2

There are two commands:

sfdx force:package:create --name "MyApp" --description "MyApp" --packagetype Unlocked -r force-app

sfdx force:package:version:create --package MyApp --installationkey securepassword --wait 20

Package Installation URL: https://login.salesforce.com/packaging/installPackage.apexp?p0=xxxxxx

As I understand it the first command creates a package from my project (updating the project json file) and the second one pushes it the Salesforce servers with a password for access.

Where is this package hosted? Is it on our dev hub? Or is it somewhere anyone in the world could install it if they had the url and the password?

Improve this question

1 Answer 1

Reset to default
2

Your options aren't mutually exclusive. The force:package:version:create command docs say that the command "Creates a package version in the Dev Hub org." But your DevHub org is still on a Salesforce instance, and yes, anyone with the package version id and the installation key could install it. From PM Dileep Burki's unofficial FAQ:

An unlocked package can be installed in any Salesforce environment - scratch orgs, sandbox orgs, trial orgs, and production orgs (see here for a note on beta vs released state of a package version).

Further down, under "How can I secure my packages?", he also says:

In future (safe harbor), we have plans to provide additional security mechanisms to enable enhanced security for your packages.

Improve this answer
5
  • Thanks for this. What I was trying to understand is whether there is away to package code up in a controlled way and be able for developers to pull in packages into their scratch orgs and the more control route to live (sandboxes etc). Without putting out source code out there with minimal security controls.
    – Skynet5
    Commented Aug 20, 2019 at 13:28
  • Does my answer get at that enough for you? You certainly can install packages into scratch orgs, and set dependencies between packages.
    – Thomas Taylor
    Commented Aug 20, 2019 at 13:32
  • It does. So to confirm a package in sfdx has little security, so unless you accept the risk of creating a new attack vector in which source code can be leaked by just knowing a url and password, sfdx packaging is of little use. Correct?
    – Skynet5
    Commented Aug 20, 2019 at 13:36
  • I would say "unlocked packaging" specifically, but yes.
    – Thomas Taylor
    Commented Aug 20, 2019 at 13:45
  • OK. So is there another packaging approach that we could look at for avoiding this. We really want to start componentizating our solutions to share discrete functionality across our large estate. And wondering the best approach without such risks of code leakage.
    – Skynet5
    Commented Aug 20, 2019 at 13:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .