I have created my plugin using sfdx plugins:generate and then I deployed it to npm. When I try to install it using sfdx plugins:install I got the message: This plugin is not digitally signed and its authenticity cannot be verified. Continue installation y/n?.

So my question is: How do I do to sign my SFDX Plugin?


Salesforce is still working on this and in future they plan to provide a mechanism how extension authors can sign the plugin .

Currently if you want to avoid that warning , it is a manual process .

If you are on MAC you can find the sfdx folder located at below directory


In the sfdx folder create a file named unsignedPluginWhiteList.json and add the below


Here plugin-name is the name of your plugin .

If you are on windows the sfdx directory will be at C:\Users\username.config\sfdx


| improve this answer | |

If you need to install automatically your plugin, like in a Dockerfile or in a CI process, you can use the following line :

echo 'y' | sfdx plugins:install yourpluginname
| improve this answer | |
  • 1
    Great workaround! Thank you man! – Saulo Mar 26 '19 at 22:56
  • You're welcome :) plz mark my response as the good answer if you consider it is :) – Nicolas Vuillamy Jan 10 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.