# How to sign a SFDX Plugin?

I have created my plugin using sfdx plugins:generate and then I deployed it to npm. When I try to install it using sfdx plugins:install I got the message: This plugin is not digitally signed and its authenticity cannot be verified. Continue installation y/n?.

So my question is: How do I do to sign my SFDX Plugin?

Salesforce is still working on this and in future they plan to provide a mechanism how extension authors can sign the plugin .

Currently if you want to avoid that warning , it is a manual process .

If you are on MAC you can find the sfdx folder located at below directory

\$HOME/.config/sfdx

In the sfdx folder create a file named unsignedPluginWhiteList.json and add the below

[
"plugin-name"
]


Here plugin-name is the name of your plugin .

If you are on windows the sfdx directory will be at C:\Users\username.config\sfdx

or %LOCALAPPDATA%\sfdx

If you need to install automatically your plugin, like in a Dockerfile or in a CI process, you can use the following line :

echo 'y' | sfdx plugins:install yourpluginname

• Great workaround! Thank you man! – Saulo Mar 26 at 22:56