Nullifying Precipitation Machine

    TypeScript icon, indicating that this package has built-in type declarations

    3.6.0 • Public • Published


    Use the sfdx_trust commands to digitally sign and verify your plugins.

    Two command are offerered:

    1. plugins:trust:sign - This produces a packed npm with a digital signature. The npm gets published to the npm registry and the signature file is published to target url specified in the signature url. See command details.

    2. plugins:trust:verify - This command verifies the digital siganture of a published npm. This verification is the same verification that occurs during sfdx plugins:install.


    If a plugin needs to be installed in a unattended fashion as is the case with automation. The plugin acceptance prompt can be avoided by placing the plugin name in $HOME/.config/sfdx/unsignedPluginAllowList.json


    If a plugin is not signed you then won't get a prompt confirming the installation of an unsigned plugin. Instead you'll get a message logged stating that the plugin was allowlisted and the installation will proceed as normal.

    Additional Verification Information

    In addition to signature verification additional checks are in place to help ensure authenticity of plugins.

    1. DNS - The public key url and signature urls must have an https scheme and originate from
    2. Cert Pinning - The digial fingerprint of's certificate is validated. This helps prevent man in the middle attacks.

    Relevant Environment Variables

    Use the following environment variable settings with caution.

    • NODE_TLS_REJECT_UNAUTHORIZED: enables self signed certificates.
    • SFDX_DEVELOPER_TRUSTED_FINGERPRINT: Allows changing the expected digital fingerprint.
    • SFDX_ALLOW_ALL_SALESFORCE_CERTSIG_HOSTING: Enlarges the circle of trust to include any host.
    • SFDX_DISABLE_CERT_PINNING: Completly disable the fingerprint check.

    Command Details

    @salesforce/sfdx-trust <%= %> -s <string> -p <string> -k <string> [--json] [--loglevel trace|debug|info|warn|error|fatal]

    pack an npm package and produce a tgz file along with a corresponding digital signature

      $ @salesforce/sfdx-trust plugins:trust:sign -s <string> -p <string> -k <string> [--json] [--loglevel 
      -k, --privatekeypath=privatekeypath             (required) the local file path for the private key.
      -p, --publickeyurl=publickeyurl                 (required) the url where the public key/certificate will be hosted.
      -s, --signatureurl=signatureurl                 (required) the url location where the signature will be hosted minus
                                                      the name of the actual signature file.
      --json                                          format output as json
      --loglevel=(trace|debug|info|warn|error|fatal)  [default: warn] logging level for this command invocation
      $ sfdx plugins:trust:sign --signature npmName-0.0.1.sig --publicKeyUrl --privateKeyPath $HOME/secret.key

    See code: dist/commands/plugins/trust/sign.ts

    @salesforce/sfdx-trust <%= %> -n <string> [-r <string>] [--json] [--loglevel trace|debug|info|warn|error|fatal]

    For an npm validate the associated digital signature if it exits.

      $ @salesforce/sfdx-trust plugins:trust:verify -n <string> [-r <string>] [--json] [--loglevel 
      -n, --npm=npm                                   (required) Specify the npm name. This can include a tag/version
      -r, --registry=registry                         The registry name. the behavior is the same as npm.
      --json                                          format output as json
      --loglevel=(trace|debug|info|warn|error|fatal)  [default: warn] logging level for this command invocation
      $ sfdx plugins:trust:verifySignature --npm @scope/npmName --registry
      $ sfdx plugins:trust:verifySignature --npm @scope/npmName

    See code: dist/commands/plugins/trust/verify.ts



    npm i @salesforce/sfdx-trust

    DownloadsWeekly Downloads






    Unpacked Size

    82.4 kB

    Total Files


    Last publish


    • dlouvton
    • jc-sf
    • pvandyk-sf
    • dbreese-salesforce
    • ashokrudraraju
    • dhersam
    • demianbrecht
    • mmadialagan
    • spoorti.nidagundi
    • rodesp
    • mjrust
    • salesforce-releases
    • conal
    • vazexqi
    • joshwlewis
    • mpsenn
    • sfdc_iamigo
    • kevinv11n
    • tbliss
    • byao
    • pmdartus
    • futuremint_sf
    • interactivellama
    • ekashida
    • gr8gatsby
    • ravi.jayaramappa
    • apapko
    • krisgraysfdc
    • jleen-sfdc
    • jqian
    • cwallsf
    • dhagberg-sf
    • michaelhoefer
    • tlohr
    • khawkins
    • amphro
    • tconn
    • dehru
    • abdulsattar
    • jodarove
    • rxu-sfdc
    • amcconnell-sf
    • nolanlawson
    • sfdctaka
    • fernomac
    • cafreeman
    • jimjag
    • ivarley
    • jbartolotta-sfdc