Can a Managed Package with a password be imported through SFDX?

Question

We are currently trying to figure out whether/how we might use SFDX.

Our org has FinancialForce Accounting installed. This managed package is required by several other managed packages and it heavily integrated into our code-base (of course, without the use of any wrapper class).

To install FinancialForce Accounting, a password is required. Or, at least that is the error reported by sfdx force:org:mdapi deploy.

Assuming someone in our org knows or can recover the password, will it be possible to use SFDX to script deploying this package to scratch orgs?

If so, how can we include the password within our project so it would be available to SFDX?

Would it be possible to do this in a secure way, limiting exposure of the password?

Answer 1

For now, the only ways to install the package require the key. This includes the method in my old answer, or the newer feature force:package:install that lets you specify the installation key from a command-line script.

The second method may be more promising. While you can't do anything with DX directly, you could, for example, grab the password from a private server in a script. I'm not a bash guru, so do some research, but you could start from here:

package_password = $(wget http://passwords.local/abc-password -q -O -)
sfdx force:package:install ... -k $package_password

Given that the password would be stored on a server that can only be accessed locally, this would limit exposure to the password. Slap on some extra security of some sort, and you could really have a secure solution for the passwords.

The DX team has acknowledged that requiring the installation key is a problem, but we don't know when, or, if, they'll release a solution that allows us to bypass the key for certain situations. For now, any solution you use will necessarily need to be "outside" of the DX context.