0x8c, 0x82, 0x34, 0x33, 0xe2, 0xe8, 0x2e, 0x9c, 0xa3, 0x67,
+	0x50, 0x0b, 0xa3, 0x19, 0x7d, 0x50, 0xa5, 0xae, 0x74, 0x56, 0x25, 0x1c, 0x68, 0xef, 0x60, 0xff,
+	0x35, 0xcd, 0x82, 0x59, 0x90, 0x05, 0x4c, 0x71, 0x1f, 0x2c, 0x37, 0x34, 0x57, 0x1c, 0x10, 0x0e,
+	0xd0, 0xd7, 0x00, 0x69, 0x38, 0x8f, 0x82, 0x6c, 0x93, 0xd0, 0x54, 0xad, 0x74, 0xe5, 0xb3, 0xd6,
+	0xe5, 0xff, 0x7b, 0xc2, 0x51, 0xf1, 0xac, 0x5b, 0x28, 0xc8, 0x96, 0x58, 0xfb, 0x1e, 0x8e, 0xff,
+	0x25, 0x40, 0x9f, 0x83, 0x52, 0x4a, 0xfc, 0x05, 0x0d, 0x66, 0x34, 0x11, 0x05, 0x8f, 0x4a, 0xfe,
+	0x3a, 0xa7, 0xd1, 0xc7, 0xd0, 0x2c, 0x29, 0xb5, 0x92, 0x6b, 0xde, 0x13, 0xda, 0x5b, 0xa8, 0x0b,
+	0xdd, 0x2b, 0x38, 0x9c, 0x2e, 0x82, 0x28, 0xa2, 0xcb, 0xdd, 0x03, 0xdb, 0x82, 0x15, 0xb2, 0x0f,
+	0x55, 0xae, 0x7c, 0xb0, 0xb2, 0xf6, 0xa7, 0x04, 0x6d, 0x63, 0xe7, 0x61, 0x04, 0xd5, 0xec, 0x71,
+	0xcd, 0xb3, 0xa9, 0x91, 0x7c, 0x8d, 0x54, 0x68, 0xdc, 0xd3, 0x24, 0x0d, 0xe3, 0x28, 0x3f, 0xa7,
+	0x46, 0x0a, 0x88, 0xbe, 0x82, 0x66, 0xd9, 0x0d, 0x55, 0xee, 0x4a, 0x67, 0xad, 0xcb, 0xd3, 0x1e,
+	0xef, 0x57, 0xaf, 0xe8, 0x57, 0xcf, 0x2b, 0x14, 0xe4, 0xbd, 0x18, 0xbd, 0x00, 0x28, 0xee, 0x12,
+	0xce, 0xd4, 0x6a, 0x57, 0x3a, 0x6b, 0x92, 0xa6, 0x60, 0xac, 0x19, 0xea, 0x40, 0x2d, 0x7b, 0x60,
+	0x3b, 0xb5, 0x7c, 0xa7, 0x9a, 0x3d, 0x58, 0x33, 0xd6, 0x38, 0xba, 0x8e, 0xa7, 0x0b, 0xb5, 0xce,
+	0x5b, 0x9b, 0x03, 0x96, 0x1e, 0x7d, 0xc8, 0x68, 0x94, 0xfb, 0x6b, 0xf0, 0xf4, 0x4a, 0x42, 0xd3,
+	0xe1, 0xc8, 0x7d, 0x12, 0xb7, 0x0a, 0x8d, 0x69, 0x42, 0x83, 0x2c, 0x2e, 0xf2, 0x2b, 0x20, 0x2b,
+	0x10, 0xc5, 0xd1, 0xb4, 0x68, 0x02, 0x07, 0x1a, 0x86, 0xc6, 0x6d, 0xf0, 0xb8, 0x8c, 0x83, 0x19,
+	0xfa, 0x0c, 0xea, 0x5b, 0xc9, 0xb7, 0x2e, 0x0f, 0x8b, 0x01, 0xe1, 0x47, 0x13, 0xb1, 0xcb, 0x52,
+	0x64, 0xd3, 0x20, 0xce, 0xc9, 0xd7, 0xda, 0x00, 0xf6, 0x71, 0x74, 0x4f, 0x97, 0x31, 0x4f, 0x74,
+	0xcd, 0x8f, 0x2c, 0x2c, 0x08, 0xf8, 0x1f, 0xb3, 0xf0, 0xa3, 0x04, 0xb5, 0xc1, 0x32, 0x9e, 0xfe,
+	0x80, 0x2e, 0x9e, 0x38, 0xe9, 0x14, 0x4e, 0xf2, 0xed, 0x27, 0x76, 0x5e, 0x6d, 0xd9, 0x69, 0x5d,
+	0x1e, 0xef, 0x48, 0xcd, 0x20, 0x0b, 0xb8, 0x43, 0xf4, 0x05, 0xec, 0xaf, 0xc4, 0x1c, 0x8b, 0x66,
+	0x9e, 0xec, 0x48, 0x8b, 0x21, 0x27, 0xa5, 0x4c, 0x9b, 0x43, 0x6b, 0xab, 0x20, 0xfa, 0x1f, 0xd4,
+	0xa3, 0xcd, 0x6a, 0x22, 0x5c, 0x55, 0x89, 0x40, 0xe8, 0x13, 0x68, 0xaf, 0x13, 0x7a, 0x1f, 0xc6,
+	0x9b, 0xd4, 0x5f, 0x04, 0xe9, 0x42, 0xdc, 0xec, 0xa0, 0x20, 0xaf, 0x83, 0x74, 0x81, 0x3e, 0x82,
+	0x26, 0x3b, 0x93, 0x0b, 0xe4, 0x5c, 0xb0, 0xcf, 0x08, 0xb6, 0xa9, 0xbd, 0x84, 0x66, 0x69, 0xb7,
+	0x8c, 0x57, 0xea, 0xca, 0x65, 0xbc, 0x17, 0xd0, 0xde, 0x31, 0x89, 0x4e, 0xb7, 0x6e, 0xc3, 0x85,
+	0x25, 0x3e, 0xff, 0x5d, 0x82, 0xba, 0x9b, 0x05, 0xd9, 0x26, 0x45, 0x2d, 0x68, 0x8c, 0xed, 0x1b,
+	0xdb, 0xf9, 0xd6, 0x56, 0xf6, 0xd0, 0x01, 0x34, 0xdc, 0xb1, 0x61, 0x60, 0xd7, 0x55, 0xfe, 0x90,
+	0x90, 0x02, 0xad, 0x81, 0x6e, 0xfa, 0x04, 0x7f, 0x33, 0xc6, 0xae, 0xa7, 0xfc, 0x24, 0xa3, 0x43,
+	0x68, 0x0e, 0x1d, 0x32, 0xb0, 0x4c, 0x13, 0xdb, 0xca, 0xcf, 0x39, 0xb6, 0x1d, 0xcf, 0x1f, 0x3a,
+	0x63, 0xdb, 0x54, 0x7e, 0x91, 0xd1, 0x0b, 0x50, 0x85, 0xda, 0xc7, 0xb6, 0x67, 0x79, 0xdf, 0xf9,
+	0x9e, 0xe3, 0xf8, 0x23, 0x9d, 0x5c, 0x61, 0xe5, 0x37, 0x19, 0x9d, 0xc2, 0x89, 0x65, 0x7b, 0x98,
+	0xd8, 0xfa, 0xc8, 0x77, 0x31, 0x79, 0x83, 0x89, 0x8f, 0x09, 0x71, 0x88, 0xf2, 0x97, 0x8c, 0x54,
+	0xe8, 0x30, 0xca, 0x32, 0xb0, 0x3f, 0xb6, 0xf5, 0x37, 0xba, 0x35, 0xd2, 0x07, 0x23, 0xac, 0xfc,
+	0x2d, 0x9f, 0xff, 0x2a, 0x01, 0xf0, 0x7c, 0x3d, 0xf6, 0x6f, 0x6c, 0x41, 0xe3, 0x35, 0x76, 0x5d,
+	0xfd, 0x0a, 0x2b, 0x7b, 0x08, 0xa0, 0x6e, 0x38, 0xf6, 0xd0, 0xba, 0x52, 0x24, 0x74, 0x0c, 0x6d,
+	0xbe, 0xf6, 0xc7, 0xb7, 0xa6, 0xee, 0x61, 0xa5, 0x82, 0x54, 0x78, 0x86, 0x6d, 0xd3, 0x21, 0x2e,
+	0x26, 0xbe, 0x47, 0x74, 0xdb, 0xd5, 0x0d, 0xcf, 0x72, 0x6c, 0x45, 0x46, 0xcf, 0xa1, 0xe3, 0x10,
+	0x13, 0x93, 0x27, 0x1b, 0x55, 0x74, 0x02, 0xc7, 0x26, 0x1e, 0x59, 0xcc, 0x9b, 0x8b, 0xf1, 0x8d,
+	0x6f, 0xd9, 0x43, 0x47, 0xa9, 0x31, 0xda, 0xb8, 0xd6, 0x2d, 0xdb, 0x70, 0x4c, 0xec, 0xdf, 0xea,
+	0xc6, 0x0d, 0xab, 0x5f, 0x3f, 0x7f, 0x07, 0x68, 0x27, 0x75, 0x8b, 0xbd, 0x6d, 0xd1, 0x21, 0x80,
+	0x6b, 0x5d, 0xd9, 0xba, 0x37, 0x26, 0xd8, 0x55, 0xf6, 0xd0, 0x11, 0xb4, 0x46, 0xba, 0xeb, 0xf9,
+	0xa5, 0xd5, 0xe7, 0xd0, 0xd9, 0xaa, 0xea, 0xfa, 0x43, 0x6b, 0xe4, 0x61, 0xa2, 0x54, 0xd8, 0xe5,
+	0x84, 0x2d, 0x45, 0x1e, 0xb8, 0xf0, 0x69, 0x9c, 0xcc, 0x7b, 0x8b, 0xc7, 0x35, 0x4d, 0x96, 0x74,
+	0x36, 0xa7, 0x49, 0xef, 0x2e, 0x98, 0x24, 0xe1, 0x94, 0xbf, 0x5b, 0x52, 0x31, 0x9c, 0x6f, 0x2f,
+	0xe6, 0x61, 0xb6, 0xd8, 0x4c, 0x18, 0xec, 0x6f, 0x89, 0xfb, 0x5c, 0xcc, 0x3f, 0x1c, 0xa9, 0xf8,
+	0xb8, 0x4c, 0xea, 0x39, 0xfc, 0xf2, 0x9f, 0x00, 0x00, 0x00, 0xff, 0xff, 0xa1, 0xcb, 0xe1, 0xb4,
+	0x74, 0x06, 0x00, 0x00,
 }
diff --git a/protos/common/common.proto b/protos/common/common.proto
index 97aa27792ea..d4a56bd5b47 100644
--- a/protos/common/common.proto
+++ b/protos/common/common.proto
@@ -42,6 +42,7 @@ enum HeaderType {
     ENDORSER_TRANSACTION = 3;      // Used by the SDK to submit endorser based transactions
     ORDERER_TRANSACTION = 4;       // Used internally by the orderer for management
     DELIVER_SEEK_INFO = 5;         // Used as the type for Envelope messages submitted to instruct the Deliver API to seek
+    CHAINCODE_PACKAGE = 6;         // Used for packaging chaincode artifacts for install
 }
 
 // This enum enlists indexes of the block metadata array
diff --git a/protos/peer/admin.pb.go b/protos/peer/admin.pb.go
index eda2cf72531..78c9a402a4f 100644
--- a/protos/peer/admin.pb.go
+++ b/protos/peer/admin.pb.go
@@ -16,6 +16,7 @@ It is generated from these files:
 	peer/proposal.proto
 	peer/proposal_response.proto
 	peer/query.proto
+	peer/signed_cc_dep_spec.proto
 	peer/transaction.proto
 
 It has these top-level messages:
@@ -61,6 +62,7 @@ It has these top-level messages:
 	ChaincodeInfo
 	ChannelQueryResponse
 	ChannelInfo
+	SignedChaincodeDeploymentSpec
 	SignedTransaction
 	ProcessedTransaction
 	Transaction
diff --git a/protos/peer/signed_cc_dep_spec.pb.go b/protos/peer/signed_cc_dep_spec.pb.go
new file mode 100644
index 00000000000..dd83d7ca57d
--- /dev/null
+++ b/protos/peer/signed_cc_dep_spec.pb.go
@@ -0,0 +1,67 @@
+// Code generated by protoc-gen-go.
+// source: peer/signed_cc_dep_spec.proto
+// DO NOT EDIT!
+
+package peer
+
+import proto "github.com/golang/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// SignedChaincodeDeploymentSpec carries the CDS along with endorsements
+type SignedChaincodeDeploymentSpec struct {
+	// This is the bytes of the ChaincodeDeploymentSpec
+	ChaincodeDeploymentSpec []byte `protobuf:"bytes,1,opt,name=chaincode_deployment_spec,json=chaincodeDeploymentSpec,proto3" json:"chaincode_deployment_spec,omitempty"`
+	// This is the instantiation policy which is identical in structure
+	// to endorsement policy.  This policy is checked by the VSCC at commit
+	// time on the instantiation (all peers will get the same policy as it
+	// will be part of the LCCC instantation record and will be part of the
+	// hash as well)
+	InstantiationPolicy []byte `protobuf:"bytes,2,opt,name=instantiation_policy,json=instantiationPolicy,proto3" json:"instantiation_policy,omitempty"`
+	// The endorsements of the above deployment spec, the owner's signature over
+	// chaincode_deployment_spec and Endorsement.endorser.
+	OwnerEndorsements []*Endorsement `protobuf:"bytes,3,rep,name=owner_endorsements,json=ownerEndorsements" json:"owner_endorsements,omitempty"`
+}
+
+func (m *SignedChaincodeDeploymentSpec) Reset()                    { *m = SignedChaincodeDeploymentSpec{} }
+func (m *SignedChaincodeDeploymentSpec) String() string            { return proto.CompactTextString(m) }
+func (*SignedChaincodeDeploymentSpec) ProtoMessage()               {}
+func (*SignedChaincodeDeploymentSpec) Descriptor() ([]byte, []int) { return fileDescriptor10, []int{0} }
+
+func (m *SignedChaincodeDeploymentSpec) GetOwnerEndorsements() []*Endorsement {
+	if m != nil {
+		return m.OwnerEndorsements
+	}
+	return nil
+}
+
+func init() {
+	proto.RegisterType((*SignedChaincodeDeploymentSpec)(nil), "protos.SignedChaincodeDeploymentSpec")
+}
+
+func init() { proto.RegisterFile("peer/signed_cc_dep_spec.proto", fileDescriptor10) }
+
+var fileDescriptor10 = []byte{
+	// 255 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x74, 0x90, 0xc1, 0x4a, 0xc3, 0x40,
+	0x10, 0x86, 0xa9, 0x05, 0x0f, 0xab, 0x17, 0x53, 0xc1, 0x28, 0x16, 0x4a, 0x4f, 0xf5, 0x92, 0xa0,
+	0xde, 0x3c, 0x56, 0x3d, 0x2b, 0xed, 0xcd, 0xcb, 0x92, 0x4c, 0xc6, 0x64, 0x21, 0xdd, 0x19, 0x66,
+	0x56, 0x24, 0xaf, 0xe9, 0x13, 0x49, 0x76, 0x2d, 0xd6, 0x83, 0xa7, 0x85, 0xfd, 0xbe, 0x7f, 0x66,
+	0xf8, 0xcd, 0x9c, 0x11, 0xa5, 0x54, 0xd7, 0x7a, 0x6c, 0x2c, 0x80, 0x6d, 0x90, 0xad, 0x32, 0x42,
+	0xc1, 0x42, 0x81, 0xb2, 0xe3, 0xf8, 0xe8, 0xd5, 0x75, 0xd4, 0x58, 0x88, 0x49, 0xab, 0xde, 0x0a,
+	0x2a, 0x93, 0x57, 0x4c, 0xd6, 0xf2, 0x6b, 0x62, 0xe6, 0xdb, 0x38, 0xe2, 0xb1, 0xab, 0x9c, 0x07,
+	0x6a, 0xf0, 0x09, 0xb9, 0xa7, 0x61, 0x87, 0x3e, 0x6c, 0x19, 0x21, 0x7b, 0x30, 0x97, 0xb0, 0x47,
+	0xe3, 0x8e, 0x1f, 0x16, 0x57, 0xe5, 0x93, 0xc5, 0x64, 0x75, 0xba, 0xb9, 0x80, 0x7f, 0xb2, 0xb7,
+	0xe6, 0xdc, 0x79, 0x0d, 0x95, 0x0f, 0xae, 0x0a, 0x8e, 0xbc, 0x65, 0xea, 0x1d, 0x0c, 0xf9, 0x51,
+	0x8c, 0xcd, 0xfe, 0xb0, 0xd7, 0x88, 0xb2, 0xb5, 0xc9, 0xe8, 0xd3, 0xa3, 0x58, 0xf4, 0x0d, 0x89,
+	0xe2, 0x38, 0x4b, 0xf3, 0xe9, 0x62, 0xba, 0x3a, 0xb9, 0x9b, 0xa5, 0xa3, 0xb5, 0x78, 0xfe, 0x65,
+	0x9b, 0xb3, 0xa8, 0x1f, 0xfc, 0xe8, 0xfa, 0xc5, 0x2c, 0x49, 0xda, 0xa2, 0x1b, 0x18, 0xa5, 0xc7,
+	0xa6, 0x45, 0x29, 0xde, 0xab, 0x5a, 0x1c, 0xec, 0xf3, 0x63, 0x25, 0x6f, 0x37, 0xad, 0x0b, 0xdd,
+	0x47, 0x5d, 0x00, 0xed, 0xca, 0x03, 0xb5, 0x4c, 0x6a, 0x99, 0xd4, 0x72, 0x54, 0xeb, 0xd4, 0xe5,
+	0xfd, 0x77, 0x00, 0x00, 0x00, 0xff, 0xff, 0x78, 0x40, 0x4c, 0x9e, 0x73, 0x01, 0x00, 0x00,
+}
diff --git a/protos/peer/signed_cc_dep_spec.proto b/protos/peer/signed_cc_dep_spec.proto
new file mode 100644
index 00000000000..c475a5c4e14
--- /dev/null
+++ b/protos/peer/signed_cc_dep_spec.proto
@@ -0,0 +1,42 @@
+/*
+Copyright IBM Corp. 2017 All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+		 http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+syntax = "proto3";
+
+option java_package = "org.hyperledger.fabric.protos.peer";
+option go_package = "github.com/hyperledger/fabric/protos/peer";
+
+package protos;
+
+import "peer/proposal_response.proto";
+
+// SignedChaincodeDeploymentSpec carries the CDS along with endorsements
+message SignedChaincodeDeploymentSpec {
+
+	// This is the bytes of the ChaincodeDeploymentSpec 
+	bytes chaincode_deployment_spec = 1;
+
+	// This is the instantiation policy which is identical in structure
+	// to endorsement policy.  This policy is checked by the VSCC at commit
+	// time on the instantiation (all peers will get the same policy as it
+	// will be part of the LCCC instantation record and will be part of the
+	// hash as well)
+	bytes instantiation_policy = 2;
+
+	// The endorsements of the above deployment spec, the owner's signature over
+	// chaincode_deployment_spec and Endorsement.endorser. 
+	repeated Endorsement owner_endorsements = 3;
+}
+
diff --git a/protos/peer/transaction.pb.go b/protos/peer/transaction.pb.go
index 14d9ccdcec9..c444ee78a44 100644
--- a/protos/peer/transaction.pb.go
+++ b/protos/peer/transaction.pb.go
@@ -82,7 +82,7 @@ var TxValidationCode_value = map[string]int32{
 func (x TxValidationCode) String() string {
 	return proto.EnumName(TxValidationCode_name, int32(x))
 }
-func (TxValidationCode) EnumDescriptor() ([]byte, []int) { return fileDescriptor10, []int{0} }
+func (TxValidationCode) EnumDescriptor() ([]byte, []int) { return fileDescriptor11, []int{0} }
 
 // This message is necessary to facilitate the verification of the signature
 // (in the signature field) over the bytes of the transaction (in the
@@ -100,7 +100,7 @@ type SignedTransaction struct {
 func (m *SignedTransaction) Reset()                    { *m = SignedTransaction{} }
 func (m *SignedTransaction) String() string            { return proto.CompactTextString(m) }
 func (*SignedTransaction) ProtoMessage()               {}
-func (*SignedTransaction) Descriptor() ([]byte, []int) { return fileDescriptor10, []int{0} }
+func (*SignedTransaction) Descriptor() ([]byte, []int) { return fileDescriptor11, []int{0} }
 
 // ProcessedTransaction wraps an Envelope that includes a transaction along with an indication
 // of whether the transaction was validated or invalidated by committing peer.
@@ -118,7 +118,7 @@ type ProcessedTransaction struct {
 func (m *ProcessedTransaction) Reset()                    { *m = ProcessedTransaction{} }
 func (m *ProcessedTransaction) String() string            { return proto.CompactTextString(m) }
 func (*ProcessedTransaction) ProtoMessage()               {}
-func (*ProcessedTransaction) Descriptor() ([]byte, []int) { return fileDescriptor10, []int{1} }
+func (*ProcessedTransaction) Descriptor() ([]byte, []int) { return fileDescriptor11, []int{1} }
 
 func (m *ProcessedTransaction) GetTransactionEnvelope() *common.Envelope {
 	if m != nil {
@@ -148,7 +148,7 @@ type Transaction struct {
 func (m *Transaction) Reset()                    { *m = Transaction{} }
 func (m *Transaction) String() string            { return proto.CompactTextString(m) }
 func (*Transaction) ProtoMessage()               {}
-func (*Transaction) Descriptor() ([]byte, []int) { return fileDescriptor10, []int{2} }
+func (*Transaction) Descriptor() ([]byte, []int) { return fileDescriptor11, []int{2} }
 
 func (m *Transaction) GetActions() []*TransactionAction {
 	if m != nil {
@@ -170,7 +170,7 @@ type TransactionAction struct {
 func (m *TransactionAction) Reset()                    { *m = TransactionAction{} }
 func (m *TransactionAction) String() string            { return proto.CompactTextString(m) }
 func (*TransactionAction) ProtoMessage()               {}
-func (*TransactionAction) Descriptor() ([]byte, []int) { return fileDescriptor10, []int{3} }
+func (*TransactionAction) Descriptor() ([]byte, []int) { return fileDescriptor11, []int{3} }
 
 // ChaincodeActionPayload is the message to be used for the TransactionAction's
 // payload when the Header's type is set to CHAINCODE.  It carries the
@@ -193,7 +193,7 @@ type ChaincodeActionPayload struct {
 func (m *ChaincodeActionPayload) Reset()                    { *m = ChaincodeActionPayload{} }
 func (m *ChaincodeActionPayload) String() string            { return proto.CompactTextString(m) }
 func (*ChaincodeActionPayload) ProtoMessage()               {}
-func (*ChaincodeActionPayload) Descriptor() ([]byte, []int) { return fileDescriptor10, []int{4} }
+func (*ChaincodeActionPayload) Descriptor() ([]byte, []int) { return fileDescriptor11, []int{4} }
 
 func (m *ChaincodeActionPayload) GetAction() *ChaincodeEndorsedAction {
 	if m != nil {
@@ -217,7 +217,7 @@ type ChaincodeEndorsedAction struct {
 func (m *ChaincodeEndorsedAction) Reset()                    { *m = ChaincodeEndorsedAction{} }
 func (m *ChaincodeEndorsedAction) String() string            { return proto.CompactTextString(m) }
 func (*ChaincodeEndorsedAction) ProtoMessage()               {}
-func (*ChaincodeEndorsedAction) Descriptor() ([]byte, []int) { return fileDescriptor10, []int{5} }
+func (*ChaincodeEndorsedAction) Descriptor() ([]byte, []int) { return fileDescriptor11, []int{5} }
 
 func (m *ChaincodeEndorsedAction) GetEndorsements() []*Endorsement {
 	if m != nil {
@@ -236,9 +236,9 @@ func init() {
 	proto.RegisterEnum("protos.TxValidationCode", TxValidationCode_name, TxValidationCode_value)
 }
 
-func init() { proto.RegisterFile("peer/transaction.proto", fileDescriptor10) }
+func init() { proto.RegisterFile("peer/transaction.proto", fileDescriptor11) }
 
-var fileDescriptor10 = []byte{
+var fileDescriptor11 = []byte{
 	// 748 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x74, 0x54, 0x51, 0x4f, 0xeb, 0x36,
 	0x18, 0x5d, 0x61, 0xc0, 0xf8, 0xca, 0xc0, 0x18, 0x6e, 0x6f, 0xa9, 0xd0, 0xee, 0x55, 0x1f, 0xa6,