Centralize onboarding package validation

Change-Id: I3cc58cf15f62008e83cfc7ddb095d07ab216b82a
Issue-ID: SDC-2583
Signed-off-by: andre.schmid <andre.schmid@est.tech>

67 files changed, 1127 insertions, 755 deletions

diff --git a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/main/java/org/openecomp/sdcrests/vsp/rest/data/PackageArchive.java b/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/main/java/org/openecomp/sdcrests/vsp/rest/data/PackageArchive.java
deleted file mode 100644
index 4f4258ad53..0000000000
--- a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/main/java/org/openecomp/sdcrests/vsp/rest/data/PackageArchive.java
+++ /dev/null
@@ -1,163 +0,0 @@
-/*-
- * ============LICENSE_START=======================================================
- * SDC
- * ================================================================================
- * Copyright (C) 2019, Nordix Foundation. All rights reserved.
- * ================================================================================
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ============LICENSE_END=========================================================
- */
-package org.openecomp.sdcrests.vsp.rest.data;
-
-import java.security.cert.CertificateException;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import org.apache.commons.io.FilenameUtils;
-import org.apache.commons.lang3.tuple.Pair;
-import org.apache.cxf.jaxrs.ext.multipart.Attachment;
-import org.openecomp.core.utilities.file.FileContentHandler;
-import org.openecomp.sdc.common.utils.CommonUtil;
-import org.openecomp.sdc.common.zip.exception.ZipException;
-import org.openecomp.sdc.logging.api.Logger;
-import org.openecomp.sdc.logging.api.LoggerFactory;
-import org.openecomp.sdc.vendorsoftwareproduct.security.SecurityManager;
-import org.openecomp.sdc.vendorsoftwareproduct.security.SecurityManagerException;
-
-/**
- * Class responsible for processing zip archive and verify if this package corresponds SOL004 option 2 signed package
- * format, verifies the cms signature if package is signed
- */
-public class PackageArchive {
-
-    private static final Logger LOG = LoggerFactory.getLogger(PackageArchive.class);
-    private static final String[] ALLOWED_ARCHIVE_EXTENSIONS = {"csar", "zip"};
-    private static final String[] ALLOWED_SIGNATURE_EXTENSIONS = {"cms"};
-    private static final String[] ALLOWED_CERTIFICATE_EXTENSIONS = {"cert"};
-    private static final int NUMBER_OF_FILES_FOR_SIGNATURE_WITH_CERT_INSIDE = 2;
-    private static final int NUMBER_OF_FILES_FOR_SIGNATURE_WITHOUT_CERT_INSIDE = 3;
-    private final SecurityManager securityManager;
-    private final byte[] outerPackageFileBytes;
-    private Pair<FileContentHandler, List<String>> handlerPair;
-    private Boolean signatureValid;
-
-    public PackageArchive(Attachment uploadedFile) {
-        this(uploadedFile.getObject(byte[].class));
-    }
-
-    public PackageArchive(byte[] outerPackageFileBytes) {
-        this.outerPackageFileBytes = outerPackageFileBytes;
-        this.securityManager = SecurityManager.getInstance();
-        try {
-            handlerPair = CommonUtil.getFileContentMapFromOrchestrationCandidateZip(
-                outerPackageFileBytes);
-        } catch (final ZipException exception) {
-            LOG.error("Error reading files inside archive", exception);
-        }
-    }
-
-    /**
-     * Checks if package matches required format {package.csar/zip, package.cms, package.cert(optional)}
-     *
-     * @return true if structure matches sol004 option 2 structure
-     */
-    public boolean isSigned() {
-        return isPackageSizeMatches() && getSignatureFileName().isPresent();
-    }
-
-    /**
-     * Gets csar/zip package name with extension only if package is signed
-     *
-     * @return csar package name
-     */
-    public Optional<String> getArchiveFileName() {
-        if (isSigned()) {
-            return getFileByExtension(ALLOWED_ARCHIVE_EXTENSIONS);
-        }
-        return Optional.empty();
-    }
-
-    /**
-     * Gets csar/zip package content from zip archive
-     *
-     * @return csar package content
-     * @throws SecurityManagerException
-     */
-    public byte[] getPackageFileContents() throws SecurityManagerException {
-        try {
-            if (isSignatureValid()) {
-                return handlerPair.getKey().getFiles().get(getArchiveFileName().orElseThrow(CertificateException::new));
-            }
-        } catch (CertificateException exception) {
-            LOG.info("Error verifying signature ", exception);
-        }
-        return outerPackageFileBytes;
-    }
-
-    /**
-     * Validates package signature against trusted certificates
-     *
-     * @return true if signature verified
-     * @throws SecurityManagerException
-     */
-    public boolean isSignatureValid() throws SecurityManagerException {
-        if (signatureValid == null) {
-            final Map<String, byte[]> files = handlerPair.getLeft().getFiles();
-            final Optional<String> signatureFileName = getSignatureFileName();
-            final Optional<String> archiveFileName = getArchiveFileName();
-            if (files.isEmpty() || !signatureFileName.isPresent() || !archiveFileName.isPresent()) {
-                signatureValid = false;
-            } else {
-                final Optional<String> certificateFile = getCertificateFileName();
-                signatureValid = securityManager.verifySignedData(files.get(signatureFileName.get()),
-                    certificateFile.map(files::get).orElse(null), files.get(archiveFileName.get()));
-            }
-
-        }
-        return signatureValid;
-    }
-
-    private boolean isPackageSizeMatches() {
-        return handlerPair.getRight().isEmpty()
-            && (handlerPair.getLeft().getFiles().size() == NUMBER_OF_FILES_FOR_SIGNATURE_WITH_CERT_INSIDE
-            || handlerPair.getLeft().getFiles().size() == NUMBER_OF_FILES_FOR_SIGNATURE_WITHOUT_CERT_INSIDE);
-    }
-
-    private Optional<String> getSignatureFileName() {
-        return getFileByExtension(ALLOWED_SIGNATURE_EXTENSIONS);
-    }
-
-    private Optional<String> getFileByExtension(String[] extensions) {
-        for (String fileName : handlerPair.getLeft().getFileList()) {
-            for (String extension : extensions) {
-                if (extension.equalsIgnoreCase(FilenameUtils.getExtension(fileName))) {
-                    return Optional.of(fileName);
-                }
-            }
-        }
-        return Optional.empty();
-    }
-
-    private Optional<String> getCertificateFileName() {
-        Optional<String> certFileName = getFileByExtension(ALLOWED_CERTIFICATE_EXTENSIONS);
-        if (!certFileName.isPresent()) {
-            return Optional.empty();
-        }
-        String certNameWithoutExtension = FilenameUtils.removeExtension(certFileName.get());
-        if (certNameWithoutExtension.equals(FilenameUtils.removeExtension(getArchiveFileName().orElse("")))) {
-            return certFileName;
-        }
-        //cert file name should be the same as package name, e.g. vnfpackage.scar-->vnfpackage.cert
-        return Optional.empty();
-    }
-}
diff --git a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/main/java/org/openecomp/sdcrests/vsp/rest/services/OrchestrationTemplateCandidateImpl.java b/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/main/java/org/openecomp/sdcrests/vsp/rest/services/OrchestrationTemplateCandidateImpl.java
index 10f96e9d3b..e4262df105 100644
--- a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/main/java/org/openecomp/sdcrests/vsp/rest/services/OrchestrationTemplateCandidateImpl.java
+++ b/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/main/java/org/openecomp/sdcrests/vsp/rest/services/OrchestrationTemplateCandidateImpl.java
@@ -19,13 +19,11 @@
 
 package org.openecomp.sdcrests.vsp.rest.services;
 
-import static org.openecomp.core.utilities.file.FileUtils.getFileExtension;
-import static org.openecomp.core.utilities.file.FileUtils.getNetworkPackageName;
 import static org.openecomp.core.validation.errors.ErrorMessagesFormatBuilder.getErrorWithParameters;
 
 import java.io.IOException;
-import java.nio.ByteBuffer;
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -33,10 +31,8 @@ import java.util.Optional;
 import javax.activation.DataHandler;
 import javax.inject.Named;
 import javax.ws.rs.core.Response;
-import org.apache.commons.io.FilenameUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.cxf.jaxrs.ext.multipart.Attachment;
-import org.openecomp.core.utilities.orchestration.OnboardingTypesEnum;
 import org.openecomp.sdc.activitylog.ActivityLogManager;
 import org.openecomp.sdc.activitylog.ActivityLogManagerFactory;
 import org.openecomp.sdc.activitylog.dao.type.ActivityLogEntity;
@@ -52,8 +48,7 @@ import org.openecomp.sdc.vendorsoftwareproduct.OrchestrationTemplateCandidateMan
 import org.openecomp.sdc.vendorsoftwareproduct.VendorSoftwareProductManager;
 import org.openecomp.sdc.vendorsoftwareproduct.VspManagerFactory;
 import org.openecomp.sdc.vendorsoftwareproduct.dao.type.VspDetails;
-import org.openecomp.sdc.vendorsoftwareproduct.security.SecurityManagerException;
-import org.openecomp.sdc.vendorsoftwareproduct.types.OnboardPackage;
+import org.openecomp.sdc.vendorsoftwareproduct.impl.onboarding.OnboardingPackageProcessor;
 import org.openecomp.sdc.vendorsoftwareproduct.types.OnboardPackageInfo;
 import org.openecomp.sdc.vendorsoftwareproduct.types.OrchestrationTemplateActionResponse;
 import org.openecomp.sdc.vendorsoftwareproduct.types.UploadFileResponse;
@@ -65,7 +60,6 @@ import org.openecomp.sdcrests.vendorsoftwareproducts.types.OrchestrationTemplate
 import org.openecomp.sdcrests.vendorsoftwareproducts.types.UploadFileResponseDto;
 import org.openecomp.sdcrests.vendorsoftwareproducts.types.ValidationResponseDto;
 import org.openecomp.sdcrests.vsp.rest.OrchestrationTemplateCandidate;
-import org.openecomp.sdcrests.vsp.rest.data.PackageArchive;
 import org.openecomp.sdcrests.vsp.rest.mapping.MapFilesDataStructureToDto;
 import org.openecomp.sdcrests.vsp.rest.mapping.MapUploadFileResponseToUploadFileResponseDto;
 import org.openecomp.sdcrests.vsp.rest.mapping.MapValidationResponseToDto;
@@ -89,91 +83,41 @@ public class OrchestrationTemplateCandidateImpl implements OrchestrationTemplate
   public Response upload(final String vspId, final String versionId,
                          final Attachment fileToUpload, final String user) {
     final byte[] fileToUploadBytes = fileToUpload.getObject(byte[].class);
-    String fileToUploadName = "";
-    String fileToUploadExtension = "";
     final DataHandler dataHandler = fileToUpload.getDataHandler();
-    if(dataHandler != null) {
-      final String filename = dataHandler.getName();
-      fileToUploadName = FilenameUtils.removeExtension(filename);
-      fileToUploadExtension = FilenameUtils.getExtension(filename);
-    }
-    final PackageArchive archive = new PackageArchive(fileToUploadBytes);
-    final Optional<UploadFileResponseDto> validatePackageArchiveResponse =
-        validatePackageArchive(archive);
-    if (!validatePackageArchiveResponse.isPresent()) {
-      final VspDetails vspDetails = new VspDetails(vspId, new Version(versionId));
-      return processOnboardPackage(fileToUpload, fileToUploadBytes, fileToUploadName,
-          fileToUploadExtension, archive, vspDetails);
-    } else {
-      return Response.ok(validatePackageArchiveResponse.get()).build();
-    }
-  }
+    final String filename = dataHandler.getName();
 
-  private Optional<UploadFileResponseDto> validatePackageArchive(final PackageArchive archive) {
-    UploadFileResponseDto uploadFileResponseDto;
-    try {
-      if (archive.isSigned() && !archive.isSignatureValid()) {
-        final ErrorMessage errorMessage = new ErrorMessage(ErrorLevel.ERROR,
-            getErrorWithParameters(Messages.FAILED_TO_VERIFY_SIGNATURE.getErrorMessage(), ""));
-        LOGGER.error(errorMessage.getMessage());
-        uploadFileResponseDto = buildUploadResponseWithError(errorMessage);
-        //returning OK as SDC UI won't show error message if NOT OK error code.
-        return Optional.of(uploadFileResponseDto);
-      }
-    } catch (final SecurityManagerException e) {
-      final ErrorMessage errorMessage = new ErrorMessage(ErrorLevel.ERROR,
-          getErrorWithParameters(e.getMessage(), ""));
-      LOGGER.error(errorMessage.getMessage(), e);
-      uploadFileResponseDto = buildUploadResponseWithError(errorMessage);
-      //returning OK as SDC UI won't show error message if NOT OK error code.
-      return Optional.of(uploadFileResponseDto);
+    final OnboardingPackageProcessor onboardingPackageProcessor = new OnboardingPackageProcessor(filename, fileToUploadBytes);
+    if (onboardingPackageProcessor.hasErrors()) {
+      final UploadFileResponseDto uploadFileResponseDto =
+          buildUploadResponseWithError(onboardingPackageProcessor.getErrorMessageSet().toArray(new ErrorMessage[0]));
+      return Response.ok(uploadFileResponseDto).build();
     }
-    return Optional.empty();
-  }
 
-  private Response processOnboardPackage(final Attachment fileToUpload,
-                                         final byte[] fileToUploadBytes,
-                                         final String fileToUploadName,
-                                         final String fileToUploadExtension,
-                                         final PackageArchive archive,
-                                         final VspDetails vspDetails) {
-    final String filename = archive.getArchiveFileName()
-        .orElse(fileToUpload.getContentDisposition().getFilename());
-    UploadFileResponseDto uploadFileResponseDto;
-    try {
-      final String archiveFileExtension = getFileExtension(filename);
-      final OnboardPackageInfo onboardPackageInfo;
-      if (OnboardingTypesEnum.CSAR.toString().equalsIgnoreCase(archiveFileExtension)) {
-        final OnboardPackage onboardPackage = new OnboardPackage(getNetworkPackageName(filename),
-            archiveFileExtension, ByteBuffer.wrap(archive.getPackageFileContents()));
-        onboardPackageInfo = new OnboardPackageInfo(fileToUploadName,
-            fileToUploadExtension, ByteBuffer.wrap(fileToUploadBytes), onboardPackage);
-      } else {
-        onboardPackageInfo = new OnboardPackageInfo(fileToUploadName,
-            fileToUploadExtension, ByteBuffer.wrap(fileToUploadBytes));
-      }
-      final UploadFileResponse uploadFileResponse = candidateManager
-          .upload(vspDetails, onboardPackageInfo);
-      uploadFileResponseDto = new MapUploadFileResponseToUploadFileResponseDto()
-          .applyMapping(uploadFileResponse, UploadFileResponseDto.class);
+    final OnboardPackageInfo onboardPackageInfo = onboardingPackageProcessor.getOnboardPackageInfo().orElse(null);
 
-      return Response.ok(uploadFileResponseDto).build();
-    } catch (final SecurityManagerException e) {
-      final ErrorMessage errorMessage = new ErrorMessage(ErrorLevel.ERROR,
-          getErrorWithParameters(e.getMessage(), ""));
-      LOGGER.error(errorMessage.getMessage(), e);
-      uploadFileResponseDto = buildUploadResponseWithError(errorMessage);
-      //returning OK as SDC UI won't show error message if NOT OK error code.
+    if (onboardPackageInfo == null) {
+      final UploadFileResponseDto uploadFileResponseDto = buildUploadResponseWithError(
+          new ErrorMessage(ErrorLevel.ERROR, Messages.PACKAGE_PROCESS_ERROR.formatMessage(filename)));
       return Response.ok(uploadFileResponseDto).build();
     }
+
+    final VspDetails vspDetails = new VspDetails(vspId, new Version(versionId));
+    return processOnboardPackage(onboardPackageInfo, vspDetails);
   }
 
-  private UploadFileResponseDto buildUploadResponseWithError(ErrorMessage errorMessage) {
-    UploadFileResponseDto uploadFileResponseDto = new UploadFileResponseDto();
-    Map<String, List<ErrorMessage>> errorMap = new HashMap<>();
-    List<ErrorMessage> errorMessages = new ArrayList<>();
-    errorMessages.add(errorMessage);
-    errorMap.put(SdcCommon.UPLOAD_FILE, errorMessages);
+    private Response processOnboardPackage(final OnboardPackageInfo onboardPackageInfo, final VspDetails vspDetails) {
+        final UploadFileResponse uploadFileResponse = candidateManager.upload(vspDetails, onboardPackageInfo);
+        final UploadFileResponseDto uploadFileResponseDto = new MapUploadFileResponseToUploadFileResponseDto()
+            .applyMapping(uploadFileResponse, UploadFileResponseDto.class);
+        return Response.ok(uploadFileResponseDto).build();
+    }
+
+  private UploadFileResponseDto buildUploadResponseWithError(final ErrorMessage... errorMessages) {
+    final UploadFileResponseDto uploadFileResponseDto = new UploadFileResponseDto();
+    final Map<String, List<ErrorMessage>> errorMap = new HashMap<>();
+    final List<ErrorMessage> errorMessageList = new ArrayList<>();
+    Collections.addAll(errorMessageList, errorMessages);
+    errorMap.put(SdcCommon.UPLOAD_FILE, errorMessageList);
     uploadFileResponseDto.setErrors(errorMap);
     return uploadFileResponseDto;
   }
diff --git a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/java/org/openecomp/sdcrests/vsp/rest/data/PackageArchiveTest.java b/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/java/org/openecomp/sdcrests/vsp/rest/data/PackageArchiveTest.java
deleted file mode 100644
index 91a20bd57f..0000000000
--- a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/java/org/openecomp/sdcrests/vsp/rest/data/PackageArchiveTest.java
+++ /dev/null
@@ -1,119 +0,0 @@
-/*-
- * ============LICENSE_START=======================================================
- * SDC
- * ================================================================================
- * Copyright (C) 2019 AT&T Intellectual Property. All rights reserved.
- * ================================================================================
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *      http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ============LICENSE_END=========================================================
- */
-
-package org.openecomp.sdcrests.vsp.rest.data;
-
-import org.junit.Before;
-import org.junit.Test;
-import org.mockito.Mock;
-import org.openecomp.sdc.vendorsoftwareproduct.security.SecurityManager;
-import org.openecomp.sdc.vendorsoftwareproduct.security.SecurityManagerException;
-import org.powermock.reflect.Whitebox;
-
-import java.io.IOException;
-import java.net.URISyntaxException;
-import java.nio.file.Files;
-import java.nio.file.Paths;
-
-import static junit.framework.TestCase.assertTrue;
-import static org.junit.Assert.assertFalse;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.MockitoAnnotations.initMocks;
-import static org.powermock.api.mockito.PowerMockito.when;
-
-public class PackageArchiveTest {
-    private static final String BASE_DIR = "/vspmanager.csar/";
-
-    @Mock
-    SecurityManager manager;
-
-    @Before
-    public void setUp(){
-        initMocks(this);
-    }
-
-
-    @Test
-    public void isSignedTestCheckingWrongFile() throws IOException,
-            URISyntaxException {
-        PackageArchive packageArchive = getArchive("notCsar.txt");
-        assertFalse("2 or 3 files expected for signed package present or signature valid for " +
-                "empty file", packageArchive.isSigned());
-    }
-
-    @Test
-    public void isSignedTestWrongPackageStructure2EmptyDirInRoot() throws IOException,
-            URISyntaxException {
-        PackageArchive packageArchive = getArchive("signing/2-empty-directories-in-root.zip");
-        assertFalse(packageArchive.isSigned());
-    }
-
-    @Test
-    public void isSignedTestWrongPackageStructure2EmptyFilesAndEmptyDirInRoot() throws IOException,
-            URISyntaxException {
-        PackageArchive packageArchive = getArchive("signing/2-empty-files-1-empty-directory-in-root.zip");
-        assertFalse(packageArchive.isSigned());
-    }
-
-    @Test
-    public void isSignedTestWrongPackageStructure2EmptyFilesAndDirWithContentInRoot() throws IOException,
-            URISyntaxException {
-        PackageArchive packageArchive = getArchive("signing/2-empty-files-1-directory-with-contents-in-root.zip");
-        assertFalse(packageArchive.isSigned());
-    }
-
-    @Test
-    public void isSignedTestCorrectStructureNoSignature() throws IOException,
-            URISyntaxException {
-        PackageArchive packageArchive = getArchive("signing/2-files-in-root.zip");
-        assertFalse(packageArchive.isSigned());
-    }
-
-    @Test
-    public void isSignedTestCorrectStructureAndSignatureExists() throws IOException,
-            URISyntaxException {
-        PackageArchive packageArchive = getArchive("signing/csar-and-cms-in-root.zip");
-        assertTrue(packageArchive.isSigned());
-    }
-
-    @Test
-    public void isSignatureValidTestCorrectStructureAndValidSignatureExists() throws IOException,
-            URISyntaxException, SecurityManagerException {
-        PackageArchive packageArchive = getArchive("signing/signed-package.zip");
-        Whitebox.setInternalState(packageArchive, "securityManager", manager);
-        when(manager.verifySignedData(any(), any(), any())).thenReturn(true);
-        assertTrue("Signature invalid for signed package",
-                packageArchive.isSignatureValid());
-    }
-
-    @Test(expected = SecurityManagerException.class)
-    public void isSignatureValidTestCorrectStructureAndNotValidSignatureExists() throws IOException,
-            URISyntaxException, SecurityManagerException {
-        PackageArchive packageArchive = getArchive("signing/signed-package-tampered-data.zip");
-        Whitebox.setInternalState(packageArchive, "securityManager", manager);
-        when(manager.verifySignedData(any(), any(), any())).thenThrow(new SecurityManagerException("error!"));
-        packageArchive.isSignatureValid();
-    }
-
-    private PackageArchive getArchive(String path) throws URISyntaxException, IOException {
-        return new PackageArchive(Files.readAllBytes(Paths.get(
-                PackageArchiveTest.class.getResource(BASE_DIR + path).toURI())));
-    }
-}
diff --git a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/java/org/openecomp/sdcrests/vsp/rest/services/OrchestrationTemplateCandidateImplTest.java b/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/java/org/openecomp/sdcrests/vsp/rest/services/OrchestrationTemplateCandidateImplTest.java
index a9dfbb8449..589be207c1 100644
--- a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/java/org/openecomp/sdcrests/vsp/rest/services/OrchestrationTemplateCandidateImplTest.java
+++ b/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/java/org/openecomp/sdcrests/vsp/rest/services/OrchestrationTemplateCandidateImplTest.java
@@ -27,12 +27,12 @@ import static org.mockito.MockitoAnnotations.initMocks;
 import static org.powermock.api.mockito.PowerMockito.mock;
 import static org.powermock.api.mockito.PowerMockito.mockStatic;
 import static org.powermock.api.mockito.PowerMockito.when;
-import static org.powermock.api.mockito.PowerMockito.whenNew;
 
 import java.io.IOException;
 import java.util.Arrays;
 import java.util.Optional;
 import java.util.UUID;
+import javax.activation.DataHandler;
 import javax.ws.rs.core.Response;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.cxf.jaxrs.ext.multipart.Attachment;
@@ -52,7 +52,6 @@ import org.openecomp.sdc.vendorsoftwareproduct.OrchestrationTemplateCandidateMan
 import org.openecomp.sdc.vendorsoftwareproduct.OrchestrationTemplateCandidateManagerFactory;
 import org.openecomp.sdc.vendorsoftwareproduct.VendorSoftwareProductManager;
 import org.openecomp.sdc.vendorsoftwareproduct.VspManagerFactory;
-import org.openecomp.sdc.vendorsoftwareproduct.security.SecurityManagerException;
 import org.openecomp.sdc.vendorsoftwareproduct.types.OrchestrationTemplateActionResponse;
 import org.openecomp.sdc.vendorsoftwareproduct.types.UploadFileResponse;
 import org.openecomp.sdc.vendorsoftwareproduct.types.UploadFileStatus;
@@ -62,7 +61,6 @@ import org.openecomp.sdc.vendorsoftwareproduct.types.candidateheat.Module;
 import org.openecomp.sdcrests.vendorsoftwareproducts.types.FileDataStructureDto;
 import org.openecomp.sdcrests.vendorsoftwareproducts.types.OrchestrationTemplateActionResponseDto;
 import org.openecomp.sdcrests.vendorsoftwareproducts.types.UploadFileResponseDto;
-import org.openecomp.sdcrests.vsp.rest.data.PackageArchive;
 import org.powermock.core.classloader.annotations.PrepareForTest;
 import org.powermock.modules.junit4.PowerMockRunner;
 
@@ -78,8 +76,6 @@ public class OrchestrationTemplateCandidateImplTest {
     @Mock
     private VendorSoftwareProductManager vendorSoftwareProductManager;
     @Mock
-    private PackageArchive packageArchive;
-    @Mock
     private VspManagerFactory vspManagerFactory;
     @Mock
     private ActivityLogManager activityLogManager;
@@ -100,19 +96,15 @@ public class OrchestrationTemplateCandidateImplTest {
     public void setUp(){
         try {
             initMocks(this);
-            packageArchive = mock(PackageArchive.class);
             mockStatic(VspManagerFactory.class);
             when(VspManagerFactory.getInstance()).thenReturn(vspManagerFactory);
             when(vspManagerFactory.createInterface()).thenReturn(vendorSoftwareProductManager);
             mockStatic(ActivityLogManagerFactory.class);
             when(ActivityLogManagerFactory.getInstance()).thenReturn(activityLogManagerFactory);
             when(activityLogManagerFactory.createInterface()).thenReturn(activityLogManager);
-            whenNew(PackageArchive.class).withAnyArguments().thenReturn(packageArchive);
             mockStatic(OrchestrationTemplateCandidateManagerFactory.class);
             when(OrchestrationTemplateCandidateManagerFactory.getInstance()).thenReturn(orchestrationTemplateCandidateManagerFactory);
             when(orchestrationTemplateCandidateManagerFactory.createInterface()).thenReturn(candidateManager);
-            when(packageArchive.getArchiveFileName()).thenReturn(Optional.of("test"));
-            when(packageArchive.getPackageFileContents()).thenReturn(new byte[0]);
             UploadFileResponse uploadFileResponse = new UploadFileResponse();
             uploadFileResponse.setOnboardingType(OnboardingTypesEnum.ZIP);
             uploadFileResponse.setNetworkPackageName("test");
@@ -163,36 +155,34 @@ public class OrchestrationTemplateCandidateImplTest {
     }
 
     @Test
-    public void uploadSignedTest() throws SecurityManagerException {
-        when(packageArchive.isSigned()).thenReturn(true);
-        when(packageArchive.isSignatureValid()).thenReturn(true);
+    public void uploadSignedTest() {
         orchestrationTemplateCandidate = new OrchestrationTemplateCandidateImpl();
-        Response response = orchestrationTemplateCandidate.upload("1", "1", mockAttachment(), "1");
+        Response response = orchestrationTemplateCandidate.upload("1", "1", mockAttachment("filename.zip"), "1");
         assertEquals(Response.Status.OK.getStatusCode(), response.getStatus());
     }
 
     @Test
     public void uploadNotSignedTest(){
-        when(packageArchive.isSigned()).thenReturn(false);
         orchestrationTemplateCandidate = new OrchestrationTemplateCandidateImpl();
-        Response response = orchestrationTemplateCandidate.upload("1", "1", mockAttachment(), "1");
+        Response response = orchestrationTemplateCandidate.upload("1", "1", mockAttachment("filename.csar"), "1");
         assertEquals(Response.Status.OK.getStatusCode(), response.getStatus());
     }
 
-    private Attachment mockAttachment() {
+    private Attachment mockAttachment(final String fileName) {
         final Attachment attachment = mock(Attachment.class);
         when(attachment.getContentDisposition()).thenReturn(new ContentDisposition("test"));
+        final DataHandler dataHandler = mock(DataHandler.class);
+        when(dataHandler.getName()).thenReturn(fileName);
+        when(attachment.getDataHandler()).thenReturn(dataHandler);
         final byte[] bytes = "upload package Test".getBytes();
         when(attachment.getObject(ArgumentMatchers.any())).thenReturn(bytes);
         return attachment;
     }
 
     @Test
-    public void uploadSignNotValidTest() throws SecurityManagerException {
-        when(packageArchive.isSigned()).thenReturn(true);
-        when(packageArchive.isSignatureValid()).thenReturn(false);
+    public void uploadSignNotValidTest() {
         orchestrationTemplateCandidate = new OrchestrationTemplateCandidateImpl();
-        Response response = orchestrationTemplateCandidate.upload("1", "1", mockAttachment(), "1");
+        Response response = orchestrationTemplateCandidate.upload("1", "1", mockAttachment("filename.zip"), "1");
         assertEquals(Response.Status.OK.getStatusCode(), response.getStatus());
         assertFalse(((UploadFileResponseDto)response.getEntity()).getErrors().isEmpty());
     }
diff --git a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/notCsar.txt b/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/notCsar.txt
deleted file mode 100644
index e69de29bb2..0000000000
--- a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/notCsar.txt
+++ /dev/null
diff --git a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/2-empty-directories-in-root.zip b/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/2-empty-directories-in-root.zip
deleted file mode 100644
index d0f1fd09dc..0000000000
--- a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/2-empty-directories-in-root.zip
+++ /dev/null
diff --git a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/2-empty-files-1-directory-with-contents-in-root.zip b/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/2-empty-files-1-directory-with-contents-in-root.zip
deleted file mode 100644
index 0f10af262f..0000000000
--- a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/2-empty-files-1-directory-with-contents-in-root.zip
+++ /dev/null
diff --git a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/2-empty-files-1-empty-directory-in-root.zip b/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/2-empty-files-1-empty-directory-in-root.zip
deleted file mode 100644
index 6ded8b1d57..0000000000
--- a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/2-empty-files-1-empty-directory-in-root.zip
+++ /dev/null
diff --git a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/2-files-in-root.zip b/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/2-files-in-root.zip
deleted file mode 100644
index d1e80ae132..0000000000
--- a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/2-files-in-root.zip
+++ /dev/null
diff --git a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vnf-repository-rest-services/src/main/java/org/openecomp/sdcrests/vsp/rest/services/VnfPackageRepositoryImpl.java b/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vnf-repository-rest-services/src/main/java/org/openecomp/sdcrests/vsp/rest/services/VnfPackageRepositoryImpl.java
index 5bcd3d3a39..fe07f8a07f 100644
--- a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vnf-repository-rest-services/src/main/java/org/openecomp/sdcrests/vsp/rest/services/VnfPackageRepositoryImpl.java
+++ b/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vnf-repository-rest-services/src/main/java/org/openecomp/sdcrests/vsp/rest/services/VnfPackageRepositoryImpl.java
@@ -39,6 +39,7 @@ import javax.ws.rs.core.Link;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.UriBuilder;
 import org.onap.config.api.ConfigurationManager;
+import org.openecomp.core.utilities.orchestration.OnboardingTypesEnum;
 import org.openecomp.sdc.common.errors.CoreException;
 import org.openecomp.sdc.common.errors.ErrorCode;
 import org.openecomp.sdc.common.errors.ErrorCodeAndMessage;
@@ -141,8 +142,10 @@ public class VnfPackageRepositoryImpl implements VnfPackageRepository {
             final OrchestrationTemplateCandidateManager candidateManager =
                     OrchestrationTemplateCandidateManagerFactory.getInstance().createInterface();
             final String filename = formatFilename(csarId);
-            final OnboardPackageInfo onboardPackageInfo = new OnboardPackageInfo(getNetworkPackageName(filename),
-                getFileExtension(filename), ByteBuffer.wrap(payload));
+            final String fileExtension = getFileExtension(filename);
+            final OnboardPackageInfo onboardPackageInfo =
+                new OnboardPackageInfo(getNetworkPackageName(filename), fileExtension, ByteBuffer.wrap(payload),
+                    OnboardingTypesEnum.getOnboardingTypesEnum(fileExtension));
             final VspDetails vspDetails = new VspDetails(vspId, getVersion(vspId, versionId));
             final UploadFileResponse response = candidateManager.upload(vspDetails, onboardPackageInfo);
             final UploadFileResponseDto uploadFileResponse =
diff --git a/openecomp-be/backend/openecomp-sdc-validation-manager/src/main/java/org/openecomp/sdc/validation/util/ValidationManagerUtil.java b/openecomp-be/backend/openecomp-sdc-validation-manager/src/main/java/org/openecomp/sdc/validation/util/ValidationManagerUtil.java
index d1d61c66b3..6a7466d20d 100644
--- a/openecomp-be/backend/openecomp-sdc-validation-manager/src/main/java/org/openecomp/sdc/validation/util/ValidationManagerUtil.java
+++ b/openecomp-be/backend/openecomp-sdc-validation-manager/src/main/java/org/openecomp/sdc/validation/util/ValidationManagerUtil.java
@@ -43,7 +43,7 @@ public class ValidationManagerUtil {
    */
   public static void handleMissingManifest(FileContentHandler fileContentMap,
                                            Map<String, List<ErrorMessage>> errors) throws IOException {
-    try (InputStream manifest = fileContentMap.getFileContent(SdcCommon.MANIFEST_NAME)) {
+    try (InputStream manifest = fileContentMap.getFileContentAsStream(SdcCommon.MANIFEST_NAME)) {
       if (manifest == null) {
         ErrorMessage.ErrorMessageUtil.addMessage(SdcCommon.MANIFEST_NAME, errors)
                 .add(new ErrorMessage(ErrorLevel.ERROR, Messages.MANIFEST_NOT_EXIST.getErrorMessage()));
@@ -60,7 +60,7 @@ public class ValidationManagerUtil {
   public static ValidationManager initValidationManager(FileContentHandler fileContentMap) {
     ValidationManager validationManager = ValidationManagerFactory.getInstance().createInterface();
     fileContentMap.getFileList().forEach(fileName -> validationManager
-        .addFile(fileName, FileUtils.toByteArray(fileContentMap.getFileContent(fileName))));
+        .addFile(fileName, FileUtils.toByteArray(fileContentMap.getFileContentAsStream(fileName))));
     return validationManager;
   }
 }
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/exception/OnboardPackageException.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/exception/OnboardPackageException.java
new file mode 100644
index 0000000000..2e88357e0b
--- /dev/null
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/exception/OnboardPackageException.java
@@ -0,0 +1,27 @@
+/*
+ * ============LICENSE_START=======================================================
+ *  Copyright (C) 2019 Nordix Foundation
+ *  ================================================================================
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  SPDX-License-Identifier: Apache-2.0
+ *  ============LICENSE_END=========================================================
+ */
+
+package org.openecomp.sdc.vendorsoftwareproduct.exception;
+
+public class OnboardPackageException extends Exception {
+
+    public OnboardPackageException(final String s, final Throwable throwable) {
+        super(s, throwable);
+    }
+}
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/OrchestrationTemplateCandidateManagerImpl.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/OrchestrationTemplateCandidateManagerImpl.java
index d5d5c8045b..d4c7151c17 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/OrchestrationTemplateCandidateManagerImpl.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/OrchestrationTemplateCandidateManagerImpl.java
@@ -65,7 +65,7 @@ public class OrchestrationTemplateCandidateManagerImpl
                                    final OnboardPackageInfo onboardPackageInfo) {
     final OnboardPackage onboardPackage = onboardPackageInfo.getOnboardPackage();
     final OrchestrationTemplateFileHandler orchestrationTemplateFileHandler =
-        OrchestrationUploadFactory.createOrchestrationTemplateFileHandler(onboardPackage.getFileExtension());
+        OrchestrationUploadFactory.createOrchestrationTemplateFileHandler(onboardPackageInfo.getPackageType());
 
     final UploadFileResponse uploadFileResponse =
         orchestrationTemplateFileHandler.upload(vspDetails, onboardPackageInfo, candidateService);
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/onboarding/OnboardingPackageProcessor.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/onboarding/OnboardingPackageProcessor.java
new file mode 100644
index 0000000000..1d502547dc
--- /dev/null
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/onboarding/OnboardingPackageProcessor.java
@@ -0,0 +1,229 @@
+/*
+ * ============LICENSE_START=======================================================
+ *  Copyright (C) 2019 Nordix Foundation
+ *  ================================================================================
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  SPDX-License-Identifier: Apache-2.0
+ *  ============LICENSE_END=========================================================
+ */
+
+package org.openecomp.sdc.vendorsoftwareproduct.impl.onboarding;
+
+import static org.openecomp.sdc.common.errors.Messages.PACKAGE_EMPTY_ERROR;
+import static org.openecomp.sdc.common.errors.Messages.PACKAGE_INVALID_ERROR;
+import static org.openecomp.sdc.common.errors.Messages.PACKAGE_INVALID_EXTENSION;
+import static org.openecomp.sdc.common.errors.Messages.PACKAGE_MISSING_INTERNAL_PACKAGE;
+import static org.openecomp.sdc.common.errors.Messages.PACKAGE_PROCESS_ERROR;
+import static org.openecomp.sdc.common.errors.Messages.PACKAGE_PROCESS_INTERNAL_PACKAGE_ERROR;
+
+import com.google.common.collect.ImmutableSet;
+import java.nio.ByteBuffer;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import org.apache.commons.collections4.CollectionUtils;
+import org.apache.commons.collections4.MapUtils;
+import org.apache.commons.io.FilenameUtils;
+import org.openecomp.core.utilities.file.FileContentHandler;
+import org.openecomp.core.utilities.orchestration.OnboardingTypesEnum;
+import org.openecomp.sdc.common.zip.exception.ZipException;
+import org.openecomp.sdc.common.utils.CommonUtil;
+import org.openecomp.sdc.datatypes.error.ErrorLevel;
+import org.openecomp.sdc.datatypes.error.ErrorMessage;
+import org.openecomp.sdc.logging.api.Logger;
+import org.openecomp.sdc.logging.api.LoggerFactory;
+import org.openecomp.sdc.vendorsoftwareproduct.exception.OnboardPackageException;
+import org.openecomp.sdc.vendorsoftwareproduct.types.OnboardPackage;
+import org.openecomp.sdc.vendorsoftwareproduct.types.OnboardPackageInfo;
+import org.openecomp.sdc.vendorsoftwareproduct.types.OnboardSignedPackage;
+
+public class OnboardingPackageProcessor {
+    private static final Logger LOGGER = LoggerFactory.getLogger(OnboardingPackageProcessor.class);
+    private static final Set<String> ALLOWED_SIGNATURE_EXTENSIONS = ImmutableSet.of("cms");
+    private static final Set<String> ALLOWED_CERTIFICATE_EXTENSIONS = ImmutableSet.of("cert", "crt");
+    private static final String CSAR_EXTENSION = "csar";
+    private static final String ZIP_EXTENSION = "zip";
+
+    private final String packageFileName;
+    private final byte[] packageFileContent;
+    private FileContentHandler onboardPackageContentHandler;
+    private Set<ErrorMessage> errorMessageSet = new HashSet<>();
+    private OnboardPackageInfo onboardPackageInfo;
+
+    public OnboardingPackageProcessor(final String packageFileName, final byte[] packageFileContent) {
+        this.packageFileName = packageFileName;
+        this.packageFileContent = packageFileContent;
+        onboardPackageInfo = processPackage();
+    }
+
+    private OnboardPackageInfo processPackage() {
+        if (!hasValidExtension()) {
+            final String message = PACKAGE_INVALID_EXTENSION.formatMessage(packageFileName, String.join(", ", CSAR_EXTENSION, ZIP_EXTENSION));
+            reportError(ErrorLevel.ERROR, message);
+            return null;
+        }
+        try {
+            onboardPackageContentHandler = CommonUtil.getZipContent(packageFileContent);
+        } catch (final ZipException e) {
+            final String message = PACKAGE_PROCESS_ERROR.formatMessage(packageFileName);
+            LOGGER.error(message, e);
+            reportError(ErrorLevel.ERROR, message);
+            return null;
+        }
+        if (isPackageEmpty()) {
+            final String message = PACKAGE_EMPTY_ERROR.formatMessage(packageFileName);
+            reportError(ErrorLevel.ERROR, message);
+            return null;
+        }
+
+        final String packageName = FilenameUtils.getBaseName(packageFileName);
+        final String packageExtension = FilenameUtils.getExtension(packageFileName);
+
+        if (hasSignedPackageStructure()) {
+            return processSignedPackage(packageName, packageExtension);
+        } else {
+            final OnboardPackage onboardPackage = new OnboardPackage(packageName, packageExtension,
+                ByteBuffer.wrap(packageFileContent), onboardPackageContentHandler);
+            if (packageExtension.equalsIgnoreCase(CSAR_EXTENSION)) {
+                return new OnboardPackageInfo(onboardPackage, OnboardingTypesEnum.CSAR);
+            } else if (packageExtension.equalsIgnoreCase(ZIP_EXTENSION)) {
+                return new OnboardPackageInfo(onboardPackage, OnboardingTypesEnum.ZIP);
+            }
+        }
+
+        reportError(ErrorLevel.ERROR, PACKAGE_INVALID_ERROR.formatMessage(packageFileName));
+        return null;
+    }
+
+    private boolean hasValidExtension() {
+        final String packageExtension = FilenameUtils.getExtension(packageFileName);
+        return packageExtension.equalsIgnoreCase(CSAR_EXTENSION) || packageExtension.equalsIgnoreCase(ZIP_EXTENSION);
+    }
+
+    private OnboardPackageInfo processSignedPackage(final String packageName, final String packageExtension) {
+        final String internalPackagePath = findInternalPackagePath().orElse(null);
+        if (internalPackagePath == null) {
+            reportError(ErrorLevel.ERROR, PACKAGE_MISSING_INTERNAL_PACKAGE.getErrorMessage());
+            return null;
+        }
+        final String signatureFilePath = findSignatureFilePath().orElse(null);
+        final String certificateFilePath = findCertificateFilePath().orElse(null);
+        final OnboardSignedPackage onboardSignedPackage =
+            new OnboardSignedPackage(packageName, packageExtension, ByteBuffer.wrap(packageFileContent),
+                onboardPackageContentHandler, signatureFilePath, internalPackagePath, certificateFilePath);
+
+        final String internalPackageName = FilenameUtils.getName(internalPackagePath);
+        final String internalPackageBaseName = FilenameUtils.getBaseName(internalPackagePath);
+        final String internalPackageExtension = FilenameUtils.getExtension(internalPackagePath);
+        final byte[] internalPackageContent = onboardPackageContentHandler.getFileContent(internalPackagePath);
+
+        final OnboardPackage onboardPackage;
+        try {
+            onboardPackage = new OnboardPackage(internalPackageBaseName, internalPackageExtension,
+                internalPackageContent);
+        } catch (final OnboardPackageException e) {
+            final String message = PACKAGE_PROCESS_INTERNAL_PACKAGE_ERROR.formatMessage(internalPackageName);
+            LOGGER.error(message, e);
+            reportError(ErrorLevel.ERROR, message);
+            return null;
+        }
+
+        return new OnboardPackageInfo(onboardSignedPackage, onboardPackage, OnboardingTypesEnum.SIGNED_CSAR);
+    }
+
+    private void reportError(final ErrorLevel errorLevel, final String message) {
+        errorMessageSet.add(new ErrorMessage(errorLevel, message));
+    }
+
+    public boolean hasErrors() {
+        return !errorMessageSet.isEmpty();
+    }
+
+    public Set<ErrorMessage> getErrorMessageSet() {
+        return errorMessageSet;
+    }
+
+    private Optional<String> findInternalPackagePath() {
+        return onboardPackageContentHandler.getFileList().stream()
+            .filter(filePath -> {
+                    final String extension = FilenameUtils.getExtension(filePath);
+                    return CSAR_EXTENSION.equalsIgnoreCase(extension) || ZIP_EXTENSION.equalsIgnoreCase(extension);
+                }
+            )
+            .findFirst();
+    }
+
+    private boolean isPackageEmpty() {
+        return MapUtils.isEmpty(onboardPackageContentHandler.getFiles());
+    }
+
+    private boolean hasSignedPackageStructure() {
+        if (MapUtils.isEmpty(onboardPackageContentHandler.getFiles()) || !CollectionUtils.isEmpty(
+            onboardPackageContentHandler.getFolderList())) {
+            return false;
+        }
+        final int numberOfFiles = onboardPackageContentHandler.getFileList().size();
+        if (numberOfFiles == 2) {
+            return hasOneInternalPackageFile(onboardPackageContentHandler) &&
+                hasOneSignatureFile(onboardPackageContentHandler);
+        }
+
+        if (numberOfFiles == 3) {
+            return hasOneInternalPackageFile(onboardPackageContentHandler) &&
+                hasOneSignatureFile(onboardPackageContentHandler) &&
+                hasOneCertificateFile(onboardPackageContentHandler);
+        }
+
+        return false;
+    }
+
+    private boolean hasOneInternalPackageFile(final FileContentHandler fileContentHandler) {
+        return fileContentHandler.getFileList().parallelStream()
+            .map(FilenameUtils::getExtension)
+            .map(String::toLowerCase)
+            .filter(file -> file.endsWith(CSAR_EXTENSION)).count() == 1;
+    }
+
+    private boolean hasOneSignatureFile(final FileContentHandler fileContentHandler) {
+        return fileContentHandler.getFileList().parallelStream()
+            .map(FilenameUtils::getExtension)
+            .map(String::toLowerCase)
+            .filter(ALLOWED_SIGNATURE_EXTENSIONS::contains).count() == 1;
+    }
+
+    private boolean hasOneCertificateFile(final FileContentHandler fileContentHandler) {
+        return fileContentHandler.getFileList().parallelStream()
+            .map(FilenameUtils::getExtension)
+            .map(String::toLowerCase)
+            .filter(ALLOWED_CERTIFICATE_EXTENSIONS::contains).count() == 1;
+    }
+
+    private Optional<String> findSignatureFilePath() {
+        final Map<String, byte[]> files = onboardPackageContentHandler.getFiles();
+        return files.keySet().stream()
+            .filter(fileName -> ALLOWED_SIGNATURE_EXTENSIONS.contains(FilenameUtils.getExtension(fileName).toLowerCase()))
+            .findFirst();
+    }
+
+    private Optional<String> findCertificateFilePath() {
+        final Map<String, byte[]> files = onboardPackageContentHandler.getFiles();
+        return files.keySet().stream()
+            .filter(fileName -> ALLOWED_CERTIFICATE_EXTENSIONS.contains(FilenameUtils.getExtension(fileName).toLowerCase()))
+            .findFirst();
+    }
+
+    public Optional<OnboardPackageInfo> getOnboardPackageInfo() {
+        return Optional.ofNullable(onboardPackageInfo);
+    }
+}
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/BaseOrchestrationTemplateHandler.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/BaseOrchestrationTemplateHandler.java
index d87c9c8dbb..23cf41c5d5 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/BaseOrchestrationTemplateHandler.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/BaseOrchestrationTemplateHandler.java
@@ -20,16 +20,11 @@
 
 package org.openecomp.sdc.vendorsoftwareproduct.impl.orchestration;
 
-import static org.openecomp.core.validation.errors.ErrorMessagesFormatBuilder.getErrorWithParameters;
-
 import java.io.ByteArrayInputStream;
 import java.util.Optional;
 import org.apache.commons.collections4.MapUtils;
-import org.openecomp.core.utilities.file.FileContentHandler;
 import org.openecomp.core.utilities.orchestration.OnboardingTypesEnum;
-import org.openecomp.sdc.common.errors.Messages;
 import org.openecomp.sdc.common.utils.SdcCommon;
-import org.openecomp.sdc.datatypes.error.ErrorLevel;
 import org.openecomp.sdc.datatypes.error.ErrorMessage;
 import org.openecomp.sdc.logging.api.Logger;
 import org.openecomp.sdc.logging.api.LoggerFactory;
@@ -59,33 +54,25 @@ public abstract class BaseOrchestrationTemplateHandler implements OrchestrationT
       return uploadFileResponse;
     }
 
-    final Optional<FileContentHandler> optionalContentMap =
-        getFileContentMap(uploadFileResponse, fileContentByteArray);
-    if (!optionalContentMap.isPresent()) {
-      logger.error(getErrorWithParameters(Messages.FILE_CONTENT_MAP.getErrorMessage(),
-          getHandlerType().toString()));
-      uploadFileResponse.addStructureError(SdcCommon.UPLOAD_FILE, new ErrorMessage(ErrorLevel.ERROR,
-          getErrorWithParameters(Messages.FILE_CONTENT_MAP.getErrorMessage(),
-              getHandlerType().toString())));
-      return uploadFileResponse;
-    }
+    final UploadFileResponse validateResponse = validate(onboardPackageInfo);
 
-    if (!MapUtils.isEmpty(uploadFileResponse.getErrors())) {
+    if (!MapUtils.isEmpty(validateResponse.getErrors())) {
+      uploadFileResponse.addStructureErrors(validateResponse.getErrors());
       return uploadFileResponse;
     }
-    if (updateCandidateData(vspDetails, onboardPackageInfo, candidateService, uploadFileResponse,
-        optionalContentMap.get())) {
-      return uploadFileResponse;
+
+    final UploadFileResponse responseFromUpdate = updateCandidateData(vspDetails, onboardPackageInfo,
+        candidateService);
+    if (!MapUtils.isEmpty(responseFromUpdate.getErrors())) {
+      uploadFileResponse.addStructureErrors(responseFromUpdate.getErrors());
     }
-    return uploadFileResponse;
 
+    return uploadFileResponse;
   }
 
-  protected abstract boolean updateCandidateData(final VspDetails vspDetails,
+  protected abstract UploadFileResponse updateCandidateData(final VspDetails vspDetails,
                                                  final OnboardPackageInfo onboardPackageInfo,
-                                                 final CandidateService candidateService,
-                                                 final UploadFileResponse uploadFileResponse,
-                                                 final FileContentHandler contentMap);
+                                                 final CandidateService candidateService);
 
   private boolean isFileFileToUploadEmpty(final OnboardPackage onboardPackage,
                                           final UploadFileResponse uploadFileResponse,
@@ -114,9 +101,7 @@ public abstract class BaseOrchestrationTemplateHandler implements OrchestrationT
     return false;
   }
 
-  public abstract Optional<FileContentHandler> getFileContentMap(
-      UploadFileResponse uploadFileResponse,
-      byte[] uploadedFileData);
+  public abstract UploadFileResponse validate(final OnboardPackageInfo onboardPackageInfo);
 
   protected abstract OnboardingTypesEnum getHandlerType();
 }
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/OrchestrationTemplateCSARHandler.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/OrchestrationTemplateCSARHandler.java
index 8f0029aa83..16f12bb44d 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/OrchestrationTemplateCSARHandler.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/OrchestrationTemplateCSARHandler.java
@@ -23,79 +23,107 @@ package org.openecomp.sdc.vendorsoftwareproduct.impl.orchestration;
 import static org.openecomp.core.validation.errors.ErrorMessagesFormatBuilder.getErrorWithParameters;
 
 import java.io.IOException;
-import java.util.List;
 import java.util.Optional;
-import org.apache.commons.lang3.tuple.Pair;
 import org.openecomp.core.utilities.file.FileContentHandler;
 import org.openecomp.core.utilities.orchestration.OnboardingTypesEnum;
 import org.openecomp.sdc.common.errors.CoreException;
 import org.openecomp.sdc.common.errors.Messages;
-import org.openecomp.sdc.common.utils.CommonUtil;
 import org.openecomp.sdc.common.utils.SdcCommon;
-import org.openecomp.sdc.common.zip.exception.ZipException;
 import org.openecomp.sdc.datatypes.error.ErrorLevel;
 import org.openecomp.sdc.datatypes.error.ErrorMessage;
 import org.openecomp.sdc.vendorsoftwareproduct.dao.type.OrchestrationTemplateCandidateData;
 import org.openecomp.sdc.vendorsoftwareproduct.dao.type.VspDetails;
+import org.openecomp.sdc.vendorsoftwareproduct.impl.orchestration.csar.validation.CsarSecurityValidator;
 import org.openecomp.sdc.vendorsoftwareproduct.impl.orchestration.csar.validation.Validator;
 import org.openecomp.sdc.vendorsoftwareproduct.impl.orchestration.csar.validation.ValidatorFactory;
+import org.openecomp.sdc.vendorsoftwareproduct.security.SecurityManagerException;
 import org.openecomp.sdc.vendorsoftwareproduct.services.filedatastructuremodule.CandidateService;
 import org.openecomp.sdc.vendorsoftwareproduct.types.OnboardPackage;
 import org.openecomp.sdc.vendorsoftwareproduct.types.OnboardPackageInfo;
+import org.openecomp.sdc.vendorsoftwareproduct.types.OnboardSignedPackage;
 import org.openecomp.sdc.vendorsoftwareproduct.types.UploadFileResponse;
 
 public class OrchestrationTemplateCSARHandler extends BaseOrchestrationTemplateHandler
     implements OrchestrationTemplateFileHandler {
 
-  @Override
-  public Optional<FileContentHandler> getFileContentMap(UploadFileResponse uploadFileResponse,
-                                                        byte[] uploadedFileData) {
-    FileContentHandler contentMap = null;
-    List<String> folderList;
-    try {
-      Pair<FileContentHandler, List<String>> fileContentMapFromOrchestrationCandidateZip =
-          CommonUtil.getFileContentMapFromOrchestrationCandidateZip(uploadedFileData);
-      contentMap = fileContentMapFromOrchestrationCandidateZip.getKey();
-      folderList = fileContentMapFromOrchestrationCandidateZip.getRight();
-      Validator validator = ValidatorFactory.getValidator(contentMap);
-      uploadFileResponse.addStructureErrors(validator.validateContent(contentMap, folderList));
-    } catch (final ZipException | IOException exception) {
-      logger.error(exception.getMessage(), exception);
-      uploadFileResponse.addStructureError(
-          SdcCommon.UPLOAD_FILE,
-          new ErrorMessage(ErrorLevel.ERROR, Messages.INVALID_CSAR_FILE.getErrorMessage()));
-    } catch (CoreException coreException) {
-      logger.error(coreException.getMessage(), coreException);
-      uploadFileResponse.addStructureError(
-          SdcCommon.UPLOAD_FILE, new ErrorMessage(ErrorLevel.ERROR, coreException.getMessage()));
+    @Override
+    public UploadFileResponse validate(final OnboardPackageInfo onboardPackageInfo) {
+        final UploadFileResponse uploadFileResponse = new UploadFileResponse();
+        if (onboardPackageInfo.getPackageType() == OnboardingTypesEnum.SIGNED_CSAR) {
+            final OnboardSignedPackage originalOnboardPackage =
+                (OnboardSignedPackage) onboardPackageInfo.getOriginalOnboardPackage();
+            validatePackageSecurity(originalOnboardPackage).ifPresent(packageSignatureResponse -> {
+                if (packageSignatureResponse.hasErrors()) {
+                    uploadFileResponse.addStructureErrors(packageSignatureResponse.getErrors());
+                }
+            });
+
+            if (uploadFileResponse.hasErrors()) {
+                return uploadFileResponse;
+            }
+        }
+        final OnboardPackage onboardPackage = onboardPackageInfo.getOnboardPackage();
+        final FileContentHandler fileContentHandler = onboardPackage.getFileContentHandler();
+
+        try {
+            final Validator validator = ValidatorFactory.getValidator(fileContentHandler);
+            uploadFileResponse.addStructureErrors(validator.validateContent(fileContentHandler));
+        } catch (IOException exception) {
+            logger.error(exception.getMessage(), exception);
+            uploadFileResponse.addStructureError(
+                SdcCommon.UPLOAD_FILE,
+                new ErrorMessage(ErrorLevel.ERROR, Messages.INVALID_CSAR_FILE.getErrorMessage()));
+        } catch (CoreException coreException) {
+            logger.error(coreException.getMessage(), coreException);
+            uploadFileResponse.addStructureError(
+                SdcCommon.UPLOAD_FILE, new ErrorMessage(ErrorLevel.ERROR, coreException.getMessage()));
+        }
+
+        return uploadFileResponse;
     }
 
-    return Optional.ofNullable(contentMap);
-  }
+    private Optional<UploadFileResponse> validatePackageSecurity(final OnboardSignedPackage originalOnboardPackage) {
+        final UploadFileResponse uploadFileResponseDto = new UploadFileResponse();
+        try {
+            final CsarSecurityValidator csarSecurityValidator = new CsarSecurityValidator();
+            if (!csarSecurityValidator.verifyPackageSignature(originalOnboardPackage)) {
+                final ErrorMessage errorMessage = new ErrorMessage(ErrorLevel.ERROR,
+                    Messages.FAILED_TO_VERIFY_SIGNATURE.getErrorMessage());
+                logger.error(errorMessage.getMessage());
+                uploadFileResponseDto.addStructureError(SdcCommon.UPLOAD_FILE, errorMessage);
+                return Optional.of(uploadFileResponseDto);
+            }
+        } catch (final SecurityManagerException e) {
+            final ErrorMessage errorMessage = new ErrorMessage(ErrorLevel.ERROR, e.getMessage());
+            logger.error("Could not validate package signature {}", originalOnboardPackage.getFilename(), e);
+            uploadFileResponseDto.addStructureError(SdcCommon.UPLOAD_FILE, errorMessage);
+            return Optional.of(uploadFileResponseDto);
+        }
+        return Optional.empty();
+    }
 
-  @Override
-  protected boolean updateCandidateData(final VspDetails vspDetails,
-                                        final OnboardPackageInfo onboardPackageInfo,
-                                        final CandidateService candidateService,
-                                        final UploadFileResponse uploadFileResponse,
-                                        final FileContentHandler contentMap) {
-    try {
-      final OnboardPackage csarPackage = onboardPackageInfo.getOnboardPackage();
-      final OnboardPackage originalOnboardPackage = onboardPackageInfo.getOriginalOnboardPackage();
-      candidateService.updateCandidateUploadData(vspDetails.getId(), vspDetails.getVersion(),
-          new OrchestrationTemplateCandidateData(csarPackage.getFileContent(),
-              "", csarPackage.getFileExtension(),
-              csarPackage.getFilename(), originalOnboardPackage.getFilename(), originalOnboardPackage.getFileExtension(),
-              originalOnboardPackage.getFileContent()));
-    } catch (final Exception exception) {
-      logger.error(getErrorWithParameters(Messages.FILE_CONTENT_MAP.getErrorMessage(),
-          getHandlerType().toString()), exception);
-      uploadFileResponse.addStructureError(SdcCommon.UPLOAD_FILE,
-          new ErrorMessage(ErrorLevel.ERROR, exception.getMessage()));
-      return true;
+    @Override
+    protected UploadFileResponse updateCandidateData(final VspDetails vspDetails,
+                                                     final OnboardPackageInfo onboardPackageInfo,
+                                                     final CandidateService candidateService) {
+        final UploadFileResponse uploadFileResponse = new UploadFileResponse();
+        final OnboardPackage csarPackage = onboardPackageInfo.getOnboardPackage();
+        final OnboardPackage originalOnboardPackage = onboardPackageInfo.getOriginalOnboardPackage();
+        try {
+            candidateService.updateCandidateUploadData(vspDetails.getId(), vspDetails.getVersion(),
+                new OrchestrationTemplateCandidateData(csarPackage.getFileContent(),
+                    "", csarPackage.getFileExtension(),
+                    csarPackage.getFilename(), originalOnboardPackage.getFilename(),
+                    originalOnboardPackage.getFileExtension(),
+                    originalOnboardPackage.getFileContent()));
+        } catch (final Exception exception) {
+            logger.error(getErrorWithParameters(Messages.FILE_CONTENT_MAP.getErrorMessage(),
+                getHandlerType().toString()), exception);
+            uploadFileResponse.addStructureError(SdcCommon.UPLOAD_FILE,
+                new ErrorMessage(ErrorLevel.ERROR, exception.getMessage()));
+        }
+        return uploadFileResponse;
     }
-    return false;
-  }
 
   @Override
   protected OnboardingTypesEnum getHandlerType() {
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/OrchestrationTemplateZipHandler.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/OrchestrationTemplateZipHandler.java
index bc4fb668b0..056f1a4478 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/OrchestrationTemplateZipHandler.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/OrchestrationTemplateZipHandler.java
@@ -22,8 +22,6 @@ package org.openecomp.sdc.vendorsoftwareproduct.impl.orchestration;
 
 import static org.openecomp.core.validation.errors.ErrorMessagesFormatBuilder.getErrorWithParameters;
 
-import java.util.Optional;
-import org.openecomp.core.utilities.file.FileContentHandler;
 import org.openecomp.core.utilities.orchestration.OnboardingTypesEnum;
 import org.openecomp.sdc.common.errors.Messages;
 import org.openecomp.sdc.common.utils.SdcCommon;
@@ -40,24 +38,25 @@ import org.openecomp.sdc.vendorsoftwareproduct.types.UploadFileResponse;
 public class OrchestrationTemplateZipHandler extends BaseOrchestrationTemplateHandler
     implements OrchestrationTemplateFileHandler {
 
-  @Override
-  public Optional<FileContentHandler> getFileContentMap(UploadFileResponse uploadFileResponse,
-                                                        byte[] uploadedFileData) {
-    return OrchestrationUtil
-        .getFileContentMap(OnboardingTypesEnum.ZIP, uploadFileResponse, uploadedFileData);
-  }
+    @Override
+    public UploadFileResponse validate(final OnboardPackageInfo onboardPackageInfo) {
+        final UploadFileResponse uploadFileResponse = new UploadFileResponse();
+        final OnboardPackage onboardPackage = onboardPackageInfo.getOnboardPackage();
+        OrchestrationUtil
+            .getFileContentMap(OnboardingTypesEnum.ZIP, uploadFileResponse, onboardPackage.getFileContent().array());
+        return uploadFileResponse;
+    }
 
   @Override
-  protected boolean updateCandidateData(final VspDetails vspDetails,
+  protected UploadFileResponse updateCandidateData(final VspDetails vspDetails,
                                         final OnboardPackageInfo onboardPackageInfo,
-                                        final CandidateService candidateService,
-                                        final UploadFileResponse uploadFileResponse,
-                                        final FileContentHandler contentMap) {
+                                        final CandidateService candidateService) {
+    final UploadFileResponse uploadFileResponse = new UploadFileResponse();
     try {
       final OnboardPackage zipPackage = onboardPackageInfo.getOnboardPackage();
       final OrchestrationTemplateCandidateData candidateData =
           new CandidateEntityBuilder(candidateService)
-              .buildCandidateEntityFromZip(vspDetails, zipPackage.getFileContent().array(), contentMap,
+              .buildCandidateEntityFromZip(vspDetails, zipPackage.getFileContent().array(), zipPackage.getFileContentHandler(),
                   uploadFileResponse.getErrors());
       candidateData.setFileName(zipPackage.getFilename());
       candidateData.setFileSuffix(zipPackage.getFileExtension());
@@ -68,9 +67,8 @@ public class OrchestrationTemplateZipHandler extends BaseOrchestrationTemplateHa
           getHandlerType().toString()), exception);
       uploadFileResponse.addStructureError(SdcCommon.UPLOAD_FILE,
           new ErrorMessage(ErrorLevel.ERROR, exception.getMessage()));
-      return true;
     }
-    return false;
+    return uploadFileResponse;
   }
 
   @Override
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/OrchestrationUploadFactory.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/OrchestrationUploadFactory.java
index b1fb84c1f3..4b2decd412 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/OrchestrationUploadFactory.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/OrchestrationUploadFactory.java
@@ -19,6 +19,7 @@ package org.openecomp.sdc.vendorsoftwareproduct.impl.orchestration;
 import org.onap.config.api.Configuration;
 import org.onap.config.api.ConfigurationManager;
 import org.openecomp.core.utilities.CommonMethods;
+import org.openecomp.core.utilities.orchestration.OnboardingTypesEnum;
 import org.openecomp.sdc.common.errors.CoreException;
 import org.openecomp.sdc.datatypes.configuration.ImplementationConfiguration;
 import org.openecomp.sdc.vendorsoftwareproduct.dao.errors.OrchestrationTemplateFileExtensionErrorBuilder;
@@ -42,9 +43,9 @@ public class OrchestrationUploadFactory {
 
     }
 
-    public static OrchestrationTemplateFileHandler createOrchestrationTemplateFileHandler(String fileSuffix) {
-        String fileExtension = fileSuffix.toLowerCase();
-        ImplementationConfiguration orchestrationTemplateFileHandler = FILE_HANLDERS.get(fileExtension);
+    public static OrchestrationTemplateFileHandler createOrchestrationTemplateFileHandler(
+            final OnboardingTypesEnum onboardingType) {
+        final ImplementationConfiguration orchestrationTemplateFileHandler = FILE_HANLDERS.get(onboardingType.toString());
 
         if(Objects.isNull(orchestrationTemplateFileHandler)){
             throw new CoreException(new OrchestrationTemplateFileExtensionErrorBuilder
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/OrchestrationUtil.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/OrchestrationUtil.java
index 3dfe3a25c2..ef41262621 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/OrchestrationUtil.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/OrchestrationUtil.java
@@ -287,7 +287,7 @@ public class OrchestrationUtil {
                              FileContentHandler fileContentMap, HeatStructureTree tree) {
     Map<String, Object> manifestAsMap =
         fileContentMap.containsFile(SdcCommon.MANIFEST_NAME)
-            ? (Map<String, Object>) JsonUtil.json2Object(fileContentMap.getFileContent(
+            ? (Map<String, Object>) JsonUtil.json2Object(fileContentMap.getFileContentAsStream(
             SdcCommon.MANIFEST_NAME), Map.class)
             : new HashMap<>();
 
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/CsarSecurityValidator.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/CsarSecurityValidator.java
new file mode 100644
index 0000000000..0efe65b3b6
--- /dev/null
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/CsarSecurityValidator.java
@@ -0,0 +1,61 @@
+/*
+ * ============LICENSE_START=======================================================
+ *  Copyright (C) 2019 Nordix Foundation
+ *  ================================================================================
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  SPDX-License-Identifier: Apache-2.0
+ *  ============LICENSE_END=========================================================
+ */
+
+package org.openecomp.sdc.vendorsoftwareproduct.impl.orchestration.csar.validation;
+
+import java.util.Optional;
+import org.openecomp.core.utilities.file.FileContentHandler;
+import org.openecomp.sdc.vendorsoftwareproduct.security.SecurityManager;
+import org.openecomp.sdc.vendorsoftwareproduct.security.SecurityManagerException;
+import org.openecomp.sdc.vendorsoftwareproduct.types.OnboardSignedPackage;
+
+/**
+ * Validates the package security
+ */
+public class CsarSecurityValidator {
+
+    private SecurityManager securityManager = SecurityManager.getInstance();
+
+    public CsarSecurityValidator() {
+    }
+
+    //for tests purpose
+    CsarSecurityValidator(final SecurityManager securityManager) {
+        this.securityManager = securityManager;
+    }
+
+    /**
+     * Validates package signature against trusted certificates
+     *
+     * @return true if signature verified
+     * @throws SecurityManagerException when a certificate error occurs.
+     */
+    public boolean verifyPackageSignature(final OnboardSignedPackage signedPackage) throws SecurityManagerException {
+        final FileContentHandler fileContentHandler = signedPackage.getFileContentHandler();
+        final byte[] signatureBytes = fileContentHandler.getFileContent(signedPackage.getSignatureFilePath());
+        final byte[] archiveBytes = fileContentHandler.getFileContent(signedPackage.getInternalPackageFilePath());
+        byte[] certificateBytes = null;
+        final Optional<String> certificateFilePath = signedPackage.getCertificateFilePath();
+        if (certificateFilePath.isPresent()) {
+            certificateBytes = fileContentHandler.getFileContent(certificateFilePath.get());
+        }
+
+        return securityManager.verifySignedData(signatureBytes, certificateBytes, archiveBytes);
+    }
+}
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/ONAPCsarValidator.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/ONAPCsarValidator.java
index e5a06e5d42..ceee5facd0 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/ONAPCsarValidator.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/ONAPCsarValidator.java
@@ -20,6 +20,7 @@
 
 package org.openecomp.sdc.vendorsoftwareproduct.impl.orchestration.csar.validation;
 
+import java.util.Set;
 import org.openecomp.core.utilities.file.FileContentHandler;
 import org.openecomp.sdc.common.errors.Messages;
 import org.openecomp.sdc.common.utils.SdcCommon;
@@ -54,13 +55,13 @@ class ONAPCsarValidator implements Validator {
     private List<ErrorMessage> uploadFileErrors = new ArrayList<>();
 
     @Override
-    public Map<String, List<ErrorMessage>> validateContent(FileContentHandler contentHandler, List<String> folderList) {
+    public Map<String, List<ErrorMessage>> validateContent(final FileContentHandler contentHandler) {
 
         Map<String, List<ErrorMessage>> errors = new HashMap<>();
         validateManifest(contentHandler);
         validateMetadata(contentHandler);
         validateNoExtraFiles(contentHandler);
-        validateFolders(folderList);
+        validateFolders(contentHandler.getFolderList());
 
         if(uploadFileErrors == null || uploadFileErrors.isEmpty()){
             return errors;
@@ -71,7 +72,7 @@ class ONAPCsarValidator implements Validator {
 
     private void validateMetadata(FileContentHandler contentMap){
         if (!validateTOSCAYamlFileInRootExist(contentMap, MAIN_SERVICE_TEMPLATE_YAML_FILE_NAME)) {
-            try (InputStream metaFileContent = contentMap.getFileContent(TOSCA_META_PATH_FILE_NAME)) {
+            try (InputStream metaFileContent = contentMap.getFileContentAsStream(TOSCA_META_PATH_FILE_NAME)) {
 
                 ToscaMetadata onboardingToscaMetadata = OnboardingToscaMetadata.parseToscaMetadataFile(metaFileContent);
                 String entryDefinitionsPath = onboardingToscaMetadata.getMetaEntries().get(TOSCA_META_ENTRY_DEFINITIONS);
@@ -97,7 +98,7 @@ class ONAPCsarValidator implements Validator {
             return;
         }
 
-        try (InputStream fileContent = contentMap.getFileContent(MAIN_SERVICE_TEMPLATE_MF_FILE_NAME)) {
+        try (InputStream fileContent = contentMap.getFileContentAsStream(MAIN_SERVICE_TEMPLATE_MF_FILE_NAME)) {
 
             Manifest onboardingManifest = new ONAPManifestOnboarding();
             onboardingManifest.parse(fileContent);
@@ -122,7 +123,7 @@ class ONAPCsarValidator implements Validator {
         }
     }
 
-    private void validateFolders(List<String> folderList) {
+    private void validateFolders(Set<String> folderList) {
         List<String> filterResult =
                 folderList.stream().filter(this::filterFolders).collect(Collectors.toList());
         if (!filterResult.isEmpty()) {
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/SOL004MetaDirectoryValidator.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/SOL004MetaDirectoryValidator.java
index bed3a9b128..6274a54a58 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/SOL004MetaDirectoryValidator.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/SOL004MetaDirectoryValidator.java
@@ -83,14 +83,13 @@ class SOL004MetaDirectoryValidator implements Validator {
     private static final String MANIFEST_NON_MANO_SOURCE = "Non-MANO Source";
     private final List<ErrorMessage> errorsByFile = new ArrayList<>();
     private FileContentHandler contentHandler;
-    private List<String> folderList;
+    private Set<String> folderList;
     private ToscaMetadata toscaMetadata;
 
     @Override
-    public Map<String, List<ErrorMessage>> validateContent(final FileContentHandler contentHandler
-        , final List<String> folderList) {
+    public Map<String, List<ErrorMessage>> validateContent(final FileContentHandler contentHandler) {
         this.contentHandler = contentHandler;
-        this.folderList = folderList;
+        this.folderList = contentHandler.getFolderList();
         parseToscaMetadata();
         verifyMetadataFile();
         return Collections.unmodifiableMap(getAnyValidationErrors());
@@ -103,7 +102,7 @@ class SOL004MetaDirectoryValidator implements Validator {
         try {
             toscaMetadata =
                 OnboardingToscaMetadata
-                    .parseToscaMetadataFile(contentHandler.getFileContent(TOSCA_META_PATH_FILE_NAME));
+                    .parseToscaMetadataFile(contentHandler.getFileContentAsStream(TOSCA_META_PATH_FILE_NAME));
         } catch (final IOException e) {
             reportError(ErrorLevel.ERROR, Messages.METADATA_PARSER_INTERNAL.getErrorMessage());
             LOGGER.error(Messages.METADATA_PARSER_INTERNAL.getErrorMessage(), e.getMessage(), e);
@@ -198,7 +197,7 @@ class SOL004MetaDirectoryValidator implements Validator {
         final String manifestFile = toscaMetadata.getMetaEntries().get(TOSCA_META_ETSI_ENTRY_MANIFEST);
         if(verifyFileExists(contentHandler.getFileList(), manifestFile)){
             final Manifest onboardingManifest = new SOL004ManifestOnboarding();
-            onboardingManifest.parse(contentHandler.getFileContent(manifestFile));
+            onboardingManifest.parse(contentHandler.getFileContentAsStream(manifestFile));
             final Optional<ResourceTypeEnum> resourceType = onboardingManifest.getType();
             if (resourceType.isPresent() && resourceType.get() == ResourceTypeEnum.VF){
                 final String value = (String) entry.getValue();
@@ -250,7 +249,7 @@ class SOL004MetaDirectoryValidator implements Validator {
         final Set<String> existingFiles = contentHandler.getFileList();
         if (verifyFileExists(existingFiles, filePath)) {
             final Manifest onboardingManifest = new SOL004ManifestOnboarding();
-            onboardingManifest.parse(contentHandler.getFileContent(filePath));
+            onboardingManifest.parse(contentHandler.getFileContentAsStream(filePath));
             if (onboardingManifest.isValid()) {
                 try {
                     verifyManifestMetadata(onboardingManifest.getMetadata());
@@ -354,7 +353,7 @@ class SOL004MetaDirectoryValidator implements Validator {
             return;
         }
 
-        final InputStream fileContent = contentHandler.getFileContent(filePath);
+        final InputStream fileContent = contentHandler.getFileContentAsStream(filePath);
         if (fileContent == null) {
             reportError(ErrorLevel.ERROR, Messages.EMPTY_YAML_FILE_1.formatMessage(filePath));
             return;
@@ -397,7 +396,7 @@ class SOL004MetaDirectoryValidator implements Validator {
                     folderPath));
     }
 
-    private boolean verifyFoldersExist(final List<String> folderList, final String folderPath) {
+    private boolean verifyFoldersExist(final Set<String> folderList, final String folderPath) {
         return folderList.contains(folderPath + "/");
     }
 
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/Validator.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/Validator.java
index 927f3c0b69..34386b6d29 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/Validator.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/Validator.java
@@ -34,8 +34,7 @@ public interface Validator {
     /**
      *
      * @param contentHandler contains file and its data
-     * @param folderList folder structure inside the package
      * @return errors Map of errors that occur
      */
-    Map<String, List<ErrorMessage>> validateContent(FileContentHandler contentHandler, List<String> folderList);
+    Map<String, List<ErrorMessage>> validateContent(final FileContentHandler contentHandler);
 }
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/ValidatorFactory.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/ValidatorFactory.java
index bc44496fef..064a1c66ab 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/ValidatorFactory.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/ValidatorFactory.java
@@ -34,12 +34,12 @@ public class ValidatorFactory {
     /**
      * Returns a validator based on the contents of the csar package.
      *
-     * @param contentMap the csar package
+     * @param fileContentHandler the csar package
      * @return Validator based on the contents of the csar package provided
      * @throws IOException when metafile is invalid
      */
-    public static Validator getValidator(FileContentHandler contentMap) throws IOException{
+    public static Validator getValidator(final FileContentHandler fileContentHandler) throws IOException {
         ETSIService etsiService = new ETSIServiceImpl(null);
-        return etsiService.isSol004WithToscaMetaDirectory(contentMap) ? new SOL004MetaDirectoryValidator() : new ONAPCsarValidator();
+        return etsiService.isSol004WithToscaMetaDirectory(fileContentHandler) ? new SOL004MetaDirectoryValidator() : new ONAPCsarValidator();
     }
 }
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/process/OrchestrationTemplateProcessCsarHandler.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/process/OrchestrationTemplateProcessCsarHandler.java
index 31898d26ae..ac7a1510c7 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/process/OrchestrationTemplateProcessCsarHandler.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/process/OrchestrationTemplateProcessCsarHandler.java
@@ -67,6 +67,7 @@ public class OrchestrationTemplateProcessCsarHandler implements OrchestrationTem
   public OrchestrationTemplateActionResponse process(VspDetails vspDetails,
                                   OrchestrationTemplateCandidateData candidateData) {
 
+
     UploadFileResponse uploadFileResponse = new UploadFileResponse();
     Optional<FileContentHandler> fileContent = OrchestrationUtil
         .getFileContentMap(OnboardingTypesEnum.CSAR, uploadFileResponse,
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/security/SecurityManager.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/security/SecurityManager.java
index 90bfb67977..2928905603 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/security/SecurityManager.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/security/SecurityManager.java
@@ -61,7 +61,6 @@ import org.bouncycastle.cms.jcajce.JcaSimpleSignerInfoVerifierBuilder;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.bouncycastle.openssl.PEMParser;
 import org.bouncycastle.operator.OperatorCreationException;
-import org.bouncycastle.util.Store;
 import org.openecomp.sdc.logging.api.Logger;
 import org.openecomp.sdc.logging.api.LoggerFactory;
 
@@ -73,7 +72,6 @@ import org.openecomp.sdc.logging.api.LoggerFactory;
 public class SecurityManager {
 
     private static final String CERTIFICATE_DEFAULT_LOCATION = "cert";
-    private static SecurityManager INSTANCE = null;
 
     private Logger logger = LoggerFactory.getLogger(SecurityManager.class);
     private Set<X509Certificate> trustedCertificates = new HashSet<>();
@@ -90,10 +88,15 @@ public class SecurityManager {
     }
 
     public static SecurityManager getInstance() {
-        if (INSTANCE == null) {
-            INSTANCE = new SecurityManager();
-        }
-        return INSTANCE;
+        return SecurityManagerInstanceHolder.instance;
+    }
+
+    /**
+     * Initialization on demand class / synchronized singleton pattern.
+     */
+    private static class SecurityManagerInstanceHolder {
+
+        private static final SecurityManager instance = new SecurityManager();
     }
 
     /**
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/types/OnboardPackage.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/types/OnboardPackage.java
index b8ef598d65..60bd5ae0a0 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/types/OnboardPackage.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/types/OnboardPackage.java
@@ -21,6 +21,10 @@ package org.openecomp.sdc.vendorsoftwareproduct.types;
 
 import java.nio.ByteBuffer;
 import lombok.Getter;
+import org.openecomp.core.utilities.file.FileContentHandler;
+import org.openecomp.sdc.common.zip.exception.ZipException;
+import org.openecomp.sdc.common.utils.CommonUtil;
+import org.openecomp.sdc.vendorsoftwareproduct.exception.OnboardPackageException;
 
 @Getter
 public class OnboardPackage {
@@ -28,11 +32,30 @@ public class OnboardPackage {
     private final String filename;
     private final String fileExtension;
     private final ByteBuffer fileContent;
+    private final FileContentHandler fileContentHandler;
 
-    public OnboardPackage(final String filename, final String fileExtension, final ByteBuffer fileContent) {
+    public OnboardPackage(final String filename, final String fileExtension, final ByteBuffer fileContent,
+                          final FileContentHandler fileContentHandler) {
         this.filename = filename;
         this.fileExtension = fileExtension;
         this.fileContent = fileContent;
+        this.fileContentHandler = fileContentHandler;
     }
 
+    public OnboardPackage(final String filename, final String fileExtension, final ByteBuffer fileContent)
+        throws OnboardPackageException {
+        this.filename = filename;
+        this.fileExtension = fileExtension;
+        this.fileContent = fileContent;
+        try {
+            fileContentHandler = CommonUtil.getZipContent(fileContent.array());
+        } catch (final ZipException e) {
+            throw new OnboardPackageException("Could not read the package content", e);
+        }
+    }
+
+    public OnboardPackage(final String packageName, final String packageExtension, final byte[] packageContentBytes)
+        throws OnboardPackageException {
+        this(packageName, packageExtension, ByteBuffer.wrap(packageContentBytes));
+    }
 }
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/types/OnboardPackageInfo.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/types/OnboardPackageInfo.java
index 308db035db..6c35bd67d9 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/types/OnboardPackageInfo.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/types/OnboardPackageInfo.java
@@ -21,24 +21,32 @@ package org.openecomp.sdc.vendorsoftwareproduct.types;
 
 import java.nio.ByteBuffer;
 import lombok.Getter;
+import org.openecomp.core.utilities.orchestration.OnboardingTypesEnum;
+import org.openecomp.sdc.vendorsoftwareproduct.exception.OnboardPackageException;
 
 @Getter
 public class OnboardPackageInfo {
 
+    private final OnboardingTypesEnum packageType;
     private final OnboardPackage originalOnboardPackage;
     private final OnboardPackage onboardPackage;
 
-    public OnboardPackageInfo(final String filename,
-                              final String fileExtension,
-                              final ByteBuffer fileContent,
-                              final OnboardPackage onboardPackage) {
-        originalOnboardPackage = new OnboardPackage(filename, fileExtension, fileContent);
+    public OnboardPackageInfo(final OnboardPackage onboardPackage, final OnboardingTypesEnum packageType) {
+        this(onboardPackage, onboardPackage, packageType);
+    }
+
+    public OnboardPackageInfo(final OnboardPackage originalOnboardPackage,
+                              final OnboardPackage onboardPackage, final OnboardingTypesEnum packageType) {
+        this.packageType = packageType;
+        this.originalOnboardPackage = originalOnboardPackage;
         this.onboardPackage = onboardPackage;
     }
 
     public OnboardPackageInfo(final String filename,
                               final String fileExtension,
-                              final ByteBuffer fileContent) {
+                              final ByteBuffer fileContent,
+                              final OnboardingTypesEnum packageType) throws OnboardPackageException {
+        this.packageType = packageType;
         originalOnboardPackage = new OnboardPackage(filename, fileExtension, fileContent);
         this.onboardPackage = originalOnboardPackage;
     }
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/types/OnboardSignedPackage.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/types/OnboardSignedPackage.java
new file mode 100644
index 0000000000..a1436fcd2d
--- /dev/null
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/types/OnboardSignedPackage.java
@@ -0,0 +1,49 @@
+/*
+ * ============LICENSE_START=======================================================
+ *  Copyright (C) 2019 Nordix Foundation
+ *  ================================================================================
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  SPDX-License-Identifier: Apache-2.0
+ *  ============LICENSE_END=========================================================
+ */
+
+package org.openecomp.sdc.vendorsoftwareproduct.types;
+
+import java.nio.ByteBuffer;
+import java.util.Optional;
+import lombok.Getter;
+import org.apache.commons.lang3.StringUtils;
+import org.openecomp.core.utilities.file.FileContentHandler;
+
+@Getter
+public class OnboardSignedPackage extends OnboardPackage {
+    private String signatureFilePath;
+    private String internalPackageFilePath;
+    private String certificateFilePath;
+
+    public OnboardSignedPackage(final String filename, final String fileExtension, final ByteBuffer fileContent,
+                                final FileContentHandler fileContentHandler, final String signatureFilePath,
+                                final String internalPackageFilePath, final String certificateFilePath) {
+        super(filename, fileExtension, fileContent, fileContentHandler);
+        this.signatureFilePath = signatureFilePath;
+        this.internalPackageFilePath = internalPackageFilePath;
+        this.certificateFilePath = certificateFilePath;
+    }
+
+    public Optional<String> getCertificateFilePath() {
+        if (StringUtils.isEmpty(certificateFilePath)) {
+            return Optional.empty();
+        }
+        return Optional.of(certificateFilePath);
+    }
+}
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/types/UploadFileResponse.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/types/UploadFileResponse.java
index ca0eed2153..31bdf21884 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/types/UploadFileResponse.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/types/UploadFileResponse.java
@@ -21,6 +21,7 @@
 package org.openecomp.sdc.vendorsoftwareproduct.types;
 
 
+import org.apache.commons.collections4.MapUtils;
 import org.openecomp.core.utilities.orchestration.OnboardingTypesEnum;
 import org.openecomp.sdc.datatypes.error.ErrorLevel;
 import org.openecomp.sdc.datatypes.error.ErrorMessage;
@@ -109,4 +110,8 @@ public class UploadFileResponse {
   public Map<String, List<ErrorMessage>> getErrors() {
     return errors;
   }
+
+  public boolean hasErrors() {
+    return !MapUtils.isEmpty(errors);
+  }
 }
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/resources/config-orchestration.json b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/resources/config-orchestration.json
index b3147eb3af..2477eab5f6 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/resources/config-orchestration.json
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/main/resources/config-orchestration.json
@@ -7,6 +7,10 @@
     "csar": {
       "enable": true,
       "implementationClass": "org.openecomp.sdc.vendorsoftwareproduct.impl.orchestration.OrchestrationTemplateCSARHandler"
+    },
+    "signed-csar": {
+      "enable": true,
+      "implementationClass": "org.openecomp.sdc.vendorsoftwareproduct.impl.orchestration.OrchestrationTemplateCSARHandler"
     }
   },
   "process_impl": {
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/QuestionnaireDataServiceTest.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/QuestionnaireDataServiceTest.java
index b922da9b46..c17c33142c 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/QuestionnaireDataServiceTest.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/QuestionnaireDataServiceTest.java
@@ -38,6 +38,7 @@ import org.openecomp.sdc.datatypes.error.ErrorLevel;
 import org.openecomp.sdc.logging.api.Logger;
 import org.openecomp.sdc.logging.api.LoggerFactory;
 import org.openecomp.sdc.vendorsoftwareproduct.dao.type.VspDetails;
+import org.openecomp.sdc.vendorsoftwareproduct.exception.OnboardPackageException;
 import org.openecomp.sdc.vendorsoftwareproduct.impl.OrchestrationTemplateCandidateManagerImpl;
 import org.openecomp.sdc.vendorsoftwareproduct.informationArtifact.InformationArtifactData;
 import org.openecomp.sdc.vendorsoftwareproduct.questionnaire.QuestionnaireDataService;
@@ -72,7 +73,7 @@ public class QuestionnaireDataServiceTest {
   }
 
   // TODO: 3/15/2017 fix and enable   //@Test
-  public void testQuestionnaireDataAfterLegalUploadWithComposition() throws IOException {
+  public void testQuestionnaireDataAfterLegalUploadWithComposition() throws IOException, OnboardPackageException {
     InformationArtifactData informationArtifactData =
         uploadFileAndValidateInformationArtifactData("/fullComposition", 5);
 
@@ -81,15 +82,15 @@ public class QuestionnaireDataServiceTest {
 
 
   // TODO: 3/15/2017 fix and enable   //@Test
-  public void testQuestionnaireDataAfterLegalUploadEmptyComposition() throws IOException {
+  public void testQuestionnaireDataAfterLegalUploadEmptyComposition() throws IOException, OnboardPackageException {
     uploadFileAndValidateInformationArtifactData("/emptyComposition", 0);
   }
 
 
   // TODO: 3/15/2017 fix and enable   //@Test
-  public void testQuestionnaireDataAfterIllegalUpload() throws IOException {
+  public void testQuestionnaireDataAfterIllegalUpload() throws IOException, OnboardPackageException {
     try (InputStream zipInputStream = uploadFileTest.getZipInputStream("/missingYml")) {
-      onboardPackageInfo = new OnboardPackageInfo("missingYml", CSAR, convertFileInputStream(zipInputStream));
+      onboardPackageInfo = new OnboardPackageInfo("missingYml", CSAR, convertFileInputStream(zipInputStream), OnboardingTypesEnum.CSAR);
       UploadFileResponse uploadFileResponse =
               candidateManager.upload(vspDetails, onboardPackageInfo);
     }
@@ -100,11 +101,11 @@ public class QuestionnaireDataServiceTest {
 
   private InformationArtifactData uploadFileAndValidateInformationArtifactData(final String filePath,
                                                                                final int listSizeToCheck)
-      throws IOException {
+      throws IOException, OnboardPackageException {
 
     try (final InputStream zipInputStream = uploadFileTest.getZipInputStream(filePath)) {
       onboardPackageInfo = new OnboardPackageInfo("file", OnboardingTypesEnum.CSAR.toString(),
-          convertFileInputStream(zipInputStream));
+          convertFileInputStream(zipInputStream), OnboardingTypesEnum.CSAR);
       final UploadFileResponse uploadFileResponse = candidateManager.upload(vspDetails, onboardPackageInfo);
       candidateManager.process(vspId, VERSION);
 
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/impl/onboarding/OnboardingPackageProcessorTest.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/impl/onboarding/OnboardingPackageProcessorTest.java
new file mode 100644
index 0000000000..a62aea761a
--- /dev/null
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/impl/onboarding/OnboardingPackageProcessorTest.java
@@ -0,0 +1,120 @@
+/*
+ * ============LICENSE_START=======================================================
+ *  Copyright (C) 2019 Nordix Foundation
+ *  ================================================================================
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  SPDX-License-Identifier: Apache-2.0
+ *  ============LICENSE_END=========================================================
+ */
+
+package org.openecomp.sdc.vendorsoftwareproduct.impl.onboarding;
+
+import static org.hamcrest.Matchers.containsInAnyOrder;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.junit.Assert.assertThat;
+import static org.junit.Assert.fail;
+import static org.openecomp.sdc.common.errors.Messages.PACKAGE_EMPTY_ERROR;
+import static org.openecomp.sdc.common.errors.Messages.PACKAGE_INVALID_EXTENSION;
+
+import com.google.common.collect.ImmutableSet;
+import java.io.IOException;
+import java.net.URISyntaxException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Set;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+import org.junit.runners.Parameterized.Parameters;
+import org.openecomp.core.utilities.orchestration.OnboardingTypesEnum;
+import org.openecomp.sdc.datatypes.error.ErrorLevel;
+import org.openecomp.sdc.datatypes.error.ErrorMessage;
+import org.openecomp.sdc.vendorsoftwareproduct.types.OnboardPackageInfo;
+
+@RunWith(Parameterized.class)
+public class OnboardingPackageProcessorTest {
+    private static final String BASE_DIR = "/vspmanager.csar/";
+    private final String packageName;
+    private final byte[] packageBytes;
+    private final Set<ErrorMessage> expectedErrorSet;
+    private final OnboardingTypesEnum expectedPackageType;
+
+    public OnboardingPackageProcessorTest(final String packageName, final byte[] packageBytes,
+                                          final Set<ErrorMessage> expectedErrorSet,
+                                          final OnboardingTypesEnum expectedPackageType) {
+        this.packageName = packageName;
+        this.packageBytes = packageBytes;
+        this.expectedErrorSet = expectedErrorSet;
+        this.expectedPackageType = expectedPackageType;
+    }
+
+    @Parameters(name = "Run {index} for {0}")
+    public static Collection<Object[]> data() {
+        return Arrays.asList(new Object[][]{
+            {"emptyPackage.csar", new byte[0],
+                ImmutableSet.of(
+                    new ErrorMessage(ErrorLevel.ERROR, PACKAGE_EMPTY_ERROR.formatMessage("emptyPackage.csar"))
+                ), null},
+
+            {"notCsar.txt", getFileBytes("notCsar.txt"),
+                ImmutableSet.of(
+                    new ErrorMessage(ErrorLevel.ERROR,
+                        PACKAGE_INVALID_EXTENSION.formatMessage("notCsar.txt", "csar, zip"))
+                ), null},
+
+            {"signed-package.zip", getFileBytes("signing/signed-package.zip"), Collections.emptySet(),
+                OnboardingTypesEnum.SIGNED_CSAR},
+
+            {"csar-and-cms-in-root.zip", getFileBytes("signing/csar-and-cms-in-root.zip"), Collections.emptySet(),
+                OnboardingTypesEnum.SIGNED_CSAR},
+
+            {"successfulUpload.csar", getFileBytes("successfulUpload.csar"), Collections.emptySet(),
+                OnboardingTypesEnum.CSAR},
+
+            {"fakeNonSignedZipPackage.zip", getFileBytes("signing/fakeNonSignedZipPackage.zip"), Collections.emptySet(),
+                OnboardingTypesEnum.ZIP}
+        });
+    }
+
+    @Test
+    public void processPackage() {
+        final OnboardingPackageProcessor onboardingPackageProcessor = new OnboardingPackageProcessor(packageName, packageBytes);
+        assertThat("Should contains errors", onboardingPackageProcessor.hasErrors(), is(!expectedErrorSet.isEmpty()));
+        assertThat("Should have the same number of errors", onboardingPackageProcessor.getErrorMessageSet().size(), equalTo(expectedErrorSet.size()));
+        if (expectedErrorSet.size() > 0) {
+            assertThat("Should have the expected errors", onboardingPackageProcessor.getErrorMessageSet(), containsInAnyOrder(expectedErrorSet.toArray()));
+            return;
+        }
+        final OnboardPackageInfo onboardPackageInfo = onboardingPackageProcessor.getOnboardPackageInfo().orElse(null);
+        assertThat("Should build onboardPackageInfo", onboardPackageInfo, is(notNullValue()));
+        assertThat("Should have the expected package type", onboardPackageInfo.getPackageType(), is(equalTo(expectedPackageType)));
+    }
+
+    private static byte[] getFileBytes(final String filePath) {
+        final Path path = Paths.get(BASE_DIR, filePath);
+        try {
+            return Files.readAllBytes(Paths.get(
+                OnboardingPackageProcessorTest.class.getResource(path.toString()).toURI()));
+        } catch (final IOException | URISyntaxException e) {
+            fail(String.format("Could not load file %s", path.toString()));
+        }
+        return null;
+    }
+
+}
\ No newline at end of file
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/CsarSecurityValidatorTest.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/CsarSecurityValidatorTest.java
new file mode 100644
index 0000000000..0fce606052
--- /dev/null
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/CsarSecurityValidatorTest.java
@@ -0,0 +1,99 @@
+/*
+ * ============LICENSE_START=======================================================
+ *  Copyright (C) 2019 Nordix Foundation
+ *  ================================================================================
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  SPDX-License-Identifier: Apache-2.0
+ *  ============LICENSE_END=========================================================
+ */
+
+package org.openecomp.sdc.vendorsoftwareproduct.impl.orchestration.csar.validation;
+
+import static org.hamcrest.core.Is.is;
+import static org.junit.Assert.assertThat;
+import static org.junit.Assert.fail;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.when;
+import static org.mockito.MockitoAnnotations.initMocks;
+
+import java.io.IOException;
+import java.net.URISyntaxException;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mock;
+import org.openecomp.sdc.vendorsoftwareproduct.impl.onboarding.OnboardingPackageProcessor;
+import org.openecomp.sdc.vendorsoftwareproduct.security.SecurityManager;
+import org.openecomp.sdc.vendorsoftwareproduct.security.SecurityManagerException;
+import org.openecomp.sdc.vendorsoftwareproduct.types.OnboardPackageInfo;
+import org.openecomp.sdc.vendorsoftwareproduct.types.OnboardSignedPackage;
+
+public class CsarSecurityValidatorTest {
+
+    private static final String BASE_DIR = "/vspmanager.csar/";
+    private CsarSecurityValidator csarSecurityValidator;
+    @Mock
+    SecurityManager securityManager;
+
+    @Before
+    public void setUp() {
+        initMocks(this);
+        csarSecurityValidator = new CsarSecurityValidator(securityManager);
+    }
+
+    @Test
+    public void isSignatureValidTestCorrectStructureAndValidSignatureExists() throws SecurityManagerException {
+        final byte[] packageBytes = getFileBytesOrFail("signing/signed-package.zip");
+        final OnboardSignedPackage onboardSignedPackage = loadSignedPackage("signed-package.zip",
+            packageBytes);
+        when(securityManager.verifySignedData(any(), any(), any())).thenReturn(true);
+        final boolean isSignatureValid = csarSecurityValidator.verifyPackageSignature(onboardSignedPackage);
+        assertThat("Signature should be valid", isSignatureValid, is(true));
+    }
+
+    @Test(expected = SecurityManagerException.class)
+    public void isSignatureValidTestCorrectStructureAndNotValidSignatureExists() throws SecurityManagerException {
+        final byte[] packageBytes = getFileBytesOrFail("signing/signed-package-tampered-data.zip");
+        final OnboardSignedPackage onboardSignedPackage = loadSignedPackage("signed-package-tampered-data.zip",
+            packageBytes);
+        //no mocked securityManager
+        csarSecurityValidator = new CsarSecurityValidator();
+        csarSecurityValidator.verifyPackageSignature(onboardSignedPackage);
+    }
+
+    private byte[] getFileBytesOrFail(final String path) {
+        try {
+            return getFileBytes(path);
+        } catch (final URISyntaxException | IOException e) {
+            fail("Could not load file " + path);
+            return null;
+        }
+    }
+
+    private byte[] getFileBytes(final String path) throws URISyntaxException, IOException {
+        return Files.readAllBytes(Paths.get(
+            CsarSecurityValidatorTest.class.getResource(BASE_DIR + path).toURI()));
+    }
+
+    private OnboardSignedPackage loadSignedPackage(final String packageName, final byte[] packageBytes) {
+        final OnboardingPackageProcessor onboardingPackageProcessor =
+            new OnboardingPackageProcessor(packageName, packageBytes);
+        final OnboardPackageInfo onboardPackageInfo = onboardingPackageProcessor.getOnboardPackageInfo().orElse(null);
+        if (onboardPackageInfo == null) {
+            fail("Unexpected error. Could not load original package");
+        }
+
+        return (OnboardSignedPackage) onboardPackageInfo.getOriginalOnboardPackage();
+    }
+}
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/ONAPCsarValidatorTest.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/ONAPCsarValidatorTest.java
index 6dc8e1a5c6..799e0cc342 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/ONAPCsarValidatorTest.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/ONAPCsarValidatorTest.java
@@ -37,14 +37,11 @@ public class ONAPCsarValidatorTest {
 
     private ONAPCsarValidator onapCsarValidator;
     private FileContentHandler contentHandler;
-    private List<String> folderList;
 
     @Before
     public void setUp() throws IOException{
         onapCsarValidator = new ONAPCsarValidator();
         contentHandler = new FileContentHandler();
-        folderList = new ArrayList<>();
-
         contentHandler.addFile("TOSCA-Metadata/TOSCA.meta", ValidatorUtil.getFileResource("/validation.files/metafile/nonSOL004WithMetaDirectoryCompliantMetaFile.meta"));
         contentHandler.addFile("MainServiceTemplate.mf", ValidatorUtil.getFileResource("/validation.files/manifest/sampleManifest.mf"));
         contentHandler.addFile(TestConstants.TOSCA_DEFINITION_FILEPATH, ValidatorUtil.getFileResource(TestConstants.SAMPLE_DEFINITION_FILE_PATH));
@@ -53,7 +50,7 @@ public class ONAPCsarValidatorTest {
     @Test
     public void testGivenCSARPackage_withValidContent_thenNoErrorsReturned() {
         assertExpectedErrors("Valid CSAR Package should have 0 errors",
-                onapCsarValidator.validateContent(contentHandler, folderList), 0);
+                onapCsarValidator.validateContent(contentHandler), 0);
     }
 
     @Test
@@ -63,23 +60,21 @@ public class ONAPCsarValidatorTest {
         contentHandler.addFile("MainServiceTemplate.mf", ValidatorUtil.getFileResource("/validation.files/manifest/invalidManifest.mf"));
         contentHandler.addFile(TestConstants.TOSCA_DEFINITION_FILEPATH, ValidatorUtil.getFileResource(TestConstants.SAMPLE_DEFINITION_FILE_PATH));
 
-        assertExpectedErrors("CSAR package with invalid manifest file should have errors", onapCsarValidator.validateContent(contentHandler, folderList), 1);
+        assertExpectedErrors("CSAR package with invalid manifest file should have errors", onapCsarValidator.validateContent(contentHandler), 1);
 
     }
 
     @Test
     public void testGivenCSARPackage_withUnwantedFolders_thenErrorsReturned(){
-
-        folderList.add("Files/");
-        assertExpectedErrors("CSAR package with unwanted folders should fail with errors", onapCsarValidator.validateContent(contentHandler, folderList), 1);
+        contentHandler.addFolder("Files/");
+        assertExpectedErrors("CSAR package with unwanted folders should fail with errors", onapCsarValidator.validateContent(contentHandler), 1);
     }
 
     @Test
     public void testGivenCSARPackage_withUnwantedFiles_thenErrorsReturned(){
-
         contentHandler.addFile("ExtraFile.text", "".getBytes());
         assertExpectedErrors("CSAR package with unwanted files should fail with errors",
-                onapCsarValidator.validateContent(contentHandler, folderList), 1);
+                onapCsarValidator.validateContent(contentHandler), 1);
     }
 
     private void assertExpectedErrors( String testCase, Map<String, List<ErrorMessage>> errors, int expectedErrors){
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/SOL004MetaDirectoryValidatorTest.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/SOL004MetaDirectoryValidatorTest.java
index 2e0fd8643a..17b06793a2 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/SOL004MetaDirectoryValidatorTest.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/impl/orchestration/csar/validation/SOL004MetaDirectoryValidatorTest.java
@@ -100,7 +100,7 @@ public class SOL004MetaDirectoryValidatorTest {
         handler.addFile(TOSCA_META_PATH_FILE_NAME, metaFileWithInvalidEntry.getBytes(StandardCharsets.UTF_8));
         handler.addFile(TOSCA_DEFINITION_FILEPATH, getResourceBytes(SAMPLE_DEFINITION_FILE_PATH));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertExpectedErrors("TOSCA Meta file with no entries", errors, 1);
     }
 
@@ -110,9 +110,8 @@ public class SOL004MetaDirectoryValidatorTest {
         final String entryTestFilePath = "Files/Tests";
         final String entryLicenseFilePath = "Files/Licenses";
 
-        final List<String> folderList = new ArrayList<>();
-        folderList.add("Files/Tests/");
-        folderList.add("Files/Licenses/");
+        handler.addFolder("Files/Tests/");
+        handler.addFolder("Files/Licenses/");
 
         metaFile = metaFile +
                 TOSCA_META_ETSI_ENTRY_TESTS + ATTRIBUTE_VALUE_SEPARATOR.getToken() + entryTestFilePath + "\n" +
@@ -138,7 +137,7 @@ public class SOL004MetaDirectoryValidatorTest {
 
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, folderList);
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertEquals(0, errors.size());
     }
 
@@ -147,7 +146,7 @@ public class SOL004MetaDirectoryValidatorTest {
         metaFile = "Entry-Events: Definitions/events.log";
 
         handler.addFile(TOSCA_META_PATH_FILE_NAME, metaFile.getBytes(StandardCharsets.UTF_8));
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         List<ErrorMessage> errorMessages = errors.get(SdcCommon.UPLOAD_FILE);
         assertTrue(errors.size() == 1 && errorMessages.size() == 1);
         assertSame(ErrorLevel.ERROR, errorMessages.get(0).getLevel());
@@ -180,7 +179,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertExpectedErrors("Invalid TOSCA-Meta-File-Version and CSAR-Version attributes", errors, 2);
     }
 
@@ -188,7 +187,7 @@ public class SOL004MetaDirectoryValidatorTest {
     public void testGivenTOSCAMetaFile_withNonExistentFileReferenced_thenErrorsReturned() {
         handler.addFile(TOSCA_META_PATH_FILE_NAME, metaFile.getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         List<ErrorMessage> errorMessages = errors.get(SdcCommon.UPLOAD_FILE);
         assertTrue(errors.size() == 1 && errorMessages.size() == 3);
     }
@@ -217,7 +216,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertEquals(0, errors.size());
     }
 
@@ -249,7 +248,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertEquals(0, errors.size());
     }
 
@@ -274,7 +273,7 @@ public class SOL004MetaDirectoryValidatorTest {
         String manifest = manifestBuilder.build();
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifest.getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertExpectedErrors("", errors, 1);
     }
 
@@ -303,7 +302,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertExpectedErrors("Manifest referenced import file missing", errors, 1);
     }
 
@@ -330,7 +329,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertExpectedErrors("Reference with invalid YAML format", errors, 1);
     }
 
@@ -360,7 +359,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertEquals(0, errors.size());
     }
 
@@ -392,7 +391,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertExpectedErrors("Manifest with non existent source files", errors, 1);
     }
 
@@ -407,7 +406,7 @@ public class SOL004MetaDirectoryValidatorTest {
         handler.addFile(TOSCA_DEFINITION_FILEPATH, getResourceBytes(SAMPLE_DEFINITION_FILE_PATH));
         handler.addFile(SAMPLE_DEFINITION_IMPORT_FILE_PATH, "".getBytes());
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertExpectedErrors("TOSCA manifest with invalid data", errors, 1);
     }
 
@@ -430,7 +429,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertEquals(0, errors.size());
     }
 
@@ -464,7 +463,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource("Definitions/MainServiceTemplate2.mf");
         handler.addFile("Definitions/MainServiceTemplate2.mf", manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertExpectedErrors("Main TOSCA definitions file and Manifest file with different name should return error",
                errors, 1);
     }
@@ -496,7 +495,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource("Definitions/MainServiceTemplate.txt");
         handler.addFile("Definitions/MainServiceTemplate.txt", manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertExpectedErrors("Manifest file with different extension than .mf should return error",
                 errors, 1);
     }
@@ -515,7 +514,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertExpectedErrors("Manifest with valid vnf mandatory values should not return any errors", errors, 0);
     }
 
@@ -536,7 +535,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertExpectedErrors("Manifest with valid pnf mandatory values should not return any errors", errors, 0);
     }
 
@@ -561,7 +560,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertExpectedErrors("Manifest with mixed metadata should return error", errors, 1);
     }
 
@@ -586,7 +585,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertExpectedErrors("Manifest with missing vnf or pnf mandatory entries should return error", errors, 1);
     }
 
@@ -609,7 +608,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertExpectedErrors("Manifest with metadata missing pnf mandatory entries should return error", errors, 1);
 
     }
@@ -632,7 +631,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertExpectedErrors("Manifest with metadata missing vnf mandatory entries should return error", errors, 1);
 
     }
@@ -660,7 +659,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertExpectedErrors("Manifest with more than 4 metadata entries should return error", errors, 1);
     }
 
@@ -684,10 +683,8 @@ public class SOL004MetaDirectoryValidatorTest {
 
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
-
-        final List<String> folderList = new ArrayList<>();
-        folderList.add("Files/Certificates/");
-        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler, folderList);
+        handler.addFolder("Files/Certificates/");
+        final Map<String, List<ErrorMessage>> errors = sol004MetaDirectoryValidator.validateContent(handler);
         assertExpectedErrors("Tosca.meta should not have entries applicable only to VF", errors, 2);
 
     }
@@ -719,7 +716,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> actualErrorMap = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> actualErrorMap = sol004MetaDirectoryValidator.validateContent(handler);
 
         final List<ErrorMessage> expectedErrorList = new ArrayList<>();
         expectedErrorList.add(new ErrorMessage(ErrorLevel.ERROR
@@ -756,7 +753,7 @@ public class SOL004MetaDirectoryValidatorTest {
         manifestBuilder.withSource(TOSCA_MANIFEST_FILEPATH);
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
-        final Map<String, List<ErrorMessage>> actualErrorMap = sol004MetaDirectoryValidator.validateContent(handler, Collections.emptyList());
+        final Map<String, List<ErrorMessage>> actualErrorMap = sol004MetaDirectoryValidator.validateContent(handler);
 
         final List<ErrorMessage> expectedErrorList = new ArrayList<>();
         expectedErrorList.add(new ErrorMessage(ErrorLevel.ERROR
@@ -791,7 +788,7 @@ public class SOL004MetaDirectoryValidatorTest {
         handler.addFile(TOSCA_MANIFEST_FILEPATH, manifestBuilder.build().getBytes(StandardCharsets.UTF_8));
 
         final Map<String, List<ErrorMessage>> actualErrorMap = sol004MetaDirectoryValidator
-            .validateContent(handler, Collections.emptyList());
+            .validateContent(handler);
 
         assertExpectedErrors(actualErrorMap.get(SdcCommon.UPLOAD_FILE), Collections.emptyList());
     }
@@ -829,7 +826,7 @@ public class SOL004MetaDirectoryValidatorTest {
         );
 
         final Map<String, List<ErrorMessage>> actualErrorMap = sol004MetaDirectoryValidator
-            .validateContent(handler, Collections.emptyList());
+            .validateContent(handler);
 
         assertExpectedErrors(actualErrorMap.get(SdcCommon.UPLOAD_FILE), expectedErrorList);
     }
@@ -867,7 +864,7 @@ public class SOL004MetaDirectoryValidatorTest {
         );
 
         final Map<String, List<ErrorMessage>> actualErrorMap = sol004MetaDirectoryValidator
-            .validateContent(handler, Collections.emptyList());
+            .validateContent(handler);
 
         assertExpectedErrors(actualErrorMap.get(SdcCommon.UPLOAD_FILE), expectedErrorList);
     }
@@ -905,7 +902,7 @@ public class SOL004MetaDirectoryValidatorTest {
         );
 
         final Map<String, List<ErrorMessage>> actualErrorMap = sol004MetaDirectoryValidator
-            .validateContent(handler, Collections.emptyList());
+            .validateContent(handler);
 
         assertExpectedErrors(actualErrorMap.get(SdcCommon.UPLOAD_FILE), expectedErrorList);
     }
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/tree/UploadFileTest.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/tree/UploadFileTest.java
index 8081184f68..cc73bd766f 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/tree/UploadFileTest.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/tree/UploadFileTest.java
@@ -52,6 +52,7 @@ import org.openecomp.sdc.vendorsoftwareproduct.dao.OrchestrationTemplateDao;
 import org.openecomp.sdc.vendorsoftwareproduct.dao.VendorSoftwareProductInfoDao;
 import org.openecomp.sdc.vendorsoftwareproduct.dao.type.OrchestrationTemplateEntity;
 import org.openecomp.sdc.vendorsoftwareproduct.dao.type.VspDetails;
+import org.openecomp.sdc.vendorsoftwareproduct.exception.OnboardPackageException;
 import org.openecomp.sdc.vendorsoftwareproduct.impl.OrchestrationTemplateCandidateManagerImpl;
 import org.openecomp.sdc.vendorsoftwareproduct.services.composition.CompositionDataExtractor;
 import org.openecomp.sdc.vendorsoftwareproduct.services.impl.filedatastructuremodule.CandidateServiceImpl;
@@ -62,9 +63,6 @@ import org.openecomp.sdc.versioning.dao.types.Version;
 
 public class UploadFileTest {
   private static final Logger LOGGER = LoggerFactory.getLogger(UploadFileTest.class);
-
-  private static final String USER1 = "vspTestUser1";
-
   public static final Version VERSION01 = new Version(0, 1);
 
   @Mock
@@ -98,21 +96,22 @@ public class UploadFileTest {
   }
 
   @Test
-  public void testUploadFile() throws IOException {
+  public void testUploadFile() throws IOException, OnboardPackageException {
     doReturn(vspDetails).when(vspInfoDaoMock).get(any(VspDetails.class));
     try (final InputStream inputStream = getZipInputStream("/legalUpload")) {
       onboardPackageInfo = new OnboardPackageInfo("legalUpload", OnboardingTypesEnum.ZIP.toString(),
-              convertFileInputStream(inputStream));
+              convertFileInputStream(inputStream), OnboardingTypesEnum.ZIP);
       candidateManager.upload(vspDetails, onboardPackageInfo);
 
     }
   }
 
-  private void testLegalUpload(String vspId, Version version, InputStream upload, String user) {
+  private void testLegalUpload(String vspId, Version version, InputStream upload, String user)
+      throws IOException, OnboardPackageException {
     onboardPackageInfo = new OnboardPackageInfo("file", OnboardingTypesEnum.ZIP.toString(),
-            convertFileInputStream(upload));
+            convertFileInputStream(upload), OnboardingTypesEnum.ZIP);
     final UploadFileResponse uploadFileResponse = candidateManager.upload(vspDetails, onboardPackageInfo);
-    assertEquals(uploadFileResponse.getOnboardingType(), OnboardingTypesEnum.ZIP);
+    assertEquals(OnboardingTypesEnum.ZIP, uploadFileResponse.getOnboardingType());
     OrchestrationTemplateEntity uploadData = orchestrationTemplateDataDaoMock.get(vspId, version);
 
   }
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/upload/csar/UploadCSARFileTest.java b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/upload/csar/UploadCSARFileTest.java
index 7a183c0dbb..017ba2fbc2 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/upload/csar/UploadCSARFileTest.java
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/upload/csar/UploadCSARFileTest.java
@@ -45,6 +45,7 @@ import org.openecomp.sdc.logging.api.LoggerFactory;
 import org.openecomp.sdc.vendorsoftwareproduct.dao.OrchestrationTemplateCandidateDao;
 import org.openecomp.sdc.vendorsoftwareproduct.dao.VendorSoftwareProductInfoDao;
 import org.openecomp.sdc.vendorsoftwareproduct.dao.type.VspDetails;
+import org.openecomp.sdc.vendorsoftwareproduct.exception.OnboardPackageException;
 import org.openecomp.sdc.vendorsoftwareproduct.impl.OrchestrationTemplateCandidateManagerImpl;
 import org.openecomp.sdc.vendorsoftwareproduct.services.impl.filedatastructuremodule.CandidateServiceImpl;
 import org.openecomp.sdc.vendorsoftwareproduct.services.impl.filedatastructuremodule.ManifestCreatorNamingConventionImpl;
@@ -119,23 +120,23 @@ public class UploadCSARFileTest {
   }
 
   @Test
-  public void testUploadFileIsEmpty() throws Exception {
+  public void testUploadFileIsEmpty() throws OnboardPackageException {
     doReturn(vspDetails).when(vspInfoDaoMock).get(any(VspDetails.class));
     onboardPackageInfo = new OnboardPackageInfo("file", OnboardingTypesEnum.CSAR.toString(),
-            ByteBuffer.wrap(new byte[]{}));
+            ByteBuffer.wrap(new byte[]{}), OnboardingTypesEnum.CSAR);
     UploadFileResponse uploadFileResponse = candidateManager.upload(vspDetails, onboardPackageInfo);
     assertEquals(1, uploadFileResponse.getErrors().size());
   }
 
   @Test
-  public void testInvalidManifestContent() throws Exception {
+  public void testInvalidManifestContent() throws IOException, OnboardPackageException {
 
     doReturn(vspDetails).when(vspInfoDaoMock).get(any(VspDetails.class));
 
     try (InputStream inputStream = getClass()
         .getResourceAsStream(BASE_DIR + "/invalidManifestContent.csar")) {
       onboardPackageInfo = new OnboardPackageInfo("invalidManifestContent",
-              OnboardingTypesEnum.CSAR.toString(), convertFileInputStream(inputStream));
+              OnboardingTypesEnum.CSAR.toString(), convertFileInputStream(inputStream), OnboardingTypesEnum.CSAR);
       UploadFileResponse response =
           candidateManager.upload(vspDetails, onboardPackageInfo);
       assertEquals(1, response.getErrors().size());
@@ -156,12 +157,12 @@ public class UploadCSARFileTest {
   }
 
   private UploadFileResponse testCsarUpload(final String csarFileName,
-                                            final int expectedErrorsNumber) throws IOException {
+                                            final int expectedErrorsNumber) throws IOException, OnboardPackageException {
     UploadFileResponse uploadFileResponse;
     try (final InputStream inputStream = getClass()
         .getResourceAsStream(BASE_DIR + File.separator + csarFileName)) {
       onboardPackageInfo = new OnboardPackageInfo(csarFileName, OnboardingTypesEnum.CSAR.toString(),
-              convertFileInputStream(inputStream));
+              convertFileInputStream(inputStream), OnboardingTypesEnum.CSAR);
       uploadFileResponse = candidateManager.upload(vspDetails, onboardPackageInfo);
       assertThat(String.format("Expecting %s error(s) in file '%s'", expectedErrorsNumber, csarFileName), uploadFileResponse.getErrors().size(), is(expectedErrorsNumber));
     }
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/resources/vspmanager.csar/manifest/ValidNonManoToscaPNFWithNonMano.mf b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/resources/vspmanager.csar/manifest/ValidNonManoToscaPNFWithNonMano.mf
index 02275e1bca..23ceffd512 100644
--- a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/resources/vspmanager.csar/manifest/ValidNonManoToscaPNFWithNonMano.mf
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/resources/vspmanager.csar/manifest/ValidNonManoToscaPNFWithNonMano.mf
@@ -5,6 +5,7 @@ metadata:
   pnfd_release_date_time: 2017-01-01T10:00:00+03:00
 
 Source: MainServiceTemplate.yaml
+Source: Artifacts/Deployment/ANOTHER/authorized_keys
 
 non_mano_artifact_sets:
   onap_others:
diff --git a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/csar-and-cms-in-root.zip b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/resources/vspmanager.csar/signing/csar-and-cms-in-root.zip
index 07331466df..07331466df 100644
--- a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/csar-and-cms-in-root.zip
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/resources/vspmanager.csar/signing/csar-and-cms-in-root.zip
diff --git a/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/resources/vspmanager.csar/signing/fakeNonSignedZipPackage.zip b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/resources/vspmanager.csar/signing/fakeNonSignedZipPackage.zip
new file mode 100644
index 0000000000..b54fb5f7ff
--- /dev/null
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/resources/vspmanager.csar/signing/fakeNonSignedZipPackage.zip
diff --git a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/signed-package-tampered-data.zip b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/resources/vspmanager.csar/signing/signed-package-tampered-data.zip
index 0cfb9e0265..0cfb9e0265 100644
--- a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/signed-package-tampered-data.zip
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/resources/vspmanager.csar/signing/signed-package-tampered-data.zip
diff --git a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/signed-package.zip b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/resources/vspmanager.csar/signing/signed-package.zip
index a64ddd9be2..a64ddd9be2 100644
--- a/openecomp-be/api/openecomp-sdc-rest-webapp/vendor-software-products-rest/vendor-software-products-rest-services/src/test/resources/vspmanager.csar/signing/signed-package.zip
+++ b/openecomp-be/backend/openecomp-sdc-vendor-software-product-manager/src/test/resources/vspmanager.csar/signing/signed-package.zip
diff --git a/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/errors/Messages.java b/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/errors/Messages.java
index 7163dbecfd..99de164fb3 100644
--- a/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/errors/Messages.java
+++ b/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/errors/Messages.java
@@ -22,6 +22,12 @@ public enum Messages {
   VERSION_UPGRADE("Item %s is of old version. A check out was made in order to get new " +
       "functionalities"),
 
+  PACKAGE_PROCESS_ERROR("Could not process package '%s'"),
+  PACKAGE_INVALID_EXTENSION("Invalid package '%s' extension. Expecting %s."),
+  PACKAGE_EMPTY_ERROR("The given package is empty '%s'"),
+  PACKAGE_PROCESS_INTERNAL_PACKAGE_ERROR("Could not process internal package '%s'"),
+  PACKAGE_INVALID_ERROR("Invalid package content '%s'"),
+  PACKAGE_MISSING_INTERNAL_PACKAGE("Missing expected internal package"),
   INVALID_ZIP_FILE("Invalid zip file"),
   INVALID_CSAR_FILE("Invalid csar file"),
   CSAR_FILE_NOT_FOUND("Each CSAR file must contain %s file."),
@@ -207,7 +213,7 @@ public enum Messages {
   /* Notifications */
   FAILED_TO_MARK_NOTIFICATION_AS_READ("Failed to mark notifications as read"),
   FAILED_TO_UPDATE_LAST_SEEN_NOTIFICATION("Failed to update last seen notification for user %s"),
-  FAILED_TO_VERIFY_SIGNATURE("Cannot verify signature of signed archive!");
+  FAILED_TO_VERIFY_SIGNATURE("Could not verify signature of signed package.");
 
   private String errorMessage;
 
diff --git a/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/exception/ZipException.java b/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/exception/ZipException.java
new file mode 100644
index 0000000000..d26fae62e4
--- /dev/null
+++ b/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/exception/ZipException.java
@@ -0,0 +1,33 @@
+/*
+ * ============LICENSE_START=======================================================
+ *  Copyright (C) 2019 Nordix Foundation
+ *  ================================================================================
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  SPDX-License-Identifier: Apache-2.0
+ *  ============LICENSE_END=========================================================
+ */
+
+package org.openecomp.sdc.common.exception;
+
+import java.io.IOException;
+
+public class ZipException extends IOException {
+
+    public ZipException(String s) {
+        super(s);
+    }
+
+    public ZipException(String s, Throwable throwable) {
+        super(s, throwable);
+    }
+}
diff --git a/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/utils/CommonUtil.java b/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/utils/CommonUtil.java
index 8610ecb74b..f286dc1e76 100644
--- a/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/utils/CommonUtil.java
+++ b/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/utils/CommonUtil.java
@@ -20,6 +20,7 @@
 package org.openecomp.sdc.common.utils;
 
 import com.google.common.collect.Multimap;
+import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -29,11 +30,14 @@ import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipInputStream;
 import org.apache.commons.collections4.CollectionUtils;
 import org.apache.commons.io.FilenameUtils;
 import org.apache.commons.lang3.tuple.ImmutablePair;
 import org.apache.commons.lang3.tuple.Pair;
 import org.openecomp.core.utilities.file.FileContentHandler;
+import org.openecomp.core.utilities.file.FileUtils;
 import org.openecomp.core.utilities.orchestration.OnboardingTypesEnum;
 import org.openecomp.sdc.common.errors.CoreException;
 import org.openecomp.sdc.common.errors.ErrorCategory;
@@ -71,6 +75,14 @@ public class CommonUtil {
     return pair.getLeft();
   }
 
+  /**
+   * Extracts the zip in memory and build a pair of {@link FileContentHandler} and the zip folder list. The {@link
+   * FileContentHandler} will only contain the files, not the folders.
+   *
+   * @param uploadFileData the zip file to extract
+   * @return a pair of {@link FileContentHandler} only with the zip files and a list of the zip folders.
+   * @throws ZipException when there was a problem during the zip reading
+   */
   public static Pair<FileContentHandler, List<String>> getFileContentMapFromOrchestrationCandidateZip(
       byte[] uploadFileData) throws ZipException {
     final Map<String, byte[]> zipFileMap = ZipUtils.readZip(uploadFileData, true);
@@ -88,6 +100,26 @@ public class CommonUtil {
     return new ImmutablePair<>(mapFileContent, folderList);
   }
 
+  /**
+   * Extracts the zip in memory and build the {@link FileContentHandler}.
+   *
+   * @param zipFile the zip file to extract
+   * @return The {@link FileContentHandler} based on the zip content
+   * @throws ZipException when there was a problem during the zip reading
+   */
+  public static FileContentHandler getZipContent(final byte[] zipFile) throws ZipException {
+    final Map<String, byte[]> zipFileMap = ZipUtils.readZip(zipFile, true);
+    final FileContentHandler fileContentHandler = new FileContentHandler();
+    zipFileMap.forEach((key, value) -> {
+      if (value == null) {
+        fileContentHandler.addFolder(key);
+      } else {
+        fileContentHandler.addFile(key, value);
+      }
+    });
+    return fileContentHandler;
+  }
+
   private static void validateNoFolders(List<String> folderList) {
     if (CollectionUtils.isNotEmpty(folderList)) {
       throw new CoreException((new ErrorCode.ErrorCodeBuilder())
diff --git a/openecomp-be/lib/openecomp-core-lib/openecomp-utilities-lib/src/main/java/org/openecomp/core/utilities/file/FileContentHandler.java b/openecomp-be/lib/openecomp-core-lib/openecomp-utilities-lib/src/main/java/org/openecomp/core/utilities/file/FileContentHandler.java
index c96ceeb46a..cc13879b96 100644
--- a/openecomp-be/lib/openecomp-core-lib/openecomp-utilities-lib/src/main/java/org/openecomp/core/utilities/file/FileContentHandler.java
+++ b/openecomp-be/lib/openecomp-core-lib/openecomp-utilities-lib/src/main/java/org/openecomp/core/utilities/file/FileContentHandler.java
@@ -21,14 +21,12 @@
 package org.openecomp.core.utilities.file;
 
 import java.io.ByteArrayInputStream;
-import java.io.IOException;
 import java.io.InputStream;
 import java.util.HashMap;
 import java.util.Map;
-import java.util.Optional;
 import java.util.Set;
-import java.util.function.Function;
-
+import java.util.stream.Collectors;
+import org.apache.commons.collections4.CollectionUtils;
 import org.apache.commons.collections4.MapUtils;
 
 public class FileContentHandler {
@@ -36,13 +34,12 @@ public class FileContentHandler {
     private Map<String, byte[]> files = new HashMap<>();
 
     /**
-     * Gets file content.
+     * Gets file content as stream.
      *
      * @param fileName the file name
-     * @return the file content
+     * @return if the file was found, its content as stream, otherwise {@code null}.
      */
-    public InputStream getFileContent(String fileName) {
-
+    public InputStream getFileContentAsStream(final String fileName) {
         byte[] content = files.get(fileName);
         if (content == null || content.length == 0) {
             return null;
@@ -51,89 +48,70 @@ public class FileContentHandler {
         return new ByteArrayInputStream(content);
     }
 
-    /**
-     * Applies a business logic to a file's content while taking care of all retrieval logic.
-     *
-     * @param fileName  name of a file inside this content handler.
-     * @param processor the business logic to work on the file's input stream, which may not be set
-     *                  (check the {@link Optional} if no such file can be found
-     * @param <T>       return type, may be {@link java.lang.Void}
-     * @return result produced by the processor
-     */
-    public <T> T processFileContent(String fileName, Function<Optional<InputStream>, T> processor) {
+    public byte[] getFileContent(final String fileName) {
+        return files.get(fileName);
+    }
 
-        // do not throw IOException to mimic the existing uses of getFileContent()
-        try (InputStream contentInputStream = getFileContent(fileName)) {
-            return processor.apply(Optional.ofNullable(contentInputStream));
-        } catch (IOException e) {
-            throw new ProcessingException("Failed to process file: " + fileName, e);
-        }
+    public boolean isFolder(final String fileName) {
+        return files.get(fileName) == null;
     }
 
-    public void addFile(String fileName, byte[] content) {
-        files.put(fileName, content);
+    public boolean isFile(final String fileName) {
+        return files.get(fileName) != null;
     }
 
-    public void addFile(String fileName, InputStream is) {
+    public void addFolder(final String folder) {
+        files.put(folder, null);
+    }
+
+    public void addFile(final String fileName, final byte[] content) {
+        files.put(fileName, content == null ? new byte[0] : content);
+    }
 
+    public void addFile(final String fileName, final InputStream is) {
         files.put(fileName, FileUtils.toByteArray(is));
     }
 
     public Map<String, byte[]> getFiles() {
-        return files;
+        return files.entrySet().stream().filter(entry -> entry.getValue() != null)
+            .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));
     }
 
-    public void setFiles(Map<String, byte[]> files) {
-        this.files = files;
+    public void setFiles(final Map<String, byte[]> files) {
+        addAll(files);
     }
 
-    public void setFiles(FileContentHandler extFiles) {
-        extFiles.getFileList().forEach(fileName -> this.addFile(fileName, extFiles.getFileContent(fileName)));
+    public Set<String> getFileList() {
+        return files.keySet().stream().filter(this::isFile).collect(Collectors.toSet());
     }
 
-    public Set<String> getFileList() {
-        return files.keySet();
+    public Set<String> getFolderList() {
+        return files.keySet().stream().filter(this::isFolder).collect(Collectors.toSet());
     }
 
-    public void putAll(Map<String, byte[]> files) {
-        this.files = files;
+    public void addAll(final FileContentHandler fileContentHandlerOther) {
+        if (CollectionUtils.isNotEmpty(fileContentHandlerOther.getFolderList())) {
+            fileContentHandlerOther.getFolderList().forEach(this::addFolder);
+        }
+        addAll(fileContentHandlerOther.getFiles());
     }
 
-    public void addAll(FileContentHandler other) {
-        this.files.putAll(other.files);
+    private void addAll(final Map<String, byte[]> files) {
+        if (!MapUtils.isEmpty(files)) {
+            files.forEach(this::addFile);
+        }
     }
 
     public boolean isEmpty() {
         return MapUtils.isEmpty(this.files);
     }
 
-    public void remove(String fileName) {
-        files.remove(fileName);
+    public byte[] remove(final String fileName) {
+        return files.remove(fileName);
     }
 
-    public boolean containsFile(String fileName) {
+    public boolean containsFile(final String fileName) {
         return files.containsKey(fileName);
     }
 
-    /**
-     * An application-specific runtime exception
-     */
-    private static class ProcessingException extends RuntimeException {
-
-        public ProcessingException() {
-            super();
-        }
-
-        public ProcessingException(String message) {
-            super(message);
-        }
-
-        public ProcessingException(Throwable cause) {
-            super(cause);
-        }
-
-        public ProcessingException(String msg, Throwable cause) {
-            super(msg, cause);
-        }
-    }
 }
diff --git a/openecomp-be/lib/openecomp-core-lib/openecomp-utilities-lib/src/main/java/org/openecomp/core/utilities/file/FileUtils.java b/openecomp-be/lib/openecomp-core-lib/openecomp-utilities-lib/src/main/java/org/openecomp/core/utilities/file/FileUtils.java
index 31338dcda4..f69a2a060a 100644
--- a/openecomp-be/lib/openecomp-core-lib/openecomp-utilities-lib/src/main/java/org/openecomp/core/utilities/file/FileUtils.java
+++ b/openecomp-be/lib/openecomp-core-lib/openecomp-utilities-lib/src/main/java/org/openecomp/core/utilities/file/FileUtils.java
@@ -229,9 +229,15 @@ public class FileUtils {
   public static FileContentHandler getFileContentMapFromZip(byte[] zipData)
       throws ZipException {
     final Map<String, byte[]> zipFileAndByteMap = ZipUtils.readZip(zipData, true);
-    final FileContentHandler mapFileContent = new FileContentHandler();
-    mapFileContent.setFiles(zipFileAndByteMap);
-    return mapFileContent;
+    final FileContentHandler fileContentHandler = new FileContentHandler();
+    zipFileAndByteMap.forEach((path, bytes) -> {
+      if (bytes == null) {
+        fileContentHandler.addFolder(path);
+      } else {
+        fileContentHandler.addFile(path, bytes);
+      }
+    });
+    return fileContentHandler;
   }
 
 
@@ -280,24 +286,23 @@ public class FileUtils {
    */
   public static Map<String, String> writeFilesFromFileContentHandler(final FileContentHandler fileContentHandler,
                                                                      final Path dir) throws IOException {
-    File file;
     final File dirFile = dir.toFile();
     final Map<String, String> filePaths = new HashMap<>();
+    File file;
+    for (final String folderPath : fileContentHandler.getFolderList()) {
+      file = new File(dirFile, folderPath);
+      filePaths.put(folderPath, file.getAbsolutePath());
+      if (!file.exists() && !file.mkdirs()) {
+        throw new IOException("Could not create directory " + file.getAbsolutePath());
+      }
+    }
     for (final Map.Entry<String, byte[]> fileEntry : fileContentHandler.getFiles().entrySet()) {
       file = new File(dirFile, fileEntry.getKey());
       filePaths.put(fileEntry.getKey(), file.getAbsolutePath());
       final byte[] fileBytes = fileEntry.getValue();
-      if (fileBytes == null) {
-        if (!file.exists() && !file.mkdirs()) {
-          throw new IOException("Could not create directory " + file.getAbsolutePath());
-        }
-        continue;
-      } else {
-        if (!file.getParentFile().exists() && !file.getParentFile().mkdirs()) {
-          throw new IOException("Could not create parent directory for " + file.getAbsolutePath());
-        }
+      if (!file.getParentFile().exists() && !file.getParentFile().mkdirs()) {
+        throw new IOException("Could not create parent directory for " + file.getAbsolutePath());
       }
-
       try (final FileOutputStream fop = new FileOutputStream(file.getAbsolutePath());) {
         fop.write(fileBytes);
         fop.flush();
diff --git a/openecomp-be/lib/openecomp-core-lib/openecomp-utilities-lib/src/main/java/org/openecomp/core/utilities/orchestration/OnboardingTypesEnum.java b/openecomp-be/lib/openecomp-core-lib/openecomp-utilities-lib/src/main/java/org/openecomp/core/utilities/orchestration/OnboardingTypesEnum.java
index 91cbc2c505..1fa96103ab 100644
--- a/openecomp-be/lib/openecomp-core-lib/openecomp-utilities-lib/src/main/java/org/openecomp/core/utilities/orchestration/OnboardingTypesEnum.java
+++ b/openecomp-be/lib/openecomp-core-lib/openecomp-utilities-lib/src/main/java/org/openecomp/core/utilities/orchestration/OnboardingTypesEnum.java
@@ -16,14 +16,13 @@
 
 package org.openecomp.core.utilities.orchestration;
 
-import java.util.Optional;
-
-import static java.util.Arrays.asList;
+import java.util.Arrays;
+import org.apache.commons.lang3.StringUtils;
 public enum OnboardingTypesEnum {
-    CSAR("csar"), ZIP("zip"), MANUAL("manual"), NONE("none");
-    private String type;
+    CSAR("csar"), ZIP("zip"), MANUAL("manual"), NONE("none"), SIGNED_CSAR("signed-csar");
+    private final String type;
 
-    OnboardingTypesEnum(String type) {
+    OnboardingTypesEnum(final String type) {
         this.type = type;
     }
 
@@ -32,15 +31,14 @@ public enum OnboardingTypesEnum {
         return type;
     }
 
-    public static final OnboardingTypesEnum getOnboardingTypesEnum(final String inStr) {
-        if (inStr == null) {
+    public static OnboardingTypesEnum getOnboardingTypesEnum(final String type) {
+        if (StringUtils.isEmpty(type)) {
             return null;
         }
 
-        Optional<OnboardingTypesEnum>  onboardingTypesOptional =  asList(OnboardingTypesEnum.values()).stream()
-                .filter(onboardingTypesEnum -> onboardingTypesEnum.toString().equals(inStr.toLowerCase()))
-            .findAny();
-      return onboardingTypesOptional.orElse(null);
+        return Arrays.stream(OnboardingTypesEnum.values())
+            .filter(onboardingTypesEnum -> onboardingTypesEnum.toString().equalsIgnoreCase(type))
+            .findAny().orElse(null);
     }
 
 }
diff --git a/openecomp-be/lib/openecomp-core-lib/openecomp-utilities-lib/src/test/java/org/openecomp/core/utilities/file/FileContentHandlerTest.java b/openecomp-be/lib/openecomp-core-lib/openecomp-utilities-lib/src/test/java/org/openecomp/core/utilities/file/FileContentHandlerTest.java
index 0c767a7919..77ada193b3 100644
--- a/openecomp-be/lib/openecomp-core-lib/openecomp-utilities-lib/src/test/java/org/openecomp/core/utilities/file/FileContentHandlerTest.java
+++ b/openecomp-be/lib/openecomp-core-lib/openecomp-utilities-lib/src/test/java/org/openecomp/core/utilities/file/FileContentHandlerTest.java
@@ -16,16 +16,23 @@
 
 package org.openecomp.core.utilities.file;
 
+import static org.hamcrest.Matchers.aMapWithSize;
+import static org.hamcrest.Matchers.hasItem;
+import static org.hamcrest.Matchers.hasSize;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertThat;
 import static org.junit.Assert.assertTrue;
 
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
+import java.io.InputStream;
 import java.util.AbstractMap;
 import java.util.Arrays;
 import java.util.Map;
 import java.util.Optional;
+import java.util.Set;
+import java.util.function.Function;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 import org.junit.Assert;
@@ -48,7 +55,7 @@ public class FileContentHandlerTest {
         Arrays.fill(content, (byte) 44);
         contentHandler.addFile(FILE_NAME, content);
 
-        byte[] actualContent = contentHandler.processFileContent(FILE_NAME, optional -> {
+        byte[] actualContent = processFileContent(FILE_NAME, optional -> {
 
             try {
                 byte[] buffer = new byte[size];
@@ -59,7 +66,7 @@ public class FileContentHandlerTest {
                 throw new RuntimeException("Unexpected error", e);
             }
 
-        });
+        }, contentHandler);
         Assert.assertTrue(Arrays.equals(actualContent, content));
     }
 
@@ -67,13 +74,13 @@ public class FileContentHandlerTest {
     public void testProcessEmptyFileContent() {
         FileContentHandler contentHandler = new FileContentHandler();
         contentHandler.addFile(FILE_NAME, new byte[0]);
-        assertFalse(contentHandler.processFileContent(FILE_NAME, Optional::isPresent));
+        assertFalse(processFileContent(FILE_NAME, Optional::isPresent, contentHandler));
     }
 
     @Test
     public void testProcessNoFileContent() {
         FileContentHandler contentHandler = new FileContentHandler();
-        assertFalse(contentHandler.processFileContent("filename", Optional::isPresent));
+        assertFalse(processFileContent("filename", Optional::isPresent, contentHandler));
     }
 
     @Test
@@ -88,47 +95,69 @@ public class FileContentHandlerTest {
 
     @Test
     public void testSetFiles() {
-        FileContentHandler contentHandler = new FileContentHandler();
-        Map<String, byte[]> fileMap = Stream.of(new AbstractMap.SimpleEntry<>("file1", new byte[0]),
-                    new AbstractMap.SimpleEntry<>("file2", new byte[0]))
-                .collect(Collectors.toMap(AbstractMap.SimpleEntry::getKey, AbstractMap.SimpleEntry::getValue));
-
-        contentHandler.setFiles(fileMap);
-
-        Assert.assertEquals(contentHandler.getFiles().size(), 2);
-        Assert.assertEquals(contentHandler.getFileList().size(), 2);
-        assertFalse(contentHandler.isEmpty());
-        contentHandler.remove("file1");
-        assertFalse(contentHandler.containsFile("file1"));
-    }
-
-    @Test
-    public void testAddAll() {
-        FileContentHandler contentHandler = new FileContentHandler();
-        FileContentHandler contentHandler1 = createFileHandlerContent();
-
-        contentHandler.addAll(contentHandler1);
-
-        Assert.assertTrue(contentHandler1.containsFile("file1"));
-        Assert.assertEquals(contentHandler.getFiles().size(), 2);
+        //given
+        final FileContentHandler expectedFileContentHandler = createFileContentHandler();
+        //when
+        final FileContentHandler actualContentHandler = new FileContentHandler();
+        actualContentHandler.setFiles(expectedFileContentHandler.getFiles());
+
+        //then
+        final Map<String, byte[]> actualFileMap = actualContentHandler.getFiles();
+        assertThat("Should contain the expected number of folders", actualContentHandler.getFolderList(), hasSize(0));
+        assertThat("Should contain the expected number of files", actualFileMap, aMapWithSize(2));
+        expectedFileContentHandler.getFiles().keySet().forEach(filePath -> {
+            assertThat("Should contain the expected file", actualFileMap.keySet(), hasItem(filePath));
+        });
     }
 
     @Test
-    public void testSetFilesUsingFIleContentHandlerObject() {
-        FileContentHandler contentHandler1 = createFileHandlerContent();
-
-        FileContentHandler contentHandler = new FileContentHandler();
-        contentHandler.setFiles(contentHandler1);
-
-        Assert.assertEquals(contentHandler.getFiles().size(), 2);
+    public void testAddAllFromFileContentHandler() {
+        //given
+        final FileContentHandler expectedFileContentHandler = createFileContentHandler();
+        //when
+        final FileContentHandler actualContentHandler = new FileContentHandler();
+        actualContentHandler.addAll(expectedFileContentHandler);
+        //then
+        final Map<String, byte[]> actualFileMap = actualContentHandler.getFiles();
+        assertThat("Should contain the expected number of files", actualFileMap, aMapWithSize(2));
+        final Set<String> actualFolderList = actualContentHandler.getFolderList();
+        assertThat("Should contain the expected number of folders", actualFolderList, hasSize(3));
+        expectedFileContentHandler.getFiles().keySet().forEach(filePath -> {
+            assertThat("Should contain the expected file", actualFileMap.keySet(), hasItem(filePath));
+        });
+        expectedFileContentHandler.getFolderList().forEach(folderPath -> {
+            assertThat("Should contain the expected file", actualFolderList, hasItem(folderPath));
+        });
     }
 
-    private FileContentHandler createFileHandlerContent() {
-        FileContentHandler contentHandler1 = new FileContentHandler();
-        Map<String, byte[]> fileMap = Stream.of(new AbstractMap.SimpleEntry<>("file1", new byte[0]),
+    private FileContentHandler createFileContentHandler() {
+        final FileContentHandler contentHandler = new FileContentHandler();
+        final Map<String, byte[]> fileMap = Stream.of(new AbstractMap.SimpleEntry<>("file1", new byte[0]),
                 new AbstractMap.SimpleEntry<>("file2", new byte[0]))
                 .collect(Collectors.toMap(AbstractMap.SimpleEntry::getKey, AbstractMap.SimpleEntry::getValue));
-        contentHandler1.putAll(fileMap);
-        return contentHandler1;
+        contentHandler.setFiles(fileMap);
+        contentHandler.addFolder("folder1");
+        contentHandler.addFolder("folder1/folder2");
+        contentHandler.addFolder("folder3");
+        return contentHandler;
+    }
+
+    /**
+     * Applies a business logic to a file's content while taking care of all retrieval logic.
+     *
+     * @param fileName  name of a file inside this content handler.
+     * @param processor the business logic to work on the file's input stream, which may not be set
+     *                  (check the {@link Optional} if no such file can be found
+     * @param <T>       return type, may be {@link java.lang.Void}
+     * @return result produced by the processor
+     */
+    public <T> T processFileContent(String fileName, Function<Optional<InputStream>, T> processor, FileContentHandler contentHandler) {
+
+        // do not throw IOException to mimic the existing uses of getFileContent()
+        try (InputStream contentInputStream = contentHandler.getFileContentAsStream(fileName)) {
+            return processor.apply(Optional.ofNullable(contentInputStream));
+        } catch (IOException e) {
+            throw new RuntimeException("Failed to process file: " + fileName, e);
+        }
     }
 }
diff --git a/openecomp-be/lib/openecomp-heat-lib/src/main/java/org/openecomp/sdc/heat/services/tree/HeatTreeManager.java b/openecomp-be/lib/openecomp-heat-lib/src/main/java/org/openecomp/sdc/heat/services/tree/HeatTreeManager.java
index 936f02be67..b10d4862b1 100644
--- a/openecomp-be/lib/openecomp-heat-lib/src/main/java/org/openecomp/sdc/heat/services/tree/HeatTreeManager.java
+++ b/openecomp-be/lib/openecomp-heat-lib/src/main/java/org/openecomp/sdc/heat/services/tree/HeatTreeManager.java
@@ -118,7 +118,7 @@ public class HeatTreeManager {
                                             GlobalValidationContext globalContext) {
 
         String fileName = fileHeatStructureTree.getFileName();
-        try (InputStream fileContent = this.heatContentMap.getFileContent(fileName)) {
+        try (InputStream fileContent = this.heatContentMap.getFileContentAsStream(fileName)) {
             HeatOrchestrationTemplate hot =
                     new YamlUtil().yamlToObject(fileContent, HeatOrchestrationTemplate.class);
 
diff --git a/openecomp-be/lib/openecomp-heat-lib/src/main/java/org/openecomp/sdc/heat/services/tree/HeatTreeManagerUtil.java b/openecomp-be/lib/openecomp-heat-lib/src/main/java/org/openecomp/sdc/heat/services/tree/HeatTreeManagerUtil.java
index 8c6d1354c4..792d9a4854 100644
--- a/openecomp-be/lib/openecomp-heat-lib/src/main/java/org/openecomp/sdc/heat/services/tree/HeatTreeManagerUtil.java
+++ b/openecomp-be/lib/openecomp-heat-lib/src/main/java/org/openecomp/sdc/heat/services/tree/HeatTreeManagerUtil.java
@@ -54,7 +54,7 @@ public class HeatTreeManagerUtil {
 
         HeatTreeManager heatTreeManager = new HeatTreeManager();
         fileContentMap.getFileList().forEach(
-                fileName -> heatTreeManager.addFile(fileName, fileContentMap.getFileContent(fileName)));
+                fileName -> heatTreeManager.addFile(fileName, fileContentMap.getFileContentAsStream(fileName)));
 
         return heatTreeManager;
     }
diff --git a/openecomp-be/lib/openecomp-sdc-datatypes-lib/src/main/java/org/openecomp/sdc/datatypes/error/ErrorMessage.java b/openecomp-be/lib/openecomp-sdc-datatypes-lib/src/main/java/org/openecomp/sdc/datatypes/error/ErrorMessage.java
index 2c88e9d61a..a8aeb17a51 100644
--- a/openecomp-be/lib/openecomp-sdc-datatypes-lib/src/main/java/org/openecomp/sdc/datatypes/error/ErrorMessage.java
+++ b/openecomp-be/lib/openecomp-sdc-datatypes-lib/src/main/java/org/openecomp/sdc/datatypes/error/ErrorMessage.java
@@ -20,16 +20,17 @@
 
 package org.openecomp.sdc.datatypes.error;
 
-import org.apache.commons.collections4.CollectionUtils;
-
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
-import lombok.Getter;
 import lombok.EqualsAndHashCode;
+import lombok.Getter;
+import lombok.ToString;
+import org.apache.commons.collections4.CollectionUtils;
 
 @Getter
 @EqualsAndHashCode
+@ToString
 public class ErrorMessage {
   private final ErrorLevel level;
   private final String message;
@@ -41,6 +42,9 @@ public class ErrorMessage {
 
   public static class ErrorMessageUtil {
 
+    private ErrorMessageUtil() {
+    }
+
     /**
      * Add message list.
      *
diff --git a/openecomp-be/lib/openecomp-sdc-enrichment-lib/openecomp-sdc-enrichment-impl/src/main/java/org/openecomp/sdc/enrichment/impl/external/artifact/MonitoringMibEnricher.java b/openecomp-be/lib/openecomp-sdc-enrichment-lib/openecomp-sdc-enrichment-impl/src/main/java/org/openecomp/sdc/enrichment/impl/external/artifact/MonitoringMibEnricher.java
index ca1fbe11b7..34954bdbbb 100644
--- a/openecomp-be/lib/openecomp-sdc-enrichment-lib/openecomp-sdc-enrichment-impl/src/main/java/org/openecomp/sdc/enrichment/impl/external/artifact/MonitoringMibEnricher.java
+++ b/openecomp-be/lib/openecomp-sdc-enrichment-lib/openecomp-sdc-enrichment-impl/src/main/java/org/openecomp/sdc/enrichment/impl/external/artifact/MonitoringMibEnricher.java
@@ -281,7 +281,7 @@ public class MonitoringMibEnricher implements ExternalArtifactEnricherInterface
     }
     Set<String> fileList = mibs.getFileList();
     for (String fileName : fileList) {
-      mibServiceArtifact.setContentData(FileUtils.toByteArray(mibs.getFileContent(fileName)));
+      mibServiceArtifact.setContentData(mibs.getFileContent(fileName));
       mibServiceArtifact.setName(monitoringArtifactInfo.getName() + File.separator + fileName);
       getEnrichedServiceModelDao().storeExternalArtifact(mibServiceArtifact);
     }
diff --git a/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/datatypes/heattotosca/TranslationContext.java b/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/datatypes/heattotosca/TranslationContext.java
index f1732fa4f9..76ef37327e 100644
--- a/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/datatypes/heattotosca/TranslationContext.java
+++ b/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/datatypes/heattotosca/TranslationContext.java
@@ -280,11 +280,11 @@ public class TranslationContext {
   }
 
   public void setFiles(Map<String, byte[]> files) {
-    this.files.putAll(files);
+    this.files.setFiles(files);
   }
 
-  public InputStream getFileContent(String fileName) {
-    return files.getFileContent(fileName);
+  public InputStream getFileContentAsStream(final String fileName) {
+    return files.getFileContentAsStream(fileName);
   }
 
   public void addFile(String name, byte[] content) {
diff --git a/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/HeatToToscaUtil.java b/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/HeatToToscaUtil.java
index 9c21c9cbf6..6b03e29348 100644
--- a/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/HeatToToscaUtil.java
+++ b/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/HeatToToscaUtil.java
@@ -120,7 +120,7 @@ public class HeatToToscaUtil {
     public static TranslatorOutput loadAndTranslateTemplateData(FileContentHandler fileNameContentMap) {
         HeatToToscaTranslator heatToToscaTranslator = HeatToToscaTranslatorFactory.getInstance().createInterface();
 
-        try (InputStream fileContent = fileNameContentMap.getFileContent(SdcCommon.MANIFEST_NAME)) {
+        try (InputStream fileContent = fileNameContentMap.getFileContentAsStream(SdcCommon.MANIFEST_NAME)) {
             heatToToscaTranslator.addManifest(SdcCommon.MANIFEST_NAME, FileUtils.toByteArray(fileContent));
         } catch (IOException e) {
             throw new SdcRuntimeException("Failed to read manifest", e);
@@ -128,7 +128,7 @@ public class HeatToToscaUtil {
 
         fileNameContentMap.getFileList().stream().filter(fileName -> !(fileName.equals(SdcCommon.MANIFEST_NAME)))
                           .forEach(fileName -> heatToToscaTranslator.addFile(fileName,
-                                  FileUtils.toByteArray(fileNameContentMap.getFileContent(fileName))));
+                                  fileNameContentMap.getFileContent(fileName)));
 
         Map<String, List<ErrorMessage>> errors = heatToToscaTranslator.validate();
         if (MapUtils.isNotEmpty(MessageContainerUtil.getMessageByLevel(ErrorLevel.ERROR, errors))) {
@@ -233,7 +233,7 @@ public class HeatToToscaUtil {
                     fileDataCollection.addBaseFiles(fileData);
                 }
                 HeatOrchestrationTemplate heatOrchestrationTemplate = new YamlUtil().yamlToObject(
-                        translationContext.getFileContent(fileName), HeatOrchestrationTemplate.class);
+                        translationContext.getFileContentAsStream(fileName), HeatOrchestrationTemplate.class);
                 if (MapUtils.isNotEmpty(heatOrchestrationTemplate.getResources())) {
                     referenced.addAll(applyFilterOnFileCollection(heatOrchestrationTemplate, translationContext,
                             fileDataCollection, filteredFiles));
@@ -565,7 +565,7 @@ public class HeatToToscaUtil {
 
     private static boolean isNestedVlanResource(String nestedHeatFileName, TranslationContext translationContext) {
         HeatOrchestrationTemplate nestedHeatOrchestrationTemplate = new YamlUtil().yamlToObject(
-                translationContext.getFileContent(nestedHeatFileName), HeatOrchestrationTemplate.class);
+                translationContext.getFileContentAsStream(nestedHeatFileName), HeatOrchestrationTemplate.class);
         return Objects.nonNull(nestedHeatOrchestrationTemplate.getResources()) && nestedHeatOrchestrationTemplate
                                                                                           .getResources().values()
                                                                                           .stream().anyMatch(
@@ -575,7 +575,7 @@ public class HeatToToscaUtil {
     public static Optional<String> getSubInterfaceParentPortNodeTemplateId(TranslateTo subInterfaceTo) {
         String subInterfaceResourceType = getSubInterfaceResourceType(subInterfaceTo.getResource());
         HeatOrchestrationTemplate nestedHeatOrchestrationTemplate = new YamlUtil().yamlToObject(
-                subInterfaceTo.getContext().getFileContent(subInterfaceResourceType), HeatOrchestrationTemplate.class);
+                subInterfaceTo.getContext().getFileContentAsStream(subInterfaceResourceType), HeatOrchestrationTemplate.class);
         if (Objects.isNull(nestedHeatOrchestrationTemplate.getResources())) {
             return Optional.empty();
         }
@@ -664,7 +664,7 @@ public class HeatToToscaUtil {
     public static boolean isNestedVfcResource(Resource resource, TranslationContext context) {
         Optional<String> nestedHeatFileName = HeatToToscaUtil.getNestedHeatFileName(resource);
         HeatOrchestrationTemplate nestedHeatOrchestrationTemplate = new YamlUtil().yamlToObject(
-                context.getFileContent(nestedHeatFileName.get()), HeatOrchestrationTemplate.class);
+                context.getFileContentAsStream(nestedHeatFileName.get()), HeatOrchestrationTemplate.class);
         Map<String, Resource> resources = nestedHeatOrchestrationTemplate.getResources();
         return Objects.nonNull(resources) && resources.values().stream()
                      .anyMatch(ConsolidationDataUtil::isComputeResource);
@@ -1366,8 +1366,8 @@ public class HeatToToscaUtil {
 
     private static FileContentHandler getCsarArtifactFiles(TranslationContext translationContext) {
         FileContentHandler artifactFiles = new FileContentHandler();
-        artifactFiles.setFiles(translationContext.getFiles());
-        artifactFiles.setFiles(translationContext.getExternalArtifacts());
+        artifactFiles.addAll(translationContext.getFiles());
+        artifactFiles.addAll(translationContext.getExternalArtifacts());
 
         HeatTreeManager heatTreeManager = HeatTreeManagerUtil.initHeatTreeManager(translationContext.getFiles());
         heatTreeManager.createTree();
@@ -1415,7 +1415,7 @@ public class HeatToToscaUtil {
         }
 
         HeatOrchestrationTemplate nestedHeatOrchestrationTemplate = new YamlUtil().yamlToObject(
-                translationContext.getFileContent(nestedHeatFileName.get()), HeatOrchestrationTemplate.class);
+                translationContext.getFileContentAsStream(nestedHeatFileName.get()), HeatOrchestrationTemplate.class);
 
         if (MapUtils.isNotEmpty(nestedHeatOrchestrationTemplate.getResources())) {
             ContrailV2VirtualMachineInterfaceHelper contrailV2VirtualMachineInterfaceHelper =
diff --git a/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/TranslationService.java b/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/TranslationService.java
index 32b5e29ac7..866f78c1b5 100644
--- a/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/TranslationService.java
+++ b/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/TranslationService.java
@@ -129,7 +129,7 @@ public class TranslationService {
                                   TranslationContext context) {
         String heatFileName = heatFileData.getFile();
         HeatOrchestrationTemplate heatOrchestrationTemplate = new YamlUtil()
-                .yamlToObject(context.getFileContent(heatFileName), HeatOrchestrationTemplate.class);
+                .yamlToObject(context.getFileContentAsStream(heatFileName), HeatOrchestrationTemplate.class);
 
         translateInputParameters(serviceTemplate, heatOrchestrationTemplate, heatFileData, context,
                 heatFileName);
@@ -389,7 +389,7 @@ public class TranslationService {
         }
         for (FileData fileRelatedData : fileRelatedDataList) {
             if (fileRelatedData.getType().equals(FileData.Type.HEAT_ENV)) {
-                return new YamlUtil().yamlToObject(context.getFileContent(fileRelatedData.getFile()),
+                return new YamlUtil().yamlToObject(context.getFileContentAsStream(fileRelatedData.getFile()),
                         Environment.class);
             }
         }
diff --git a/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/helper/VolumeTranslationHelper.java b/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/helper/VolumeTranslationHelper.java
index 588c403f7d..6328541927 100644
--- a/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/helper/VolumeTranslationHelper.java
+++ b/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/helper/VolumeTranslationHelper.java
@@ -81,7 +81,7 @@ public class VolumeTranslationHelper {
       String resourceId, TranslateTo translateTo, List<FileData> fileDatas) {
     for (FileData data : fileDatas) {
       HeatOrchestrationTemplate heatOrchestrationTemplate = new YamlUtil()
-          .yamlToObject(translateTo.getContext().getFiles().getFileContent(data.getFile()),
+          .yamlToObject(translateTo.getContext().getFiles().getFileContentAsStream(data.getFile()),
               HeatOrchestrationTemplate.class);
       Map<String, Output> outputs = heatOrchestrationTemplate.getOutputs();
       if (Objects.isNull(outputs)) {
diff --git a/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/impl/functiontranslation/FunctionTranslationGetAttrImpl.java b/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/impl/functiontranslation/FunctionTranslationGetAttrImpl.java
index 812fcc90d6..16316f45af 100644
--- a/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/impl/functiontranslation/FunctionTranslationGetAttrImpl.java
+++ b/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/impl/functiontranslation/FunctionTranslationGetAttrImpl.java
@@ -28,7 +28,6 @@ import java.util.Optional;
 import java.util.Set;
 
 import org.apache.commons.lang3.StringUtils;
-import org.onap.sdc.tosca.datatypes.model.ServiceTemplate;
 import org.onap.sdc.tosca.services.YamlUtil;
 import org.openecomp.sdc.heat.datatypes.model.HeatOrchestrationTemplate;
 import org.openecomp.sdc.heat.datatypes.model.Resource;
@@ -237,7 +236,7 @@ public class FunctionTranslationGetAttrImpl implements FunctionTranslation {
                 return Optional.empty();
             }
             HeatOrchestrationTemplate nestedHeatOrchestrationTemplate = new YamlUtil()
-                    .yamlToObject(context.getFiles().getFileContent(nestedFile.get()), HeatOrchestrationTemplate.class);
+                    .yamlToObject(context.getFiles().getFileContentAsStream(nestedFile.get()), HeatOrchestrationTemplate.class);
             translatedAttributes.addAll(nestedHeatOrchestrationTemplate.getOutputs().keySet());
             return Optional.of(translatedAttributes);
 
diff --git a/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/impl/resourcetranslation/BaseResourceConnection.java b/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/impl/resourcetranslation/BaseResourceConnection.java
index 6b7f1cf5b9..e7449c4105 100644
--- a/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/impl/resourcetranslation/BaseResourceConnection.java
+++ b/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/services/heattotosca/impl/resourcetranslation/BaseResourceConnection.java
@@ -103,7 +103,7 @@ abstract class BaseResourceConnection<T> {
                 .get(translateTo.getResource().getType());
         List<String> paramNames;
         HeatOrchestrationTemplate nestedHeatOrchestrationTemplate = new YamlUtil()
-                .yamlToObject(translateTo.getContext().getFileContent(nestedFileData.getFile()),
+                .yamlToObject(translateTo.getContext().getFileContentAsStream(nestedFileData.getFile()),
                         HeatOrchestrationTemplate.class);
         List<Map<String, T>> exposedConnectionPoints = getAllConnectionPoints();
         for (Map<String, T> connectionPointsMap : exposedConnectionPoints) {
@@ -148,7 +148,7 @@ abstract class BaseResourceConnection<T> {
             return Collections.emptyList();
         }
         HeatOrchestrationTemplate mappedNestedHeatOrchestrationTemplate = new YamlUtil()
-                .yamlToObject(translateTo.getContext().getFileContent(mappedNestedHeatFileName),
+                .yamlToObject(translateTo.getContext().getFileContentAsStream(mappedNestedHeatFileName),
                         HeatOrchestrationTemplate.class);
         ServiceTemplate mappedNestedServiceTemplate =
                 translateTo.getContext().getTranslatedServiceTemplates().get(mappedNestedHeatFileName);
diff --git a/openecomp-be/lib/openecomp-sdc-vendor-software-product-lib/openecomp-sdc-vendor-software-product-api/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/services/utils/CandidateEntityBuilder.java b/openecomp-be/lib/openecomp-sdc-vendor-software-product-lib/openecomp-sdc-vendor-software-product-api/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/services/utils/CandidateEntityBuilder.java
index 6702479864..eb4b29d742 100644
--- a/openecomp-be/lib/openecomp-sdc-vendor-software-product-lib/openecomp-sdc-vendor-software-product-api/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/services/utils/CandidateEntityBuilder.java
+++ b/openecomp-be/lib/openecomp-sdc-vendor-software-product-lib/openecomp-sdc-vendor-software-product-api/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/services/utils/CandidateEntityBuilder.java
@@ -56,7 +56,7 @@ public class CandidateEntityBuilder {
       Map<String, List<ErrorMessage>> uploadErrors) throws Exception {
     //mdcDataDebugMessage.debugEntryMessage("VSP Id", vspDetails.getId());
 
-    try (InputStream zipFileManifest = contentMap.getFileContent(SdcCommon.MANIFEST_NAME)) {
+    try (InputStream zipFileManifest = contentMap.getFileContentAsStream(SdcCommon.MANIFEST_NAME)) {
       HeatFileAnalyzer heatFileAnalyzer = new HeatFileAnalyzerRowDataImpl();
       AnalyzedZipHeatFiles analyzedZipHeatFiles =
           heatFileAnalyzer.analyzeFilesNotEligibleForModulesFromFileAnalyzer(contentMap.getFiles());
@@ -87,7 +87,7 @@ public class CandidateEntityBuilder {
                                                      FileContentHandler fileContentHandler,
                                                      AnalyzedZipHeatFiles analyzedZipHeatFiles)
       throws IOException {
-    try (InputStream manifest = fileContentHandler.getFileContent(SdcCommon.MANIFEST_NAME)) {
+    try (InputStream manifest = fileContentHandler.getFileContentAsStream(SdcCommon.MANIFEST_NAME)) {
 
       if (Objects.isNull(manifest)) {
         Optional<ManifestContent> manifestContentOptional =
diff --git a/openecomp-be/lib/openecomp-sdc-vendor-software-product-lib/openecomp-sdc-vendor-software-product-core/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/services/impl/etsi/ETSIServiceImpl.java b/openecomp-be/lib/openecomp-sdc-vendor-software-product-lib/openecomp-sdc-vendor-software-product-core/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/services/impl/etsi/ETSIServiceImpl.java
index e727078daa..ca60577b29 100644
--- a/openecomp-be/lib/openecomp-sdc-vendor-software-product-lib/openecomp-sdc-vendor-software-product-core/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/services/impl/etsi/ETSIServiceImpl.java
+++ b/openecomp-be/lib/openecomp-sdc-vendor-software-product-lib/openecomp-sdc-vendor-software-product-core/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/services/impl/etsi/ETSIServiceImpl.java
@@ -152,12 +152,11 @@ public class ETSIServiceImpl implements ETSIService {
     private Optional<Path> updateNonManoPathInHandler(final FileContentHandler handler, final NonManoType nonManoType,
                                                       final Path nonManoOriginalFilePath) {
         final Path fixedSourcePath = fixNonManoPath(nonManoOriginalFilePath);
-        final Map<String, byte[]> packageFileMap = handler.getFiles();
-        if (packageFileMap.containsKey(fixedSourcePath.toString())) {
+        if (handler.containsFile(fixedSourcePath.toString())) {
             final Path newNonManoPath = Paths.get(nonManoType.getType(), nonManoType.getLocation()
                 , fixedSourcePath.getFileName().toString());
-            if (!packageFileMap.containsKey(newNonManoPath.toString())) {
-                packageFileMap.put(newNonManoPath.toString(), packageFileMap.remove(fixedSourcePath.toString()));
+            if (!handler.containsFile(newNonManoPath.toString())) {
+                handler.addFile(newNonManoPath.toString(), handler.remove(fixedSourcePath.toString()));
                 return Optional.of(newNonManoPath);
             }
         }
@@ -254,10 +253,10 @@ public class ETSIServiceImpl implements ETSIService {
         ToscaMetadata metadata;
         if (handler.containsFile(TOSCA_META_PATH_FILE_NAME)) {
             metadata = OnboardingToscaMetadata
-                .parseToscaMetadataFile(handler.getFileContent(TOSCA_META_PATH_FILE_NAME));
+                .parseToscaMetadataFile(handler.getFileContentAsStream(TOSCA_META_PATH_FILE_NAME));
         } else if (handler.containsFile(TOSCA_META_ORIG_PATH_FILE_NAME)) {
             metadata = OnboardingToscaMetadata
-                .parseToscaMetadataFile(handler.getFileContent(TOSCA_META_ORIG_PATH_FILE_NAME));
+                .parseToscaMetadataFile(handler.getFileContentAsStream(TOSCA_META_ORIG_PATH_FILE_NAME));
         } else {
             throw new IOException("TOSCA.meta file not found!");
         }
@@ -267,7 +266,7 @@ public class ETSIServiceImpl implements ETSIService {
     private ToscaMetadata getOriginalMetadata(final FileContentHandler handler) throws IOException {
         if (handler.containsFile(TOSCA_META_ORIG_PATH_FILE_NAME)) {
             return OnboardingToscaMetadata
-                .parseToscaMetadataFile(handler.getFileContent(TOSCA_META_ORIG_PATH_FILE_NAME));
+                .parseToscaMetadataFile(handler.getFileContentAsStream(TOSCA_META_ORIG_PATH_FILE_NAME));
         } else {
             throw new IOException(String.format("%s file not found", TOSCA_META_ORIG_PATH_FILE_NAME));
         }
@@ -276,9 +275,9 @@ public class ETSIServiceImpl implements ETSIService {
     private InputStream getManifestInputStream(FileContentHandler handler, String manifestLocation) throws IOException {
         InputStream io;
         if (manifestLocation == null || !handler.containsFile(manifestLocation)) {
-            io = handler.getFileContent(MAIN_SERVICE_TEMPLATE_MF_FILE_NAME);
+            io = handler.getFileContentAsStream(MAIN_SERVICE_TEMPLATE_MF_FILE_NAME);
         } else {
-            io = handler.getFileContent(manifestLocation);
+            io = handler.getFileContentAsStream(manifestLocation);
         }
 
         if (io == null) {
diff --git a/openecomp-be/lib/openecomp-sdc-vendor-software-product-lib/openecomp-sdc-vendor-software-product-core/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/services/impl/filedatastructuremodule/CandidateServiceImpl.java b/openecomp-be/lib/openecomp-sdc-vendor-software-product-lib/openecomp-sdc-vendor-software-product-core/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/services/impl/filedatastructuremodule/CandidateServiceImpl.java
index 07dc53dfae..5535416838 100644
--- a/openecomp-be/lib/openecomp-sdc-vendor-software-product-lib/openecomp-sdc-vendor-software-product-core/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/services/impl/filedatastructuremodule/CandidateServiceImpl.java
+++ b/openecomp-be/lib/openecomp-sdc-vendor-software-product-lib/openecomp-sdc-vendor-software-product-core/src/main/java/org/openecomp/sdc/vendorsoftwareproduct/services/impl/filedatastructuremodule/CandidateServiceImpl.java
@@ -132,7 +132,7 @@ public class CandidateServiceImpl implements CandidateService {
         analyzedZipHeatFiles);
     handleOtherResources(tree, usedEnvFiles, structure);
     FilesDataStructure fileDataStructureFromManifest =
-        createFileDataStructureFromManifest(zipContentMap.getFileContent(SdcCommon.MANIFEST_NAME));
+        createFileDataStructureFromManifest(zipContentMap.getFileContentAsStream(SdcCommon.MANIFEST_NAME));
     List<String> structureArtifacts = structure.getArtifacts();
     structureArtifacts.addAll(fileDataStructureFromManifest.getArtifacts().stream().filter
         (artifact -> isNotStrctureArtifact(structureArtifacts, artifact))
diff --git a/openecomp-be/lib/openecomp-sdc-vendor-software-product-lib/openecomp-sdc-vendor-software-product-core/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/dao/ServiceModelDaoFactoryTest.java b/openecomp-be/lib/openecomp-sdc-vendor-software-product-lib/openecomp-sdc-vendor-software-product-core/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/dao/ServiceModelDaoFactoryTest.java
index 3e37125442..1118260a16 100644
--- a/openecomp-be/lib/openecomp-sdc-vendor-software-product-lib/openecomp-sdc-vendor-software-product-core/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/dao/ServiceModelDaoFactoryTest.java
+++ b/openecomp-be/lib/openecomp-sdc-vendor-software-product-lib/openecomp-sdc-vendor-software-product-core/src/test/java/org/openecomp/sdc/vendorsoftwareproduct/dao/ServiceModelDaoFactoryTest.java
@@ -174,7 +174,7 @@ public class ServiceModelDaoFactoryTest {
     artifacts.put("art4", ("this is art4 desc:" + CommonMethods.nextUuId()).getBytes());
 
     FileContentHandler fileContentHandler = new FileContentHandler();
-    fileContentHandler.putAll(artifacts);
+    fileContentHandler.setFiles(artifacts);
     return fileContentHandler;
   }
 
diff --git a/openecomp-be/lib/openecomp-tosca-converter-lib/openecomp-tosca-converter-core/src/main/java/org/openecomp/core/impl/AbstractToscaSolConverter.java b/openecomp-be/lib/openecomp-tosca-converter-lib/openecomp-tosca-converter-core/src/main/java/org/openecomp/core/impl/AbstractToscaSolConverter.java
index f0d8bb2b3c..ce7024015b 100644
--- a/openecomp-be/lib/openecomp-tosca-converter-lib/openecomp-tosca-converter-core/src/main/java/org/openecomp/core/impl/AbstractToscaSolConverter.java
+++ b/openecomp-be/lib/openecomp-tosca-converter-lib/openecomp-tosca-converter-core/src/main/java/org/openecomp/core/impl/AbstractToscaSolConverter.java
@@ -96,7 +96,7 @@ public abstract class AbstractToscaSolConverter extends AbstractToscaConverter {
     private String getMainServiceDefinitionFileName(FileContentHandler contentHandler) throws IOException {
         try {
             ToscaMetadata toscaMetadata = OnboardingToscaMetadata.parseToscaMetadataFile(
-                    contentHandler.getFileContent(TOSCA_META_PATH_FILE_NAME));
+                    contentHandler.getFileContentAsStream(TOSCA_META_PATH_FILE_NAME));
             return toscaMetadata.getMetaEntries().get(TOSCA_META_ENTRY_DEFINITIONS);
         } catch (IOException e) {
             LOGGER.error(e.getMessage(), e);
diff --git a/openecomp-be/lib/openecomp-tosca-lib/src/main/java/org/openecomp/sdc/tosca/services/impl/ToscaFileOutputServiceCsarImpl.java b/openecomp-be/lib/openecomp-tosca-lib/src/main/java/org/openecomp/sdc/tosca/services/impl/ToscaFileOutputServiceCsarImpl.java
index f4e0ae409e..29b083853a 100644
--- a/openecomp-be/lib/openecomp-tosca-lib/src/main/java/org/openecomp/sdc/tosca/services/impl/ToscaFileOutputServiceCsarImpl.java
+++ b/openecomp-be/lib/openecomp-tosca-lib/src/main/java/org/openecomp/sdc/tosca/services/impl/ToscaFileOutputServiceCsarImpl.java
@@ -123,7 +123,7 @@ public class ToscaFileOutputServiceCsarImpl implements ToscaFileOutputService {
     for (String filenameIncludingPath : externalArtifacts.getFileList()) {
       try {
         zos.putNextEntry(new ZipEntry(filenameIncludingPath));
-        writeBytesToZip(zos, externalArtifacts.getFileContent(filenameIncludingPath));
+        writeBytesToZip(zos, externalArtifacts.getFileContentAsStream(filenameIncludingPath));
 
       } catch (IOException ex) {
         throw new RuntimeException(ex);
@@ -143,7 +143,7 @@ public class ToscaFileOutputServiceCsarImpl implements ToscaFileOutputService {
     for (String fileName : artifacts.getFileList()) {
       try {
         zos.putNextEntry(new ZipEntry(ARTIFACTS_FOLDER_NAME + FILE_SEPARATOR + fileName));
-        writeBytesToZip(zos, artifacts.getFileContent(fileName));
+        writeBytesToZip(zos, artifacts.getFileContentAsStream(fileName));
 
       } catch (IOException ex) {
         throw new RuntimeException(ex);
diff --git a/openecomp-be/lib/openecomp-tosca-lib/src/test/java/org/openecomp/sdc/tosca/services/impl/ToscaFileOutputServiceCsarImplTest.java b/openecomp-be/lib/openecomp-tosca-lib/src/test/java/org/openecomp/sdc/tosca/services/impl/ToscaFileOutputServiceCsarImplTest.java
index 92374f57fe..5054c09fab 100644
--- a/openecomp-be/lib/openecomp-tosca-lib/src/test/java/org/openecomp/sdc/tosca/services/impl/ToscaFileOutputServiceCsarImplTest.java
+++ b/openecomp-be/lib/openecomp-tosca-lib/src/test/java/org/openecomp/sdc/tosca/services/impl/ToscaFileOutputServiceCsarImplTest.java
@@ -104,7 +104,7 @@ public class ToscaFileOutputServiceCsarImplTest {
 
 
         FileContentHandler heatFiles = new FileContentHandler();
-        heatFiles.putAll(dummyHeatArtifacts);
+        heatFiles.setFiles(dummyHeatArtifacts);
         Map<String, byte[]> licenseArtifacts = new HashMap<>();
 
         FileContentHandler licenseArtifactsFiles = new FileContentHandler();
@@ -116,7 +116,7 @@ public class ToscaFileOutputServiceCsarImplTest {
                 ToscaFileOutputServiceCsarImpl.EXTERNAL_ARTIFACTS_FOLDER_NAME + File.separator +
                         "license-file-2.xml", file1Content.getBytes());
 
-        licenseArtifactsFiles.putAll(licenseArtifacts);
+        licenseArtifactsFiles.setFiles(licenseArtifacts);
 
         byte[] csarFile = toscaFileOutputServiceCSARImpl.createOutputFile(
                 new ToscaServiceModel(heatFiles, definitionsInput,