Firstly sorry for the delay in this messaging from ClickOnce. Judging by the passionate opinions I have heard around the community on this issue, this is a blog we should have posted a while back.

[Hanselman's Blog - http://www.hanselman.com/blog/PermaLink.aspx?guid=7ce42ccd-e531-4d43-a93f-73483c0afd3d]
[Sven Groot's Blog - http://channel9.msdn.com/ShowPost.aspx?PostID=138273]

[Lady bug - http://lab.msdn.microsoft.com/productfeedback/viewfeedback.aspx?feedbackid=5b309bf8-370d-4571-8ce2-aaebb525488b ]

Geting to business; In the V2.0 release of the Framework, ClickOnce does not have support for FireFox. 
-    I do discuss later in this post how application publishers can use the ClickOnce shortcut files to allow FireFox users to install Clickonce applications.

ClickOnce does work on machines where FireFox is the default browser, if the user clicks on the deployment manifest in IE.
-    There is an issues users hit here if their application carries a bootstrapper package, again a workaround is mentioned later in the post.
 
And yes we are actively looking into remedying this in the next release of the Framework.

What happens when I click on a ClickOnce deployment in FireFox?

ClickOnce provides an implemention of the IE mime handler interface for the mime type application/x-ms-application which is associated with .application files on servers hosting ClickOnce application. Hence when a user clicks on a .application in IE our mime handler is invoked which downlods the .application file and fires up the ClickOnce install.

When a user clicks on a .application in FireFox the FireFox equivalent of the Open/Save dialog comes up. Once the .application file is downloaded to the local macine (to the FireFox cache on Open and to a user specified location on Save) it is run form there firing up ClickOnce. ClickOnce now parses the locally downloaded .application and tries to download the actual application manifest it refers to. If the .application contains a relative path to the application manifest ClickOnce will try to find it relative to the .application in the FireFox temp folder and fail. If it is a full Url to the application manifest ClickOnce fails anyway, this time due to a security check we have that does not allow the .application and the corresponding application bits to be in different security zones.

There have been Plugins written by the FireFox community
[e.g. http://www.softwarepunk.com/cohelper/] where they parse the application after it has been downloaded and read the deploymentProvider Url from it. They then use the undocumented Apis for invoking ClickOnce with the URL as a parameter [rundll32 dfshim.dll,ShOpenVerbApplication URL ]. I have never tried the approach above, but would believe it works.
 
From the ClickOnce teams perspective we would advise users against parsing the ClickOnce manifest and relying on its format for we could inadvertently break you in future manifest updates. Also since the <deploymentProvider> tag is only needed in Shell Visible installed ClickOnce applications this solution does not work for Online ClickOnce Apps.

For out next release we are looking into what we can do to provide a simple public way for the FireFox community to build plugins for ClickOnce support. Stay tuned ...
 

How do ClickOnce Shortcuts help me get ClickOnce support on FireFox?

Anytime a shell visible installed ClickOnce App is downloaded to a machine, we create a ClickOnce shortcut (.AppRef-MS) for the application under Progrmas->Publisher->Product.AppRef-MS.
The contents of this shortcut file look something like this -http://Foo/Bar/Dummy.Application#Dummy.app, Culture=neutral, PublicKeyToken=XXXXXXXXXXXX, processorArchitecture=msil
As you can see it contains the Url to the .application and the identity of the deployment manifest modulo version.

These ClickOnce shortcuts are designed so that they can be emailed to people and when ckicked on, on a machine which does not have the corrsponding application already installed they cause the application to be installed and launched.

Now asuming you have an ClickOnce application (Shell Visible Installed App - Not an Online App) you want to publish to your clients who use FireFox, all you need to do is generate the shortcut file and publish it on your server (If you have both IE and FireFox users you could have a seperate link saying "FireFox users click here" so that IE users still get the default behavior). Once the user click on an .appref-MS in FireFox the Open/Save dialog comes up. Once the .appref-MS has been downloaded to the local machine and run it will invoke ClickOnce, which in turn will download the .application from the URL specified in the shortcut and install the App.

This solution works with out any FireFox changes. Remember though that .appref-MS files can only be generated for Shell Visible Installed ClickOnce Apps.

What about client machines where FireFox is the default browser but the user clicks on the .application in IE?

This scenario just works.

There is one caveat though. If your Application carries a bootstrapper along with it to install prerequisites before the actual ClickOnce install, then your scenario might be broken. The bootstrapper after it has installed the prerequisites starts the actual ClickOnce install by launching the .application URL in the default browser (in this case FireFox) even if the user had originally clicked on an IE session to launch the bootstrapper.

There however is a easy workaround for this [http://channel9.msdn.com/ShowPost.aspx?PostID=138879] which I have recommended to users earlier with good success.

 

Again in closing let me reitterate, we are actively working on having a better XBrowser story for our next release.

Comments are welcome as usual.