7

Unlocked Packages are just the perfect compromise for everybody working with Salesforce code that he is delivering (for money) to a customer (or two).

Managed packages are too much overhead (become a Partner, do Security Review) and Unmanaged Packages are just not usable (due to their inability to upgrade them).

So, would a developer who is currently deploying an app's source code to customer A and B also be allowed to bundle and managed this via a DX Unlocked package?

Please answer with references to official docs and not just hear-say. My gut feeling already tells me that if this would be possible it could probably harm existing AppExchange processes.

  • 1
    I'm not really sure where you're coming from on this - what's the fundamental difference between using an unmanaged/unlocked package to install code compared with deploying it to a sandbox and then using a change set? In both cases the code is visible to the users on the subscriber org. I would think that this sort of non-code question would be better aimed at the Salesforce forums than here... – Phil W Jul 2 '19 at 11:25
  • Put aside the question if this is the best place to ask: Are you saying this should be legal? Do you think the main reason for the expensive and complicated ISV and Security Review process is to hide my source code? – Robert Sösemann Jul 2 '19 at 11:28
  • 2
    Are you part of the Partner ecosystem? If so, I'd ask on the partner forums. – Phil W Jul 2 '19 at 11:41
  • 1
    To your comment about the "expensive and complicated ISV/Security Review process" - there are basically two parts to this: 1) you get advertised on the AppExchange, and (potential) customers know your app/product conforms to Salesforce's security requirements. 2) your IPR is entirely protected so people can't just copy your config and code to use it without payment. – Phil W Jul 2 '19 at 11:42
  • 1
    On TB Community, the Unlocked Packages and Managed 2GPs group is where to ask, and is frequented by the PMs. But note that that group's description says "Unlocked Packages (GA in Winter '19) that is designed for Enterprise Customers and System Integrators to organize, distribute and manage Apps and Metadata on Salesforce Platform." So they're clearly intending it for reuse of code by vendors. (PS: Push upgrades is another major feature offered only to reviewed AppEx packages.) – Thomas Taylor Jul 2 '19 at 12:12
10

TLDR: No, Unlocked Packages cannot be used like this. Anyone commercially distributing a Salesforce app must do so using Managed Packages. Also, Managed Packages offer many valuable features simply not available in Unlocked Packages.

This is a great question, Robert! Thank you for asking it.

I'll do my best to answer both parts of this question:

  • Can someone distribute an app using unlocked packages?
  • Should someone distribute an app using unlocked packages?

Can someone distribute an app using unlocked packages?

First, since your hypothetical Salesforce Developer is "working with Salesforce code that [they are] delivering (for money)", the exact situation we need to consider is the commercial distribution of an application to a third party.

In order to create their app, your hypothetical Salesforce Developer would need to use one or more Salesforce development tools. This would include, but not be limited to, DE Orgs, Scratch Orgs, the Salesforce CLI, etc.

Use of any of these tools requires the acceptance of the Salesforce Developer Services MSA. There's a lot of stuff in there, but here's the key bit:

You may not, without Our prior written consent, access or use any Salesforce services, including the Developer Services, to Commercially Distribute Your Application to third parties unless You are authorized to do so pursuant to a separate agreement with Us.

The "separate agreement" that's needed in this case would be the Salesforce Partner Program Agreement (SPPA). Again, lots of stuff there but here's the key bit:

To participate in the Partner Program, Partner must be enrolled in a Program Type. To enroll in a Program Type, Partner must fulfill the Participation Qualifications set forth in the applicable Program Type’s Program Policies, and be accepted for the applicable Program Type by SFDC

The applicable Program Type for our hypothetical Salesforce Developer would be "AppExchange Partner". The policies that govern the requirements of enrolling as an AppExchange Partner can be found here: Program Year 2020 Salesforce Partner Program Policies.

The key bit in the Program Policies doc is the list of "Participation Criteria" for AppExchange Partners:

  • Completion of SFDC’s legal due diligence process, provided it results in approval by SFDC
  • Participation in one of the AppExchange Partner Categories described in these Program Policies
  • Approval of the Partner’s application(s) through SFDC’s Security Review and Assessment

That third bullet (bolded by me) is the important one.

All AppExchange Partners must put their apps through Security Review, and all apps submitted for Security Review must be submitted as Managed Packages. The only exception to this is when you're submitting an "API Only" app for Security Review (which makes sense because there's no Salesforce code to review in that case).

So, after all those hops from contract to contract, the end result is this:

Unlocked Packages cannot be used in the manner you described because anyone who wants to commercially distribute a Salesforce app must do so using Managed Packages.

Now for the second question.

Should someone distribute an app using unlocked packages?

I can see how Unlocked Packages may seem appealing in the short term, given the use case that Robert outlined. However, I would argue that the long-term benefits of using Managed Packages outweigh what seem like the short-term conveniences to the hypothetical Salesforce Developer.

Managed Packages give you many things that Unlocked Packages don't, including:

  • IP Protection
  • License Management
  • Subscriber Console
  • Feature Management
  • Patch Orgs
  • Push Upgrades

So, even if it weren't for all the legal reasons why the hypothetical Salesforce Developer MUST use Managed Packages, there are lots of reasons why they SHOULD use Managed Packages.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.