Managed Base and Extension Packages and the AppExchange: How to deal with Licenses and Security Reviews

Question

A recent question had basically two different answers regarding the usage of features, which might not be available at the target org:

1. Adress the feature in question in a soft way. E.g. use the schema describe to see if a feature or object is available in a particular Org.
2. Build a base package, which can be installed everywhere (GE, PE, EE) and move the code, which deals with special features to an extension package.

We have always chosen route 1, which is more suitable for our customers (install only one package, a trial can be started right away after installation), but i'm intrigued by route 2.

I write down some questions, which do come to mind, when you are creating a base package plus numerous extensions:

1. Which packages are listed at the App Exchange? Only the Base or also the Extensions?
2. Which packages do receive a security review? The base package is an obvious answer, but what do you do with the extensions?
3. How do you deal with per-user-licensing? Does a customer need to purchase licenses for the base package and each extension he is using?

Answer 1

I'll only comment on the security review portion of your questions, and let others handle the licensing/marketing issues.

2. Which packages do receive a security review?

Both. The security review is per package -- really per package version. 2 packages = 2 security reviews. Whether one is a base and another is an extension doesn't matter. Obviously when you set up your testing organization, you will install both into the DE org so that the overall offering is functional, but there will be two different reviews. You can use the same testing organization for both reviews.