Verify the authenticity of a plugin being installed with plugins install.
This plugin is bundled with the Salesforce CLI. For more information on the CLI, read the getting started guide.
We always recommend using the latest version of these commands bundled with the CLI, however, you can install a specific version or tag if needed.
If a plugin needs to be installed in a unattended fashion as is the case with automation. The plugin acceptance prompt can be avoided by placing the plugin name in $HOME/.config/sf/unsignedPluginAllowList.json
[
"@salesforce/npmName",
"plugin2",
...
]If a plugin is not signed you then won't get a prompt confirming the installation of an unsigned plugin. Instead you'll get a message stating that the plugin was allowlisted and the installation will proceed as normal.
In addition to signature verification additional checks are in place to help ensure authenticity of plugins.
Host - The public key url and signature urls must use an https scheme and originate from an approved host: developer.salesforce.com or cli-assets.heroku.com.
Signature - The plugin tarball's RSA-SHA256 signature is verified against the public key served from the approved host.
sf plugins install trust@x.y.zPlease report any issues at https://github.com/forcedotcom/cli/issues
If you're interested in contributing, take a look at the CONTRIBUTING guide.
To build the plugin locally, make sure to have yarn installed and run the following commands:
# Clone the repository
git clone git@github.com:salesforcecli/plugin-trust
# Install the dependencies and compile
yarn && yarn buildTo use your plugin, run using the local ./bin/dev.js or ./bin/dev.cmd file.
# Run using local run file.
./bin/dev.js plugins trustThere should be no differences when running via the Salesforce CLI or using the local run file. However, it can be useful to link the plugin to do some additional testing or run your commands from anywhere on your machine.
# Link your plugin to the sf cli
sf plugins link .
# To verify
sf plugins@salesforce/plugin-trust plugins trust allowlist add@salesforce/plugin-trust plugins trust allowlist list@salesforce/plugin-trust plugins trust allowlist remove@salesforce/plugin-trust plugins trust verify
Add plugins to the plugin allowlist.
USAGE
$ @salesforce/plugin-trust plugins trust allowlist add -n <value>... [--json] [--flags-dir <value>]
FLAGS
-n, --name=<value>... (required) The npm name of the plugin to add to the allowlist. Add multiple plugins by
specifying the `--name` flag multiple times.
GLOBAL FLAGS
--flags-dir=<value> Import flag values from a directory.
--json Format output as json.
DESCRIPTION
Add plugins to the plugin allowlist.
The plugin allowlist lets users automatically install a plugin without being prompted, even when the plugin is
unsigned.
This command adds one or more plugins to the `unsignedPluginAllowList.json` file, creating the file if it doesn't
exist. Plugins already present in the allowlist are skipped.
EXAMPLES
Add a single plugin to the allowlist:
$ @salesforce/plugin-trust plugins trust allowlist add --name @scope/my-plugin
Add multiple plugins to the allowlist:
$ @salesforce/plugin-trust plugins trust allowlist add --name @scope/my-plugin --name another-plugin
See code: src/commands/plugins/trust/allowlist/add.ts
List the plugins on the plugin allowlist.
USAGE
$ @salesforce/plugin-trust plugins trust allowlist list [--json] [--flags-dir <value>]
GLOBAL FLAGS
--flags-dir=<value> Import flag values from a directory.
--json Format output as json.
DESCRIPTION
List the plugins on the plugin allowlist.
The plugin allowlist lets users automatically install a plugin without being prompted, even when the plugin is
unsigned.
This command prints the contents of the `unsignedPluginAllowList.json` file as a table.
EXAMPLES
List all plugins on the allowlist:
$ @salesforce/plugin-trust plugins trust allowlist list
See code: src/commands/plugins/trust/allowlist/list.ts
Remove plugins from the plugin allowlist.
USAGE
$ @salesforce/plugin-trust plugins trust allowlist remove -n <value>... [--json] [--flags-dir <value>]
FLAGS
-n, --name=<value>... (required) The npm name of the plugin to remove from the allowlist. Remove multiple plugins by
specifying the `--name` flag multiple times.
GLOBAL FLAGS
--flags-dir=<value> Import flag values from a directory.
--json Format output as json.
DESCRIPTION
Remove plugins from the plugin allowlist.
The plugin allowlist lets users automatically install a plugin without being prompted, even when the plugin is
unsigned.
This command removes one or more plugins from the `unsignedPluginAllowList.json` file. Plugins not present in the
allowlist are skipped.
EXAMPLES
Remove a single plugin from the allowlist:
$ @salesforce/plugin-trust plugins trust allowlist remove --name @scope/my-plugin
Remove multiple plugins from the allowlist:
$ @salesforce/plugin-trust plugins trust allowlist remove --name @scope/my-plugin --name another-plugin
See code: src/commands/plugins/trust/allowlist/remove.ts
Validate a digital signature.
USAGE
$ @salesforce/plugin-trust plugins trust verify -n <value> [--json] [--flags-dir <value>] [-r <value>]
FLAGS
-n, --npm=<value> (required) Specify the npm name. This can include a tag/version.
-r, --registry=<value> The registry name. The behavior is the same as npm.
GLOBAL FLAGS
--flags-dir=<value> Import flag values from a directory.
--json Format output as json.
DESCRIPTION
Validate a digital signature.
Verifies the digital signature on an npm package matches the signature and key stored at the expected URLs.
EXAMPLES
$ @salesforce/plugin-trust plugins trust verify --npm @scope/npmName --registry https://github.com/proxy/npm.pkg.github.com/
$ @salesforce/plugin-trust plugins trust verify --npm @scope/npmName
See code: src/commands/plugins/trust/verify.ts