[carbolymer]

Context

Part of:

• Add a dedicated pool registration certificate creation command to register or update a pool’s BLS key using existing pool parameters #1479

This PR does not close the issue: a follow-up PR adds the other two parameter sources, and a developer portal PR documents the signing workflow.

The new cardano-cli dijkstra stake-pool bls-registration-certificate offline command reads an existing pool registration certificate. It keeps every pool parameter and replaces only the BLS key and its proof of possession. It prints the pool ID and the old and new keys, and warns if they are equal. It accepts Conway-era certificates, including the older CertificateShelley and CertificateConway envelope types, and treats them as having no BLS key. A pool can therefore register its first BLS key right after the hard fork, when this is the only kind of certificate its operator has.

offline is a subcommand because a follow-up PR adds an online sibling, which queries a node by pool ID for the current or pending parameters. That PR also adds a second offline source, the output of query pool-state. Both depend on:

• Add query leios-committee and base query pool-state #1478

There are two deliberate differences from the issue text. First, the command takes --bls-signing-key-file, not a BLS verification key plus a proof of possession. This matches stake-pool registration-certificate since the PR below, which removed standalone proof-of-possession files. So checking the key means checking the signing key file, because a proof built from that key is always valid.

• Remove issue-pop-BLS and key-hash-BLS commands #1449

Second, the "pool parameters file" in the issue will be the query pool-state output, which arrives in the follow-up PR.

The signing workflow (owner and cold-key witnesses, then transaction assemble) will be documented in the developer portal in a separate PR.

How to trust this PR

Golden tests cover these cases:

• rotating a key on a pool with non-trivial parameters (margin, two kinds of relay, metadata)
• a first registration
• the same key again
• a Conway-era input certificate
• a certificate with the legacy envelope type
• a non-pool certificate, which is rejected

An end-to-end Hedgehog property generates pool parameters and passes them through the CLI. It checks that only the BLS key changes. The help output has golden files too.

Checklist

• Commit sequence broadly makes sense and commits have useful messages
• New tests are added if needed and existing tests are updated. See Running tests for more details
• Self-reviewed the diff
• Changelog fragment added in .changes/

[carbolymer]

Fix for duplicated entries in GHA cache

[Copilot]

🔵 Needs a closer look

Conway and legacy-envelope compatibility relies on cardano-api/ledger decoders absent from this checkout, so the cross-era golden tests must be confirmed against pinned dependencies before approval.

No open issues 🎉

What changed in this PR

Adds dijkstra stake-pool bls-registration-certificate offline so pool operators can register or rotate a BLS key using an existing registration certificate without re-entering unrelated pool parameters. This implements the certificate-file portion of #1479; other parameter sources and signing documentation remain follow-up work.

Changes:

• Adds command parsing and execution, BLS key reporting, same-key warnings, and rejection of non-pool certificates.
• Adds property tests, golden tests, certificate fixtures, and help output covering parameter preservation and compatibility scenarios.
• Documents the feature in the changelog and updates the CI Cabal-cache action.

File	Description
cardano-cli/​test/​cardano-cli-test/​Test/​Cli/​Certificates/​StakePoolBlsKey.hs	Adds a property checking preservation of all non-BLS parameters.
cardano-cli/​test/​cardano-cli-golden/​Test/​Golden/​Dijkstra/​StakePool/​BlsRegistrationCertificate.hs	Tests rotation, first registration, legacy inputs, warnings, and rejection.
cardano-cli/​test/​cardano-cli-golden/​files/​input/​shelley/​keys/​bls_keys/​signing_key_2	Supplies a second test key for rotation.
cardano-cli/​test/​cardano-cli-golden/​files/​input/​dijkstra/​stake_pool/​registration_certificate.json	Supplies a basic Dijkstra registration fixture.
cardano-cli/​test/​cardano-cli-golden/​files/​input/​dijkstra/​stake_pool/​registration_certificate_rich_params.json	Supplies a fixture with margin, relays, and metadata.
cardano-cli/​test/​cardano-cli-golden/​files/​input/​conway/​stake_pool/​registration_certificate_rich_params.json	Supplies a Conway compatibility fixture.
cardano-cli/​test/​cardano-cli-golden/​files/​input/​conway/​stake_address/​always_abstain_deleg.cert	Supplies a non-pool certificate for rejection testing.
cardano-cli/​test/​cardano-cli-golden/​files/​golden/​help/​dijkstra_stake-pool.cli	Lists the new stake-pool command.
cardano-cli/​test/​cardano-cli-golden/​files/​golden/​help/​dijkstra_stake-pool_bls-registration-certificate_offline.cli	Records offline command options and help.
cardano-cli/​test/​cardano-cli-golden/​files/​golden/​help.cli	Updates aggregate help output.
cardano-cli/​test/​cardano-cli-golden/​files/​golden/​dijkstra/​stake_pool/​bls_registration_certificate.json	Records the expected rotated certificate.
cardano-cli/​src/​Cardano/​CLI/​Type/​Error/​StakePoolCmdError.hs	Adds an error for non-registration certificates.
cardano-cli/​src/​Cardano/​CLI/​EraBased/​StakePool/​Run.hs	Reads parameters, replaces the BLS key, reports changes, and writes the certificate.
cardano-cli/​src/​Cardano/​CLI/​EraBased/​StakePool/​Option.hs	Adds Dijkstra-only offline command parsing.
cardano-cli/​src/​Cardano/​CLI/​EraBased/​StakePool/​Command.hs	Defines command arguments and the certificate parameter source.
cardano-cli/​cardano-cli.cabal	Registers both new test modules.
.github/​workflows/​haskell.yml	Updates the Cabal-cache action to 0.0.1.1.
.changes/​20261028_bls_registration_certificate.yml	Documents the new command and supported inputs.

_{Review effort: Balanced}