Nullifying Precipitation Machine

    @salesforce/sfdx-trust
    TypeScript icon, indicating that this package has built-in type declarations

    3.6.0 • Public • Published

    Overview

    Use the sfdx_trust commands to digitally sign and verify your plugins.

    Two command are offerered:

    1. plugins:trust:sign - This produces a packed npm with a digital signature. The npm gets published to the npm registry and the signature file is published to target url specified in the signature url. See command details.

    2. plugins:trust:verify - This command verifies the digital siganture of a published npm. This verification is the same verification that occurs during sfdx plugins:install.

    Allowlisting

    If a plugin needs to be installed in a unattended fashion as is the case with automation. The plugin acceptance prompt can be avoided by placing the plugin name in $HOME/.config/sfdx/unsignedPluginAllowList.json

    [    
        "@salesforce/npmName",
        "plugin2",
        ...
    ]

    If a plugin is not signed you then won't get a prompt confirming the installation of an unsigned plugin. Instead you'll get a message logged stating that the plugin was allowlisted and the installation will proceed as normal.

    Additional Verification Information

    In addition to signature verification additional checks are in place to help ensure authenticity of plugins.

    1. DNS - The public key url and signature urls must have an https scheme and originate from developer.salesforce.com
    2. Cert Pinning - The digial fingerprint of developer.salesforce.com's certificate is validated. This helps prevent man in the middle attacks.

    Relevant Environment Variables

    Use the following environment variable settings with caution.

    • NODE_TLS_REJECT_UNAUTHORIZED: enables self signed certificates.
    • SFDX_DEVELOPER_TRUSTED_FINGERPRINT: Allows changing the expected digital fingerprint.
    • SFDX_ALLOW_ALL_SALESFORCE_CERTSIG_HOSTING: Enlarges the circle of trust to include any salesforce.com host.
    • SFDX_DISABLE_CERT_PINNING: Completly disable the fingerprint check.

    Command Details

    @salesforce/sfdx-trust <%= command.id %> -s <string> -p <string> -k <string> [--json] [--loglevel trace|debug|info|warn|error|fatal]

    pack an npm package and produce a tgz file along with a corresponding digital signature

    USAGE
      $ @salesforce/sfdx-trust plugins:trust:sign -s <string> -p <string> -k <string> [--json] [--loglevel 
      trace|debug|info|warn|error|fatal]
    
    OPTIONS
      -k, --privatekeypath=privatekeypath             (required) the local file path for the private key.
      -p, --publickeyurl=publickeyurl                 (required) the url where the public key/certificate will be hosted.
    
      -s, --signatureurl=signatureurl                 (required) the url location where the signature will be hosted minus
                                                      the name of the actual signature file.
    
      --json                                          format output as json
    
      --loglevel=(trace|debug|info|warn|error|fatal)  [default: warn] logging level for this command invocation
    
    EXAMPLE
      $ sfdx plugins:trust:sign --signature npmName-0.0.1.sig --publicKeyUrl 
      https://developer.salesforce.com/media/salesforce-cli/sfdx.cer --privateKeyPath $HOME/secret.key
    

    See code: dist/commands/plugins/trust/sign.ts

    @salesforce/sfdx-trust <%= command.id %> -n <string> [-r <string>] [--json] [--loglevel trace|debug|info|warn|error|fatal]

    For an npm validate the associated digital signature if it exits.

    USAGE
      $ @salesforce/sfdx-trust plugins:trust:verify -n <string> [-r <string>] [--json] [--loglevel 
      trace|debug|info|warn|error|fatal]
    
    OPTIONS
      -n, --npm=npm                                   (required) Specify the npm name. This can include a tag/version
      -r, --registry=registry                         The registry name. the behavior is the same as npm.
      --json                                          format output as json
      --loglevel=(trace|debug|info|warn|error|fatal)  [default: warn] logging level for this command invocation
    
    EXAMPLES
      $ sfdx plugins:trust:verifySignature --npm @scope/npmName --registry http://my.repo.org:4874
      $ sfdx plugins:trust:verifySignature --npm @scope/npmName
    

    See code: dist/commands/plugins/trust/verify.ts

    Keywords

    Install

    npm i @salesforce/sfdx-trust

    DownloadsWeekly Downloads

    10,090

    Version

    3.6.0

    License

    BSD-3-Clause

    Unpacked Size

    82.4 kB

    Total Files

    26

    Last publish

    Collaborators

    • dlouvton
    • jc-sf
    • pvandyk-sf
    • dbreese-salesforce
    • ashokrudraraju
    • dhersam
    • demianbrecht
    • mmadialagan
    • spoorti.nidagundi
    • rodesp
    • mjrust
    • salesforce-releases
    • conal
    • vazexqi
    • joshwlewis
    • mpsenn
    • sfdc_iamigo
    • kevinv11n
    • tbliss
    • byao
    • pmdartus
    • futuremint_sf
    • interactivellama
    • ekashida
    • gr8gatsby
    • ravi.jayaramappa
    • apapko
    • krisgraysfdc
    • jleen-sfdc
    • jqian
    • cwallsf
    • dhagberg-sf
    • michaelhoefer
    • tlohr
    • khawkins
    • amphro
    • tconn
    • dehru
    • abdulsattar
    • jodarove
    • rxu-sfdc
    • amcconnell-sf
    • nolanlawson
    • sfdctaka
    • fernomac
    • cafreeman
    • jimjag
    • ivarley
    • jbartolotta-sfdc