Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Use the following commands to package base games and add-ons, upload packages to Partner Center, and perform related packaging operations. makepkg supports XVC for XBOX consoles and MSIXVC or MSIXVC2 for PC. The /msixvc2 option enables content-based segmentation and other PC packaging improvements within the existing packaging workflow. Both PC formats use the .msixvc extension.
Note
This reference describes makepkg.exe in the October 2026 GDK. MSIXVC2 is generally available in this release, including certification for public release. To use its content-based segmentation, reduced update downloads and package overhead, built-in compression, and other packaging improvements, specify /msixvc2. If you omit this option with /pc, makepkg creates an original MSIXVC package. For earlier preview restrictions and planned default-format changes in later releases, see Scope and timeline.
makepkg <command> [options]
Replace angle-bracket placeholders with your values, without the brackets. Enclose paths that contain spaces in quotation marks.
Global options
| Option | Description |
|---|---|
/v |
Enables verbose output to the console. |
/?, /h |
Shows help and usage information. |
Commands
- pack - Creates a new app package from files on disk.
- upload - Uploads a package or a directory of files to Partner Center.
- genkey - Generates an encryption key for use with
pack /lk. - genid - Converts between a Product ID GUID and a Store ID.
- genmap - Generates a mapping XML file based on content on disk.
- validate - Runs validation without creating a package.
- updatesubval - Updates SubmissionValidator.dll without running another operation.
- localize - Generates a Resources.pri file based on content on disk.
pack
Creates a new app package from files on disk.
makepkg pack [options]
Sample usage:
makepkg pack /msixvc2 /f layout.xml /d <sourcedir> /pc /pd <destinationdir>
Options
| Option | Description |
|---|---|
/d <sourcedir> |
(Required) Specifies the source directory that contains the content to package. |
/pd <destinationdir> |
(Required) Specifies the destination directory for the generated package. |
/f <mapfile> |
Specifies the layout mapping file. If omitted, a default single-chunk layout is generated. An explicit layout file is recommended for reviewing and configuring streaming installation and Intelligent Delivery. |
/msixvc2 |
Selects MSIXVC2 for PC packaging. In the October 2026 GDK, omitting this option with /pc generates an original MSIXVC package. This option doesn't apply to XBOX console packages. |
/compress <method> |
Compresses the output. Available methods are Automatic (default), Brotli, and None. Automatic uses Brotli for MSIXVC2 packages and no compression for other package formats. |
/pc |
Generates a package for use on PC. |
/contentid <contentid> |
Specifies the content ID to which this package belongs. |
/gameos <gameos> |
Specifies the game OS file to embed in the package. |
/l |
Encrypts the package with a unique content license. When submitting an XVC or MSIXVC package to certification, use /l or /lk unless the Certification team directs you otherwise. |
/lk <key.lekb> |
Encrypts the package with a content license by using a specified key file. Use genkey to generate the key file. When submitting an XVC or MSIXVC package to certification, use /l or /lk unless the Certification team directs you otherwise. |
/productid <productid> |
Specifies the product ID to which this package belongs. |
/maxencryptionfragments <count> |
Specifies the number of encryption fragments to reserve in package metadata. This option has no effect when /msixvc2 is specified. |
/priorpackage <packagefile> |
Specifies a prior XVC, MSIXVC, or MSIXVC2 package for content update size comparison. For MSIXVC2, writes .json and .html comparison reports without changing package creation or the resulting package. This is a shortcut for running packageutil compare after packaging. |
/loggable |
Suppresses output containing control characters that aren't suitable for a log file. |
/usepublisherkey <publisherkeyname> |
Signs an XVC or MSIXVC Publisher Content package, or embeds the publisher public key into the parent base game package, using a preinstalled CNG key identified by publisherkeyname. Applies to XVC and MSIXVC only. |
/publisherkeyprovider <publisherkeyprovider> |
Specifies the CNG key storage provider that holds the publisher key named by /usepublisherkey. If not specified, the Microsoft Software Key Storage Provider is used. Applies to XVC and MSIXVC only. |
/usepublishercert <thumbprint\|certificate.cer> |
Specifies the thumbprint or .cer file path of the certificate used to sign a MSIXVC2 Publisher Content package or authorize it from a parent package. A .cer file is matched to its private key in the certificate store. Requires /msixvc2. |
/publishercertstore <store> |
Specifies the certificate store that contains the publisher certificate named by /usepublishercert. If not specified, the CurrentUser personal store is used. Requires /msixvc2. |
/symbolpaths <symbolpaths> |
Specifies additional symbol resolution paths used during automatic symbol bundling. Separate paths with semicolons. |
/skipsymbolbundling |
Skips automatic symbol bundling. |
/skipvalidation |
Skips Submission Validator. Don't use this option for builds that might be submitted to certification. |
/validationcritical |
Treats Submission Validator failures as critical failures for the makepkg process. |
/openvalidationlog |
Opens the Submission Validator log file in the default XML application after validation. |
/validationlanguage <lang> |
Specifies an additional language for the Submission Validator log file. |
/validationpath <path> |
Specifies the directory from which to load SubmissionValidator.dll. |
/updatesubval |
Downloads the latest SubmissionValidator.dll before validation unless the installed version is current. Use /validationpath to select a different location. If the update fails, packaging or validation continues with the installed DLL. To update without another operation, use updatesubval. |
Remarks
Keep Submission Validator enabled during development and review its log. Warnings and some failures can be deferred for publisher development/test sandbox publishing or Playtest publishing in RETAIL, but they can still identify installation, launch, or runtime problems. Playtest isn't a certified commercial retail release. See Development sandbox publishing versus certification.
The /validationcritical option makes Submission Validator failures critical to the local makepkg process. It doesn't define service-side publishing eligibility. Neither omitting /validationcritical nor using /skipvalidation overrides Partner Center requirements or certification checks.
By default, makepkg pack encrypts XVC or MSIXVC packages by using a well-known encryption key recognized by all development kits for testing. These packages aren't cryptographically protected.
For additional upload protection, XVC and MSIXVC packages can use /l or /lk. Packages that use /l can't be installed on a development kit or PC before upload. Packages that use /lk can be installed on a development kit before upload. Regardless of the upload encryption mode, the XBOX service encrypts the package for distribution with Microsoft-managed encryption keys.
For packages built with /msixvc2, the XBOX service handles encryption for distribution; /l and /lk don't apply. Distribution encryption is separate from installed-file protection: PC game data files are installed unencrypted, but executables designated in MicrosoftGame.config remain protected. See PC package encryption and content protection.
For information about layout syntax, see Deployment package schema. For ways to use layout files, see Streaming Installation and Intelligent Delivery: an overview.
MakePkg normally creates a symbol bundle automatically. If you need to create one as a fallback, see Create a symbol bundle manually.
MakePkg normally creates a symbol bundle automatically. If you need to create one as a fallback, see Create a symbol bundle manually.
upload
Uploads a package to Partner Center. For MSIXVC2 only, the upload command can also package loose files and upload them in one operation when /d is specified. Loose file upload requires the /msixvc2 option.
Specify /branch or /flight explicitly to select the intended upload destination. If neither is specified, the package is uploaded to main. Partner Center identifies MSIXVC2 packages with a tag in the UI.
The EKB file and Submission Validator log file should be in the same directory as the package and are uploaded automatically. A symbol bundle is also uploaded when present. The Store ID is extracted from the package, but it can be provided when the package was generated without one.
Uploading a package isn't the same as publishing it to a development sandbox or submitting it for certification. Review Submission Validator findings for the intended destination. For validation guidance and the scope of /validationcritical and /skipvalidation, see the pack remarks.
makepkg upload [options]
Sample usage (upload a prebuilt package):
makepkg upload /pd <package_directory> /branch <branch> /auth CacheableBrowser
Sample usage (package and upload loose files):
makepkg upload /d <sourcedir> /msixvc2 /pc /branch <branch>
Package source options
| Option | Description |
|---|---|
/pd <package_directory> |
Specifies the package file or its directory. If the directory contains more than one package, specify the full package file name. |
/d <sourcedir> |
Specifies the source directory to package and upload in one operation. |
/f <mapfile> |
Specifies the mapping file to use with /d. |
/msixvc2 |
Generates an MSIXVC2 package when used with /d. |
/compress <method> |
Compresses the output. Available methods are Automatic (default), Brotli, and None. Automatic uses Brotli for MSIXVC2 packages and no compression for other package formats. |
/pc |
Generates a PC package when used with /d. |
Destination options
| Option | Description |
|---|---|
/storeid <storeId> |
Specifies the Store ID. If omitted, the Store ID is extracted from the package. |
/branch <branch> |
Specifies the branch to upload to. Defaults to main if neither a branch nor flight is specified. |
/flight <flight> |
Specifies the flight to upload to. This option can't be used with /branch. |
/market <market> |
Specifies the market to upload to. Defaults to default. |
/disclayout <path> |
Specifies a disc layout file for a package that ships on more than one disc. |
/sodb <file> |
Specifies a State Object Database (SODB) file to upload with the package. An SODB enables prebuilt platform-specific shaders that can improve game launch time. |
Release scheduling options
| Option | Description |
|---|---|
/availabilitydate <date> |
Specifies when the package becomes available to customers in the target market group. Use an ISO 8601 date and time, such as 2027-04-15T17:00:00Z. A value without a time-zone offset is treated as UTC. |
/predownloaddate <date> |
Specifies when customers can begin downloading the package before its availability date. Use an ISO 8601 date and time, such as 2027-04-14T17:00:00Z. A value without a time-zone offset is treated as UTC. This option requires /availabilitydate, and the predownload date can't be later than the availability date. |
Authentication options
| Option | Description |
|---|---|
/auth <method> |
Specifies the authentication method. The default is CacheableBrowser. Multiple methods are available only for MSIXVC2 uploads. XVC and MSIXVC uploads can use only CacheableBrowser. For advanced authentication with those formats, use Package Uploader. |
/tenantid <tenantId> |
Specifies the tenant to upload to. If omitted, the user's default tenant is used. |
/clientid <clientId> |
Specifies the client ID. Required for ManagedIdentity, ManagedIdentityFederated, ClientCertificate, and ClientSecret. |
/clientsecret <secret> |
Specifies the client secret. Requires /auth ClientSecret. |
/certthumbprint <thumbprint> |
Specifies the certificate thumbprint for ClientCertificate. This option is an alternative to /certsubject and /certpath. |
/certsubject <subject> |
Specifies the certificate subject to find in the store selected by /certstore and /certlocation. Use this selector when renewed certificates retain the same subject, rather than updating a thumbprint after renewal. This option is an alternative to /certthumbprint and /certpath. |
/certpath <path> |
Specifies the path to a PFX or PKCS12 certificate file. Use /certpassword if the file is password protected. This option is an alternative to /certthumbprint and /certsubject. |
/certstore <store> |
Specifies the certificate store name. Defaults to My. |
/certlocation <location> |
Specifies the certificate location, such as CurrentUser or LocalMachine. Defaults to CurrentUser. |
/certpassword <password> |
Specifies the password for the certificate file selected by /certpath. This option is required only for a password-protected certificate file. |
/resourceid <resourceId> |
Specifies the Azure resource ID for ManagedIdentityFederated. |
Validation and symbol options
| Option | Description |
|---|---|
/skipvalidation |
Skips Submission Validator. Don't use this option for builds that might be submitted to certification. |
/validationcritical |
Treats Submission Validator failures as critical failures for the makepkg process. |
/validationlanguage <lang> |
Specifies an additional language for the Submission Validator log file. |
/validationpath <path> |
Specifies the directory from which to load SubmissionValidator.dll. |
/updatesubval |
Downloads the latest SubmissionValidator.dll before validation. See pack for failure behavior. |
/symbolpaths <symbolpaths> |
Specifies additional symbol resolution paths used during automatic symbol bundling. Separate paths with semicolons. |
/skipsymbolbundling |
Skips automatic symbol bundling. |
Authentication methods
| Method | Description |
|---|---|
CacheableBrowser |
Opens a browser for interactive sign-in and caches credentials. This method is the default. |
Browser |
Opens a browser for interactive sign-in without caching credentials. |
AzureCli |
Uses Azure CLI credentials. |
AzurePipelines |
Uses the Azure Pipelines service connection. |
ManagedIdentity |
Uses an Azure managed identity. Requires /clientid. |
ManagedIdentityFederated |
Uses a federated managed identity. Requires /clientid and /resourceid. |
ClientSecret |
Uses a client ID and secret. Requires /clientid and /clientsecret. |
ClientCertificate |
Uses a client certificate. Requires /clientid and one of /certthumbprint, /certsubject, or /certpath. |
Environment |
Uses credentials from environment variables. |
Default |
Tries multiple authentication methods in sequence. |
genkey
Generates a local escrowed key blob (LEKB) for use with pack /lk.
makepkg genkey [options]
| Option | Description |
|---|---|
/ekb <ekbfile> |
Specifies the path for the generated LEKB file. Use the .lekb extension to distinguish it from the .ekb file generated by makepkg pack. |
Provide the LEKB file to makepkg pack /lk to use a stable encryption key during package creation. This key:
- Allows
packageutil compareto generate accurate update-size estimates. - Enables secure delta uploads to Partner Center by using the same algorithm that consoles and PCs use to download content updates.
- Produces packages that can be installed on development kits.
- Uses secure encryption key material that can only be decrypted in specific environments.
The LEKB file contains lightly obfuscated encryption key material. Anyone who has both the LEKB file and the package can decrypt the package, so secure access to the file.
genid
Converts between a Product ID GUID and a Store ID.
makepkg genid [options]
| Option | Description |
|---|---|
/storeid <storeId> |
Specifies the Store ID to convert. |
/productid <productId> |
Specifies the Product ID GUID to convert. |
genmap
Generates a mapping XML file based on content on disk. The generated file contains one chunk and can be edited to split content into multiple chunks or add Intelligent Delivery tags.
makepkg genmap /f <mapfile> /d <contentdirectory>
| Option | Description |
|---|---|
/f <mapfile> |
Specifies the path for the generated mapping file. |
/d <contentdirectory> |
Specifies the directory whose contents are added to the mapping file. |
validate
Runs package validation without creating a package. Use this command to verify content and configuration before a full pack operation.
makepkg validate [options]
The validate command accepts the same options as pack.
updatesubval
Downloads, verifies, and installs the latest SubmissionValidator.dll without creating, validating, or uploading a package.
makepkg updatesubval [/validationpath <path>]
Options
| Option | Description |
|---|---|
/validationpath <path> |
Specifies the directory that contains or should receive SubmissionValidator.dll. If omitted, the command checks the makepkg tool directory, followed by the %GameDK%\bin directory. |
Remarks
If SubmissionValidator.dll is already the latest version, the command reports that it's current and exits successfully without downloading it. If the file is missing, the command installs it. On success, the command displays the version of SubmissionValidator.dll that's on disk.
Unlike the /updatesubval option used during packaging or validation, the standalone updatesubval command returns a nonzero exit code if the update fails. When used as an option, an update failure is non-fatal and the packaging or validation operation continues with the installed version of SubmissionValidator.dll.
localize
Generates a Resources.pri file based on content on disk.
makepkg localize /d <sourcedir> [options]
| Option | Description |
|---|---|
/d <sourcedir> |
(Required) Specifies the source directory that contains the content to localize. |
/resw <reswdir> |
Specifies a directory relative to the root directory that contains RESW files. |
/pd <outputdir> |
Specifies the output directory for Resources.pri. If omitted, the file is placed in the content directory. |
/t <tempdir> |
Specifies a temporary directory for converting Resources.pri to XML. |
/gc <gameconfigpath> |
Specifies the MicrosoftGame.config path when the file isn't at the base of the content directory or uses another name. |
For more information, see MicrosoftGame.config localization.
Related topics
PC packaging improvements
Package and upload a PC game
Deployment package schema
Xbox Game Package Manager
Automating package uploading