10

In Summer 17, there is a new checkbox in Apex Settings: Deploy Metadata from Non-Certified Package Versions via Apex.

I tried to google what does certified package mean but got no luck. Does it mean we will be able to deploy packages which might have some building issues - slightly under test coverage, or some unit test failures - to our orgs with Apex?

  • You come up with some doozies...I am curious now.... – Eric May 10 '17 at 0:04
15

I believe this applies to the direct Apex access to parts of the Metadata API.

My impression is it prevents any old random installed package from using the new functionality to then deploy further Metadata without your permission.

To make clear, deploying (some) metadata from Apex in certified packages is also supported--in fact, it's the primary use case. There's a subscriber org preference to allow non-certified managed packages to do it too, if you want to allow that, but that's a sort of side note.
Avrom Roy-Faderman


From Avrom Roy-Faderman's (Principal developer of custom metadata types and metadata API in Apex) comment:

I can confirm this. In general, installed managed packages don't have access to metadata API in Apex unless they've been certified by our security team (the same process that makes them eligible for AppExchange listing). But

  1. Package developers need to test how their code will function in subscriber organizations before getting certification, and
  2. Some enterprises use managed packaging as part of their internal app lifecycle.

The setting allows package developers' test organizations and enterprises that use managed packaging internally to let those packages run without pre-certification.

I don't think you'll get a more authoritative source than that :)

Security Considerations docs link also provided by Avrom

Be aware of security considerations when accessing metadata using Apex.

Generally, Apex classes installed in the subscriber org can access any public, supported metadata type or component in the subscriber org. Protected metadata, such as a custom metadata type that’s been marked protected, can only be accessed by Apex classes in the same namespace as the protected metadata.

Additionally, for managed packages, if the managed package is not approved by Salesforce via security review, Apex classes in the package cannot access metadata (public or protected) unless the Allow metadata deploy by Apex from non-certified Apex package version org preference is enabled. This preference, located under Setup | Apex Settings, must be enabled if admins or developers are installing managed packages that haven’t passed security review for app testing or pilot purposes.

  • @Eric Fixed. I'm still searching for some more sources to back it up. Pretty sure it is to stop you installing something that then has free reign to modify your metadata (without making a callout) – Daniel Ballinger May 10 '17 at 0:10
  • Ohhhhh...Many people have been waiting for this to be possible.....I won't say game changer but......Its a big step – Eric May 10 '17 at 0:13
  • @Eric If it can be extended to more Metadata types it would be really useful for scenarios where you can't otherwise make a callout. – Daniel Ballinger May 10 '17 at 0:16
  • 4
    I can confirm this. In general, installed managed packages don't have access to metadata API in Apex unless they've been certified by our security team (the same process that makes them eligible for AppExchange listing). But 1) Package developers need to test how their code will function in subscriber organizations before getting certification, and 2) Some enterprises use managed packaging as part of their internal app lifecycle. The setting allows package developer's test organizations and such enterprises to let those packages run without pre-certification. – Avrom Roy-Faderman May 10 '17 at 0:16
  • 1
    @AvromRoy-Faderman - Thank you for your participation in this community. Always appreciated. – Eric May 10 '17 at 0:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.