12

Unlocked Packages are just the perfect compromise for everybody working with Salesforce code that he is delivering (for money) to a customer (or two).

Managed packages are too much overhead (become a Partner, do Security Review) and Unmanaged Packages are just not usable (due to their inability to upgrade them).

So, would a developer who is currently deploying an app's source code to customer A and B also be allowed to bundle and managed this via a DX Unlocked package?

Please answer with references to official docs and not just hear-say. My gut feeling already tells me that if this would be possible it could probably harm existing AppExchange processes.

Improve this question
9
  • 2
    I'm not really sure where you're coming from on this - what's the fundamental difference between using an unmanaged/unlocked package to install code compared with deploying it to a sandbox and then using a change set? In both cases the code is visible to the users on the subscriber org. I would think that this sort of non-code question would be better aimed at the Salesforce forums than here...
    – Phil W
    Commented Jul 2, 2019 at 11:25
  • Put aside the question if this is the best place to ask: Are you saying this should be legal? Do you think the main reason for the expensive and complicated ISV and Security Review process is to hide my source code?
    – Robert Sösemann
    Commented Jul 2, 2019 at 11:28
  • 2
    Are you part of the Partner ecosystem? If so, I'd ask on the partner forums.
    – Phil W
    Commented Jul 2, 2019 at 11:41
  • 1
    To your comment about the "expensive and complicated ISV/Security Review process" - there are basically two parts to this: 1) you get advertised on the AppExchange, and (potential) customers know your app/product conforms to Salesforce's security requirements. 2) your IPR is entirely protected so people can't just copy your config and code to use it without payment.
    – Phil W
    Commented Jul 2, 2019 at 11:42
  • 1
    On TB Community, the Unlocked Packages and Managed 2GPs group is where to ask, and is frequented by the PMs. But note that that group's description says "Unlocked Packages (GA in Winter '19) that is designed for Enterprise Customers and System Integrators to organize, distribute and manage Apps and Metadata on Salesforce Platform." So they're clearly intending it for reuse of code by vendors. (PS: Push upgrades is another major feature offered only to reviewed AppEx packages.)
    – Thomas Taylor
    Commented Jul 2, 2019 at 12:12

2 Answers 2

Reset to default
17

TLDR: No, Unlocked Packages cannot be used like this. Anyone commercially distributing a Salesforce app must do so using Managed Packages. Also, Managed Packages offer many valuable features simply not available in Unlocked Packages.

This is a great question, Robert! Thank you for asking it.

I'll do my best to answer both parts of this question:

  • Can someone distribute an app using unlocked packages?
  • Should someone distribute an app using unlocked packages?

Can someone distribute an app using unlocked packages?

First, since your hypothetical Salesforce Developer is "working with Salesforce code that [they are] delivering (for money)", the exact situation we need to consider is the commercial distribution of an application to a third party.

In order to create their app, your hypothetical Salesforce Developer would need to use one or more Salesforce development tools. This would include, but not be limited to, DE Orgs, Scratch Orgs, the Salesforce CLI, etc.

Use of any of these tools requires the acceptance of the Salesforce Developer Services MSA. There's a lot of stuff in there, but here's the key bit:

You may not, without Our prior written consent, access or use any Salesforce services, including the Developer Services, to Commercially Distribute Your Application to third parties unless You are authorized to do so pursuant to a separate agreement with Us.

The "separate agreement" that's needed in this case would be the Salesforce Partner Program Agreement (SPPA). Again, lots of stuff there but here's the key bit:

To participate in the Partner Program, Partner must be enrolled in a Program Type. To enroll in a Program Type, Partner must fulfill the Participation Qualifications set forth in the applicable Program Type’s Program Policies, and be accepted for the applicable Program Type by SFDC

The applicable Program Type for our hypothetical Salesforce Developer would be "AppExchange Partner". The policies that govern the requirements of enrolling as an AppExchange Partner can be found here: Program Year 2020 Salesforce Partner Program Policies.

The key bit in the Program Policies doc is the list of "Participation Criteria" for AppExchange Partners:

  • Completion of SFDC’s legal due diligence process, provided it results in approval by SFDC
  • Participation in one of the AppExchange Partner Categories described in these Program Policies
  • Approval of the Partner’s application(s) through SFDC’s Security Review and Assessment

That third bullet (bolded by me) is the important one.

All AppExchange Partners must put their apps through Security Review, and all apps submitted for Security Review must be submitted as Managed Packages. The only exception to this is when you're submitting an "API Only" app for Security Review (which makes sense because there's no Salesforce code to review in that case).

So, after all those hops from contract to contract, the end result is this:

Unlocked Packages cannot be used in the manner you described because anyone who wants to commercially distribute a Salesforce app must do so using Managed Packages.

Now for the second question.

Should someone distribute an app using unlocked packages?

I can see how Unlocked Packages may seem appealing in the short term, given the use case that Robert outlined. However, I would argue that the long-term benefits of using Managed Packages outweigh what seem like the short-term conveniences to the hypothetical Salesforce Developer.

Managed Packages give you many things that Unlocked Packages don't, including:

  • IP Protection
  • License Management
  • Subscriber Console
  • Feature Management
  • Patch Orgs
  • Push Upgrades

So, even if it weren't for all the legal reasons why the hypothetical Salesforce Developer MUST use Managed Packages, there are lots of reasons why they SHOULD use Managed Packages.

Improve this answer
7
  • 1
    As per discussion on Twitter, I believe there is nothing wrong with an ISV using unlocked 2GP as "standardized configuration packages" on top of their commercial offering (the latter realized as a managed 1GP or 2GP) as long as these are not in themselves offered for sale and it is the core package that is licensed. Being unlocked allows the configuration to be further adjusted to meet specific customer needs. I suspect Salesforce hasn't really thought about this use case.
    – Phil W
    Commented Sep 26, 2022 at 11:58
  • 1
    ... In essence, this use case is identical to one where metadata is simply deployed rather than installed in the target org, and it's not like Salesforce disallows such behaviour from ISVs. It's just that installing an unlocked package is cleaner than using Change Sets (IMHO) since unit tests are isolated from other changes made on the target org.
    – Phil W
    Commented Sep 26, 2022 at 12:00
  • 1
    @PhilW - Using unlocked packages is OK so long as you're giving them to your customer as free, unlicensed add-ons AFTER distributing your core commercial solution via a managed package. Your "standardized configuration packages" use case fits this model well and would not run afoul of the MSAs and partner agreements referenced by my answer. You're good to go! :-)
    – Vivek M. Chawla
    Commented Sep 27, 2022 at 4:31
  • 1
    @RichardCorfield - Unlocked packages are appropriate in the use case you specified.
    – Vivek M. Chawla
    Commented Mar 2 at 10:45
  • 1
    @RichardCorfield - Transferring an unlocked package is something the customer can request. No security review is required because the metadata is completely open for inspection.
    – Vivek M. Chawla
    Commented Mar 4 at 19:26
0

A detailed and complete answer was given in this Partner Community thread by Salesforce officials.

According to the Developer MSA, commercial distribution of the partner's app would require a supplemental agreement. This would be the Salesforce Partner Program Agreement.

If a Partner wants to commercially distribute their app, then they do so as an AppExchange Partner. The program requirements of being an AppExchange Partner can be found in the Program Year 2020 Salesforce Partner Program Policies.

The Program Policies state that "Approval of the Partner’s application(s) through SFDC’s Security Review and Assessment" is required to participate in the AppExchange Partner Program.

My understanding is that only managed packages can be put through the Security Review process, which explains @Manishi Singh (Salesforce)'s comment.

To sum it up:

  1. Whoever wants to make money with building and contributing software on the Salesforce.com platform has to become some kind of partner.
  2. The Partner contracts requires you to distribute all commercial code artifacts via Managed Packages that go through a Security Review.
  3. Therefore DX Unlocked Package cannot be used.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .